Law / United States / 
Iowa
Sanitary sewage utilities, notice to the Utilities Commission of an incident including a cyberattack
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds a sanitary sewage utility subject to the jurisdiction of the Iowa Utilities Commission, which you declare by stating that you operate an essential service: a public utility furnishing sanitary sewage disposal by piped collection system to the public for compensation, other than a county or an entity organized under chapter 28E composed entirely of counties. The Code chapter does not apply to municipally owned sanitary sewage or storm water drainage systems, sanitary districts or districts organized under chapter 468.
- Notify the Iowa Utilities Commission about any incident involving a cyberattack affecting the well-being of the utility, its customers, or the environment, as well as an unlawful or uncontained release of sewage into the environment, a flood event affecting the plant or collection system, or any event that causes serious adverse impact on the health of people or the environment or interrupts service to the customer.
- Notify the commission immediately, or as soon as practical, of any reportable incident, by emailing the commission duty officer or, when email is not available, by calling the duty officer, and give the utility's name, the name and telephone number of the person making the report and of a contact person who knows about the incident, the location and time of the incident, the number of deaths or personal injuries and their extent, the number of services interrupted, and a summary of what is known about the likely cause and the estimated extent of damage.
- Notify the commission when the incident has ended and normal sanitary sewage service has been restored.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 476.51 allows the commission to levy a civil penalty of $100 to $2,500 per violation on a public utility that violates the same provision, rule or order after written notice of a specific violation, and $1,000 to $10,000 per violation if the violation is willful. Each violation is a separate offense, and each day a violation continues after the time for compliance in the notice is a separate and distinct offense.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The Iowa Utilities Commission, which may levy a civil penalty on a public utility that violates the same provision of the chapter, the same commission rule or the same commission order after written notice of a specific violation (Iowa Code 476.51(1)).
What this law does
A sanitary sewage utility must notify the Iowa Utilities Commission about any incident involving a cyberattack affecting the well-being of the utility, its customers, or the environment, and about three other listed kinds of incident. The utility must notify the commission immediately, or as soon as practical, of any reportable incident, by emailing the commission duty officer or, when email is not available, by calling the duty officer.
The utility will notify the commission when the incident has ended and normal sanitary sewage service has been restored. The chapter's term utility means a water, sanitary sewage or storm water drainage public utility under Iowa Code section 476.1(2) and does not include a county or an entity organized under chapter 28E that is composed entirely of counties.
The Iowa Code chapter on utility regulation does not apply to municipally owned sanitary sewage or storm water drainage systems, sanitary districts or districts organized under chapter 468.
A public utility that, after written notice by the commission of a specific violation, violates the same provision of the chapter, the same commission rule or the same provision of a commission order is subject to a civil penalty, which the commission may levy, of not less than one hundred dollars nor more than two thousand five hundred dollars per violation.
A public utility that willfully violates the same provision, rule or order after that written notice is subject to a civil penalty of not less than one thousand dollars nor more than ten thousand dollars per violation.
When LexLint raises it
When your app profile says your app runs an essential service.