Law / United States / 
Iowa
Water utilities, notice to the Utilities Commission of an incident including a cyberattack
Iowa Utilities Commission Rule 199-21.9, incident reports regarding water service
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds a water utility subject to the jurisdiction of the Iowa Utilities Commission, which you declare by stating that you operate an essential service: a public utility furnishing water by piped distribution system to the public for compensation, other than a county or an entity organized under chapter 28E composed entirely of counties. The Code chapter does not apply to municipally owned waterworks, waterworks with fewer than two thousand customers, joint water utilities, rural water districts or cooperative water associations.
- Notify the Iowa Utilities Commission about any incident involving a cyberattack affecting the well-being of the utility, its customers, or the environment, as well as a waterborne illness, a boil water advisory, a contamination event, a low-pressure event of less than 20 psi that negatively affects water quality, or a flood event affecting the plant or distribution system.
- Notify the commission immediately, or as soon as practical, of any reportable incident, by emailing the commission duty officer or, when email is not available, by calling the duty officer, and give the utility's name, the name and telephone number of the person making the report and of a contact person who knows about the incident, the location and time of the incident, the number of deaths or personal injuries and their extent, the number of services interrupted, and a summary of what is known about the likely cause and the estimated extent of damage.
- Notify the commission when the incident has ended and normal water service has been restored.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 476.51 allows the commission to levy a civil penalty of $100 to $2,500 per violation on a public utility that violates the same provision, rule or order after written notice of a specific violation, and $1,000 to $10,000 per violation if the violation is willful. Each violation is a separate offense, and each day a violation continues after the time for compliance in the notice is a separate and distinct offense.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The Iowa Utilities Commission, which may levy a civil penalty on a public utility that violates the same provision of the chapter, the same commission rule or the same commission order after written notice of a specific violation (Iowa Code 476.51(1)).
What this law does
A water utility must notify the Iowa Utilities Commission about any incident involving a cyberattack affecting the well-being of the utility, its customers, or the environment, and about five other listed kinds of incident. The utility must notify the commission immediately, or as soon as practical, of any reportable incident, by emailing the commission duty officer or, when email is not available, by calling the duty officer.
The utility will notify the commission when the incident has ended and normal water service has been restored. The chapter's term utility means a water, sanitary sewage or storm water drainage public utility under Iowa Code section 476.1(2) and does not include a county or an entity organized under chapter 28E that is composed entirely of counties.
The Iowa Code chapter on utility regulation does not apply to municipally owned waterworks, waterworks having less than two thousand customers, joint water utilities, rural water districts and cooperative water associations.
A public utility that, after written notice by the commission of a specific violation, violates the same provision of the chapter, the same commission rule or the same provision of a commission order is subject to a civil penalty, which the commission may levy, of not less than one hundred dollars nor more than two thousand five hundred dollars per violation.
A public utility that willfully violates the same provision, rule or order after that written notice is subject to a civil penalty of not less than one thousand dollars nor more than ten thousand dollars per violation.
When LexLint raises it
When your app profile says your app runs an essential service.