Public Utilities Act, public utility security policy and annual security affidavit

Public Utilities Act, 220 ILCS 5/4-101

In force.

A sector security regimes rule binding private bodies.

Obligation class: Security, Governance

As of 27 October 2026.

What it requires

Applies to a public utility regulated by the Illinois Commerce Commission, which you declare by stating that you operate an essential service.
Establish a security policy that includes on-site safeguards to restrict physical or electronic access to critical infrastructure and computerized control and data systems.
Provide the Commission each year an affidavit, signed by a representative of the utility, that states that the utility has a security policy in place and has conducted at least one practice exercise based on the security policy within the 12 months before the date of the affidavit.
If you are an electric public utility, state in the affidavit that you follow, at a minimum, the most current security standards set forth by the North American Electric Reliability Council.

These lines are LexLint's reading of the law's text, as of 27 October 2026.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 4-101 of the Public Utilities Act directs the Commerce Commission to require all public utilities to establish a security policy that includes on-site safeguards to restrict physical or electronic access to critical infrastructure and computerized control and data systems. Each regulated entity must provide to the Commission an annual affidavit signed by a representative of the regulated entity that states that the entity has a security policy in place.

The affidavit must state that the entity has conducted at least one practice exercise based on the security policy within the 12 months immediately preceding the date of the affidavit. For an electric public utility, the affidavit must state that the entity follows, at a minimum, the most current security standards set forth by the North American Electric Reliability Council.

When LexLint raises it

When your app profile says your app runs an essential service.

Back to the example · Lint your app