Law / United States / 
Michigan
Michigan Public Service Commission Technical Standards for Electric Service, security reporting, annual cybersecurity report
Electric Technical Standards, annual cybersecurity report, Mich. Admin. Code R 460.3205(1)
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds an electric utility or cooperative electric utility subject to the jurisdiction of the Michigan Public Service Commission (reached by declaring that you operate an essential service) (R 460.3101(1)).
- Provide a written or oral annual report, individually or jointly with other electric utilities or cooperatives, to designated members of the commission staff on your cybersecurity program and related risk planning (R 460.3205(1)(a)).
- Include in the report an overview of the program and your approach to cybersecurity awareness and protection, your cybersecurity awareness and specialized training and exercise participation in the previous calendar year, an organizational diagram with primary and secondary cybersecurity emergency contacts, your communications plan for unauthorized actions that cause loss of service, financial harm or a breach of sensitive data, a redacted summary of such actions that occurred, your risk assessment tools and methods, and general information about your current emergency response plans, threat assessments and vulnerability assessments (R 460.3205(1)(a)(i) to (vii)).
- If you are an electric utility rather than a cooperative, add to the annual report an overview of major cybersecurity investments in the previous calendar year (R 460.3205(1)(b)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Under MCL 460.55 the officer or individual in default is also guilty of a misdemeanor and, on conviction, is subject to a fine of not less than 10 dollars nor more than 1,000 dollars, imprisonment in the county jail for not more than 6 months, or both.
Penalty structure
Section 5 of 1919 PA 419 (MCL 460.55), cited as authority for these rules, makes a corporation, joint stock company, association or individual that owns, manages or operates a public utility and refuses or neglects to obey the commission's rules and regulations liable to a penalty of not less than 100 dollars nor more than 1,000 dollars.
- Rule
- Fixed only
- As of
- Minimum
- 100
- Currency
- USD
- Fixed cap
- 1,000
Who enforces it
Enforcement body
The Michigan Public Service Commission, which prescribes regulations for public utilities subject to its jurisdiction and whose rules the operator of a utility must obey.
What this law does
Rule 205 of the Technical Standards for Electric Service requires an electric utility or cooperative to provide a written or oral annual report to designated members of the commission staff regarding its cybersecurity program and related risk planning. The annual report must contain an overview of the program describing the electric utility's or cooperative's approach to cybersecurity awareness and protection.
The annual report must contain a redacted summary of any unauthorized actions that resulted in loss of service, financial harm, or breach of sensitive business or customer data, including the parties notified and any remedial actions undertaken. The annual report must contain general information about current emergency response plans regarding cybersecurity incidents and domestic preparedness strategies.
An electric utility must also include in its annual report to the commission an overview of major investments in cybersecurity during the previous calendar year. The Technical Standards for Electric Service apply to electric utilities and cooperative electric utilities that are subject to the jurisdiction of the public service commission. Rule 205 carries a 2023 amendment effective . Rule 205 of the Technical Standards for Electric Service first took effect on .
The Michigan Public Service Commission adopted the Technical Standards for Electric Service under authority that includes section 5 of 1919 PA 419. A corporation, joint stock company, association or individual that owns, manages or operates a public utility and refuses or neglects to obey the commission's rules and regulations is liable to a penalty of not less than 100 dollars nor more than 1,000 dollars.
The officer or individual in default is also guilty of a misdemeanor and, on conviction, is subject to a fine of not less than 10 dollars nor more than 1,000 dollars, imprisonment in the county jail for not more than 6 months, or both.
When LexLint raises it
When your app profile says your app runs an essential service.