Law / United States / 
Michigan
Michigan Public Service Commission Technical Standards for Electric Service, security reporting, oral report of a cybersecurity incident
Electric Technical Standards, cybersecurity incident report, Mich. Admin. Code R 460.3205(2)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an electric utility or cooperative electric utility subject to the jurisdiction of the Michigan Public Service Commission (reached by declaring that you operate an essential service) (R 460.3101(1)).
- Orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan intelligence operations center as soon as reasonably practicable and before public notification (R 460.3205(2)).
- Make that report if a person intentionally interrupted the production, transmission or distribution of electricity, extorted money or another thing of value from you through a cybersecurity attack, or caused a denial of service lasting more than 12 hours, or if a security breach as the identity theft protection act defines it occurred before public and customer notification (R 460.3205(2)(a) to (d)).
- You may also make the report, at your discretion, for any other cybersecurity incident, attack or threat that you deem notable, unusual or significant (R 460.3205(2)(e)).
- Do not make the oral report where law or a court order prohibits it or official law enforcement personnel instruct otherwise (R 460.3205(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Under MCL 460.55 the officer or individual in default is also guilty of a misdemeanor and, on conviction, is subject to a fine of not less than 10 dollars nor more than 1,000 dollars, imprisonment in the county jail for not more than 6 months, or both.
Penalty structure
Section 5 of 1919 PA 419 (MCL 460.55), cited as authority for these rules, makes a corporation, joint stock company, association or individual that owns, manages or operates a public utility and refuses or neglects to obey the commission's rules and regulations liable to a penalty of not less than 100 dollars nor more than 1,000 dollars.
- Rule
- Fixed only
- As of
- Minimum
- 100
- Currency
- USD
- Fixed cap
- 1,000
Who enforces it
Enforcement body
The Michigan Public Service Commission, which prescribes regulations for public utilities subject to its jurisdiction and whose rules the operator of a utility must obey.
What this law does
As soon as reasonably practicable and before public notification, an electric utility or cooperative must orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan intelligence operations center. The oral report is not required where it is prohibited by law or court order or where official law enforcement personnel instruct otherwise.
The oral report is due if a person intentionally interrupted the production, transmission, or distribution of electricity. The oral report is due if a person extorted money or other thing of value from the electric utility or cooperative through a cybersecurity attack. The oral report is due if a person caused a denial of service in excess of 12 hours.
The oral report is due if a security breach, as defined in section 3 of the identity theft protection act, occurred before public and customer notification. The oral report is also due, at the electric utility's or cooperative's discretion, for any other cybersecurity incident, attack, or threat the utility or cooperative deems notable, unusual, or significant.
The Technical Standards for Electric Service apply to electric utilities and cooperative electric utilities that are subject to the jurisdiction of the public service commission. Rule 205 carries a 2023 amendment effective . Rule 205 of the Technical Standards for Electric Service first took effect on . The Michigan Public Service Commission adopted the Technical Standards for Electric Service under authority that includes section 5 of 1919 PA 419.
A corporation, joint stock company, association or individual that owns, manages or operates a public utility and refuses or neglects to obey the commission's rules and regulations is liable to a penalty of not less than 100 dollars nor more than 1,000 dollars. The officer or individual in default is also guilty of a misdemeanor and, on conviction, is subject to a fine of not less than 10 dollars nor more than 1,000 dollars, imprisonment in the county jail for not more than 6 months, or both.
When LexLint raises it
When your app profile says your app runs an essential service.