Law / United States / 
Michigan
Michigan Public Service Commission Technical Standards for Gas Service, security reporting, oral report of a cybersecurity incident
Gas Technical Standards, cybersecurity incident report, Mich. Admin. Code R 460.2324(2)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a gas utility that operates in Michigan and is subject to the jurisdiction of the Michigan Public Service Commission (reached by declaring that you operate an essential service) (R 460.2302(1)).
- Orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan fusion center as soon as reasonably practicable and prior to any public notification (R 460.2324(2)).
- Make that report if a person intentionally interrupted the production, transmission or distribution of natural gas, extorted money or another thing of value from you through a cybersecurity attack, or caused a denial of service lasting more than 12 hours, or if a security breach as the identity theft protection act defines it occurred before public and customer notification (R 460.2324(2)(a) to (d)).
- You may also make the report, at your discretion, for any other cybersecurity incident, attack or threat that you deem notable, unusual or significant (R 460.2324(2)(e)).
- Do not make the oral report where law or a court order prohibits it or official law enforcement personnel instruct otherwise (R 460.2324(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Under MCL 460.55 the officer or individual in default is also guilty of a misdemeanor and, on conviction, is subject to a fine of not less than 10 dollars nor more than 1,000 dollars, imprisonment in the county jail for not more than 6 months, or both.
Penalty structure
Section 5 of 1919 PA 419 (MCL 460.55), cited as authority for these rules, makes a corporation, joint stock company, association or individual that owns, manages or operates a public utility and refuses or neglects to obey the commission's rules and regulations liable to a penalty of not less than 100 dollars nor more than 1,000 dollars.
- Rule
- Fixed only
- As of
- Minimum
- 100
- Currency
- USD
- Fixed cap
- 1,000
Who enforces it
Enforcement body
The Michigan Public Service Commission, which prescribes regulations for public utilities subject to its jurisdiction and whose rules the operator of a utility must obey.
What this law does
As soon as reasonably practicable and prior to any public notification, a utility must orally report the confirmation of a cybersecurity incident to a designated member of the commission staff and to the Michigan fusion center. The oral report is not required where it is prohibited by law or court order or where official law enforcement personnel instruct otherwise. The oral report is due if a person intentionally interrupted the production, transmission, or distribution of natural gas.
The oral report is due if a person extorted money or other things of value from the utility through a cybersecurity attack. The oral report is due if a person caused a denial of service in excess of 12 hours. The oral report is due if a security breach, as defined in section 3(b) of the identity theft protection act, occurred before public and customer notification.
The oral report is also due, at the utility's discretion, for any other cybersecurity incident, attack, or threat the utility deems notable, unusual, or significant. The Technical Standards for Gas Service apply to a gas utility that operates within the state of Michigan and that is subject to the jurisdiction of the commission. Rule 24 took effect on .
The Michigan Public Service Commission adopted the Technical Standards for Gas Service under authority that includes section 5 of 1919 PA 419. A corporation, joint stock company, association or individual that owns, manages or operates a public utility and refuses or neglects to obey the commission's rules and regulations is liable to a penalty of not less than 100 dollars nor more than 1,000 dollars.
The officer or individual in default is also guilty of a misdemeanor and, on conviction, is subject to a fine of not less than 10 dollars nor more than 1,000 dollars, imprisonment in the county jail for not more than 6 months, or both.
When LexLint raises it
When your app profile says your app runs an essential service.