Law / United States / 
New Jersey
Water Quality Accountability Act, water purveyor cybersecurity program (sections 4 and 4.1 as rewritten in 2021)
N.J. Stat. Ann. 58:31-2, 58:31-4 and 58:31-4.1 (P.L. 2017, c.133, as amended by P.L. 2021, c.262)
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a water purveyor, meaning any person that owns a public community water system with more than 500 service connections; declare operates_essential_service where you own and operate such a system.
- Develop a cybersecurity program, in accordance with the requirements of the New Jersey Cybersecurity and Communications Integration Cell, that defines and implements accountabilities and responsibilities for cyber risk management and establishes policies, plans, processes and procedures for identifying and mitigating cyber risk to the water system.
- In that program, identify the individual chiefly responsible for executing it, conduct risk assessments and implement appropriate controls, maintain situational awareness of cyber threats and vulnerabilities, and create and exercise incident response and recovery plans.
- Update the program to apply to all of the water system's industrial control systems and to reasonably conform to the most recent version of the NIST Cybersecurity Framework, the CIS Critical Security Controls, or the ISO and IEC 27000 family of standards, and when a framework revision is published revise the program and submit it to the Cell no later than 180 days after publication.
- Submit a copy of the program to the Cell, join the Cell and create a cybersecurity incident reporting process, and obtain a cybersecurity insurance policy that meets any applicable standards the Board of Public Utilities adopts.
- Each year, submit to the Board of Public Utilities, the Department of Environmental Protection and the Cell a certification of compliance, signed by the responsible corporate officer of a privately held system, the executive director of an authority, or the mayor or chief executive officer of a municipally owned system.
- On the request of the Board, the Department or the Cell, provide proof of compliance in the form and manner they determine.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Department of Environmental Protection and the Board of Public Utilities, with audits caused by the New Jersey Cybersecurity and Communications Integration Cell; violations take the penalties and remedies of section 10 of chapter 224 of the Laws of 1977.
What this law does
A water purveyor is any person that owns a public community water system with more than 500 service connections. Each water purveyor must develop a cybersecurity program in accordance with requirements established by the New Jersey Cybersecurity and Communications Integration Cell.
As part of the program a water purveyor must identify the individual chiefly responsible, conduct risk assessments and implement appropriate controls, maintain situational awareness of cyber threats and vulnerabilities, and create and exercise incident response and recovery plans. A water purveyor must submit a copy of its cybersecurity program to the New Jersey Cybersecurity and Communications Integration Cell.
Each water purveyor must join the New Jersey Cybersecurity and Communications Integration Cell and create a cybersecurity incident reporting process. Each water purveyor must obtain a cybersecurity insurance policy that meets any applicable standards adopted by the Board of Public Utilities.
A water purveyor must update its cybersecurity program to apply to all of the water system's industrial control systems and to reasonably conform to the most recent version of the NIST Cybersecurity Framework, the CIS Critical Security Controls, or the ISO and IEC 27000 family of standards. Each year each water purveyor must submit a certification to the Board of Public Utilities, the Department of Environmental Protection and the Cell.
A water purveyor must, on request of the Board, the Department or the Cell, provide proof of compliance. The Cell must cause an audit of any public community water system that fails to submit a cybersecurity program. A violation is subject to the penalties and other remedies in section 10 of chapter 224 of the Laws of 1977. The Water Quality Accountability Act was approved on . Chapter 262 of the Laws of 2021 amended section 4 of the Act. Chapter 262 was approved on and took effect immediately.
When LexLint raises it
When your app profile says your app runs an essential service.