Law / United States / 
New Jersey
Water Quality Accountability Act, water purveyor cybersecurity incident report to the NJCCIC
N.J. Stat. Ann. 58:31-4.2 (P.L. 2021, c.262, section 4)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
As of .
What it requires
- Applies to a water purveyor, meaning any person that owns a public community water system with more than 500 service connections; declare operates_essential_service where you own and operate such a system.
- Report to the New Jersey Cybersecurity and Communications Integration Cell, promptly after an employee is made aware of the incident and in accordance with all applicable laws, rules and regulations, any cybersecurity incident that compromises the confidentiality, integrity, availability or privacy of your utility billing, communications, data management or business information systems or the information on them.
- Report to the Cell, on the same clock, any cybersecurity incident against your industrial control system, including monitoring, operations and centralized control systems, that adversely impacts, disables or manipulates infrastructure, resulting in loss of service, contamination of finished water or damage to infrastructure.
- After the Cell causes an audit of your cybersecurity program and your response to a reported incident, submit the audit and any corrective action plans derived from it to the Cell; the audit is conducted by a qualified and independent cybersecurity company at your expense.
These lines are LexLint's reading of the law's text, as of .
What this law does
A water purveyor must report to the New Jersey Cybersecurity and Communications Integration Cell, promptly after an employee is made aware of a cybersecurity incident. The duty begins 90 days after the effective date of chapter 262 of the Laws of 2021.
The duty covers any cybersecurity incident that compromises the confidentiality, integrity, availability, or privacy of the water purveyor's utility billing, communications, data management, or business information systems, or the information on them. The duty also covers any cybersecurity incident against the industrial control system that adversely impacts, disables, or manipulates infrastructure, resulting in loss of service, contamination of finished water, or damage to infrastructure.
No later than 30 days after receiving a report, the Cell must cause the water purveyor's cybersecurity program and its response to the incident to be audited. The audit is conducted by a qualified and independent cybersecurity company at the water purveyor's expense. Following the audit, the water purveyor must submit the audit and any corrective action plans to the Cell. Chapter 262 was approved on and took effect immediately.
When LexLint raises it
When your app profile says your app runs an essential service.