Law / United States / 
New Jersey
Board of Public Utilities Order on Utility Cyber Security Program Requirements, incident reporting
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- Applies to the electric, natural gas, and water and wastewater utilities the order names; declare operates_essential_service where you operate such a utility.
- Report to the Board's Reliability and Security Division staff, through the New Jersey Cybersecurity and Communications Integration Cell, within 6 hours of detection, any person accessing an industrial control system without authorization or exceeding authorized access, any unauthorized programs, information, code or commands discovered on an industrial control system, and any extortion of money or other thing of value by threatening damage to an industrial control system.
- Report to the Division staff, through the Cell, unusual cyber activity that has the potential to compromise critical systems and for which controls are ineffective.
- Copy the Division staff on notifications to New Jersey law enforcement agencies about information breaches involving customers' personally identifiable information, to the extent State law requires those notifications.
These lines are LexLint's reading of the law's text, as of .
What this law does
Utilities must report cyber events relating to industrial control systems to the Board's Reliability and Security Division staff. The reportable events include a person accessing the control system without authorization or exceeding authorized access. The reportable events include unauthorized programs, information, code or commands discovered on a control system.
The reportable events include a person extorting money or another thing of value by threatening to cause damage to the control system. Reports must be made within 6 hours of the detection of an incident. Reports must be submitted through the New Jersey Cybersecurity and Communications Integration Cell. Utilities must also report unusual cyber activity that has the potential to compromise critical systems and for which controls are ineffective.
Utilities must copy the Division staff on notifications to State law enforcement about information breaches involving customers' personally identifiable information, to the extent State law requires those notifications. Utilities must join the Cell and create a cyber security incident reporting process no later than 60 days after the effective date of the order.
When LexLint raises it
When your app profile says your app runs an essential service.