Law / United States / 
New Jersey
Board of Public Utilities Order on Utility Cyber Security Program Requirements
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- Applies to the electric, natural gas, and water and wastewater utilities the order names; declare operates_essential_service where you operate such a utility.
- Maintain a Cyber Security Program that defines and implements organizational oversight, accountabilities and responsibilities for cyber risk management and establishes policies, plans, processes and procedures for identifying and mitigating risk to your industrial control systems and to customer information systems that contain personal information as defined at N.J. Stat. Ann. 56:8-161.
- Annually inventory critical systems and assess and prioritize cyber risks to them, implement administrative, technical and compensating controls, and annually review the risk assessment methodology.
- Monitor log files of critical systems, monitor threat and vulnerability information sources including vendor and industry information-sharing advisories, and review vendor security patches in a timely manner.
- Establish a Cyber Security Incident Response Plan that includes log file retention protocols, and test it with an exercise at least once every 24 calendar months.
- Develop and implement a cyber security awareness program, reviewed biannually, and training for individuals with access credentials to industrial control systems and for administrators of customer information systems that contain personal information.
- Meet all requirements other than the initial steps no later than , and certify compliance each year, signed by executive-level personnel with authority for the program; a certification of compliance with the NERC CIP standards suffices for critical systems subject to them.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The New Jersey Board of Public Utilities, through its Reliability and Security Division staff, which monitors utilities performance and compliance with the Cyber Security Program requirements.
What this law does
The Board of Public Utilities directed electric, natural gas, and water and wastewater utilities to implement the order's Cyber Security Program requirements at a minimum. The order's covered assets are industrial control systems and customer information systems that contain personal information. A utility must have a Cyber Security Program that defines and implements organizational oversight, accountabilities, and responsibilities for cyber risk management activities.
The program must annually inventory critical systems and assess and prioritize cyber risks to them. A utility must monitor log files of critical systems. A utility must establish a Cyber Security Incident Response Plan and conduct an exercise to test it once every 24 calendar months at a minimum. A utility must develop and implement a cyber security awareness program. Utilities must comply with all other requirements no later than .
Utilities must certify compliance with the minimum requirements on an annual basis. Certification of compliance with the North American Electric Reliability Corporation Critical Infrastructure Protection standards is sufficient for the annual certification for critical systems subject to those standards. The order states that its measures supersede the Board's 2011 Cyber Security related order. The order is effective on .
When LexLint raises it
When your app profile says your app runs an essential service.