Law / United States / 
Oklahoma
Electric utilities: homeland security and critical infrastructure plan and annual certification
OAC 165:35-33, electric utility homeland security and critical infrastructure rules
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a electric utility serving Oklahoma jurisdictional ratepayers under the Corporation Commission's rules, which you declare by stating that you operate an essential service.
- Follow the most current applicable North American Electric Reliability Corporation's (NERC's) Security Guidelines and Standards or an equivalent cybersecurity framework as guidelines for protecting your critical infrastructure from extended service interruption.
- Prepare and make available for inspection a Homeland Security and Critical Infrastructure Plan, marked Highly Sensitive Confidential, that designates your critical infrastructure facilities, sets out the measures to secure them and follows that framework with a defined cybersecurity strategy.
- If you seek to recover security costs from Oklahoma jurisdictional ratepayers outside a general rate review, develop, implement and maintain a Critical Infrastructure and Security Plan, update it by March 1 each year, and keep the plan and each update on site at your business office.
- Submit a Certification Letter to the Public Utility Division Director by March 1 each year, and whenever a change is made, certifying whether you have a security plan and whether you are seeking cost recovery.
These lines are LexLint's reading of the law's text, as of .
What this law does
The Commission requires electric utilities to develop, implement, and maintain Homeland Security and Critical Infrastructure Plans in accordance with the industry standards enumerated in the subchapter.
Each electric utility serving Oklahoma jurisdictional ratepayers is required to follow the most current applicable North American Electric Reliability Corporation's (NERC's) Security Guidelines and Standards or equivalent cybersecurity framework as guidelines for protecting its critical infrastructure from extended service interruption.
Each electric utility is required to prepare and make available for inspection a Homeland Security and Critical Infrastructure Plan prepared with reference to those guidelines or an equivalent cybersecurity framework, with a defined cybersecurity strategy. Each utility must submit a Certification Letter to the PUD Director by March 1 of every year, and when a change is made, certifying whether it has a Homeland Security and Critical Infrastructure Plan and whether it is seeking cost recovery.
Each electric utility must submit the Certification Letter required by the subchapter, and the utility is not otherwise required to comply with the provisions of the subchapter.
When LexLint raises it
When your app profile says your app runs an essential service.