Law / United States / 
Pennsylvania
Public Utility Preparedness Through Self Certification, cyber security plan and self certification form
Public Utility Preparedness Through Self Certification, 52 Pa. Code §§ 101.1 to 101.7
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a jurisdictional utility regulated by the Pennsylvania Public Utility Commission, which you declare by stating that you operate an essential service; an entity regulated under the Federal Railroad Safety Act and the Hazardous Materials Transportation Act that filed its own certification of its own plans and compliance by is outside the chapter.
- Develop and maintain written physical security, cyber security, emergency response and business continuity plans.
- Include in the cyber security plan the critical functions requiring automated processing, appropriate backup for application software and data, alternative methods for meeting critical functional responsibilities without information technology, and the critical time period for each information system.
- Review and update the plans annually, maintain and implement an annual testing schedule, and define roles and responsibilities by individual or job function.
- File the Self Certification Form with the Commission when you file your Annual Financial Report or, for a utility not subject to that report, your Annual Assessment Report.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Pennsylvania Public Utility Commission, which reviews each Self Certification Form, may review a utility's plans and may inspect a utility's facility under 66 Pa.C.S. 504 to 506.
What this law does
Chapter 101 requires a jurisdictional utility to develop and maintain appropriate written physical security, cyber security, emergency response and business continuity plans to protect the Commonwealth's infrastructure and ensure safe, continuous and reliable utility service. A jurisdictional utility is a utility subject to the reporting requirements of section 27.10, 29.43, 31.10, 33.103, 57.47, 59.48, 61.28, 63.36 or 65.19 of the Commission's regulations.
A cyber security plan must, at a minimum, include critical functions requiring automated processing, appropriate backup for application software and data, alternative methods for meeting critical functional responsibilities in the absence of information technology capabilities, and a recognition of the critical time period for each information system before the utility could no longer continue to operate. A jurisdictional utility must review and update these plans annually.
A jurisdictional utility must maintain and implement an annual testing schedule of these plans. A jurisdictional utility must demonstrate compliance through submittal of a Self Certification Form, which is available at the Secretary's Bureau and on the Commission's website. A utility under the Annual Financial Report requirements must file the Self Certification Form at the time each Annual Financial Report is filed.
The Commission may review a utility's cyber security plan, physical security plan, emergency response plan and business continuity plan. The chapter does not apply to an entity regulated by the Federal Railroad Safety Act and the Hazardous Materials Transportation Act that, by , submitted a certification that it has its own plans in place and is in compliance with those Acts. Chapter 101 was adopted , effective .
When LexLint raises it
When your app profile says your app runs an essential service.