Law / United States / 
Tennessee
Utility cyber security plans: public utilities regulated by the Tennessee Public Utility Commission
Public Chapter 1111 (2022), Tenn. Code Ann. sec. 65-4-127
In force since .
A sector security regimes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a public utility that provides electric, water, wastewater, or natural gas services and is regulated by the Tennessee Public Utility Commission (reached by declaring that you operate an essential service). Municipal and cooperative utilities fall under a separate part of the Code.
- Prepare and implement a cyber security plan to provide for the protection of the utility's facilities from unauthorized use, alteration, ransom, or destruction of electronic data, by or within one year after the utility is formed, whichever is later.
- Assess and update the plan no less frequently than once every two years to address new threats.
- By July 1 each year, submit documentation of the utility's compliance to the Commission, in writing and under oath by the chief executive officer, president, or other person with an equivalent role. The Commission's rule -.04 requires the filing to include contact information for the employees responsible for cybersecurity, a statement whether annual cybersecurity training is conducted, and a statement whether cybersecurity insurance has been procured.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Tennessee Public Utility Commission enforces the section and orders reasonable sanctions against a utility that fails to comply; fees collected from civil penalties under the section are remitted to the commission for enforcement.
What this law does
A public utility that provides electric, water, wastewater, or natural gas services must prepare and implement a cyber security plan to protect its facilities from unauthorized use, alteration, ransom, or destruction of electronic data, and must annually submit documentation of its compliance to the commission by July 1. A utility must assess and update the plan at least once every two years to address new threats.
The documentation must be made in writing and under oath by the chief executive officer, president, or other person with an equivalent role of the utility. A utility that fails to comply is subject to reasonable sanctions ordered by the commission as described in rule.
The Commission's rule requires the annual filing to include contact information for the employees responsible for cybersecurity, a statement whether the utility conducts annual cybersecurity training, and a statement whether the utility has procured cybersecurity insurance. Public Chapter 1111 was signed into law on .
When LexLint raises it
When your app profile says your app runs an essential service.