Law / United States / 
Tennessee
Utility cybersecurity incident notification to the Tennessee Public Utility Commission
Tennessee Public Utility Commission Rule -.06, adopted under Tenn. Code Ann. sec. 65-4-127
In force.
A vulnerability and incident reporting rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a public utility that provides electric, water, wastewater, or natural gas services and is regulated by the Tennessee Public Utility Commission (reached by declaring that you operate an essential service).
- Electronically notify the Commission's Executive Director of any cybersecurity incident that results in interruption of service within 72 hours after discovery and confirmation.
- Unless law enforcement prohibits or recommends against notice to avoid compromising an investigation, notify on that clock; where it does, notify within 24 hours after the restriction is lifted by law enforcement.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Tennessee Public Utility Commission may, after a hearing, impose reasonable sanctions, including civil and monetary penalties, against a utility in non-compliance with the rules.
Settledness
- As of
- Open questions
- Does the sanction rule at -.05, which defines non-compliance by reference to the annual filings, reach a failure to give the 72-hour incident notice?
What this law does
A utility must electronically notify the Commission's Executive Director of any cybersecurity incident that results in interruption of service within 72 hours after discovery and confirmation. Where law enforcement prohibits notice or recommends against it to avoid compromising an investigation, notification is required within 24 hours after the restriction is lifted.
The rule defines a cybersecurity incident to include an event that is under investigation as a possible incident without final determination of its root cause or nature. The rules apply to a public utility that provides electric, water, wastewater, or natural gas services. After a hearing, the Commission may impose reasonable sanctions, including civil and monetary penalties, against a utility in non-compliance with the rules.
Commission Staff has cited Rule -.04, which sets the information required in the annual filing, in a complaint against a utility that did not file its cybersecurity documentation by .
When LexLint raises it
When your app profile says your app runs an essential service.