Law / United States / 
Utah
Safe Drinking Water Act, emergency response plan with cybersecurity measures for a community water system
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a supplier of a community water system; declare operates_essential_service where you operate such a system.
- Complete an emergency response plan by , and by July 1 annually thereafter if the system serves a population of 3,300 or greater, or by , and annually thereafter if it serves fewer than 3,300; report to the division on or before July 1 of each year whether the plan is complete.
- Include in the plan a requirement to support and regularly update software used in a control system, deploy and maintain network protection for a control system as needed, adopt best practices for secure authentication, provide annual cybersecurity training to an employee who has regular access to an operational technology or control system, complete an internal assessment of security vulnerabilities and implement corrective controls, remove access to operational technology and control systems promptly from a terminated employee, and ensure an automated operational technology or control system can be operated manually.
- Make the plan, any incident report and any related information available to the director on request, and comply with a security directive by the director.
These lines are LexLint's reading of the law's text, as of .
What this law does
A supplier of a community water system serving a population of 3,300 or greater must complete an emergency response plan by , and by July 1 annually thereafter. A supplier of a community water system serving a population less than 3,300 must complete an emergency response plan by , and annually thereafter. The plan must include a requirement to support and regularly update software used in a control system.
The plan must include a requirement to provide annual cybersecurity training to an employee who has regular access to an operational technology or control system. The plan must include a requirement to complete an internal assessment of the system's security vulnerabilities and implement corrective controls. A supplier must report to the division on or before July 1 of each year whether it has completed an emergency response plan.
When LexLint raises it
When your app profile says your app runs an essential service.