Law / United States / 
Utah
Safe Drinking Water Act, report of a security breach at a community water system
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
As of .
What it requires
- Applies to a supplier of a community water system; declare operates_essential_service where you operate such a system.
- Report a security breach to the Utah Cyber Center no later than two hours after you discover it. A security breach is an incident that threatens the security of the community water system with the potential to impact the quality or quantity of delivered water, and includes a breach of an operational technology or control system and an unauthorized attempt to delete, disable, destroy or override data, an application, a device or a computer network.
These lines are LexLint's reading of the law's text, as of .
What this law does
A supplier of a community water system must report a security breach to the Utah Cyber Center no later than two hours after the supplier discovers it. A security breach is an incident that threatens the security of a community water system with the potential to impact the quality or quantity of delivered water.
A security breach includes a breach of an operational technology or control system and an unauthorized attempt to delete, disable, destroy or override data, an application, a device or a computer network. The Utah Cyber Center must notify the division of a reported security breach not later than one day after receiving the report from the supplier. The section was enacted by Chapter 16 of the 2026 General Session.
When LexLint raises it
When your app profile says your app runs an essential service.