SECTION 165:35-33-1. Purpose and scope

(a)   The purpose of this Subchapter is to require utilities to take all reasonable measures necessary to protect their critical infrastructures from extended interruption of service from all extraordinary events, natural and man-made.

(b)   The Commission requires electric utilities to develop, implement, and maintain Homeland Security and Critical Infrastructure Plans according to the industry standards enumerated in sub-section (d) below.

(c)   To the extent that a utility seeks to recover costs for security measures outside of a general rate review for the implementation of Homeland Security and/or Critical Infrastructure protections, the utility shall comply with all provisions of this Subchapter.

(d)   Each electric utility serving Oklahoma jurisdictional ratepayers is required to follow the most current applicable North American Electric Reliability Corporation's (NERC's) Security Guidelines and Standards or equivalent cybersecurity framework, as may be amended from time to time, for use as guidelines for protecting the utility's Critical Infrastructure from extended service interruption.

(e)   Each electric utility seeking to recover costs for security measures from Oklahoma jurisdictional ratepayers outside of a general rate review shall develop, implement, and maintain a Critical Infrastructure and Security Plan as further set forth within this Subchapter.

(f)   If the utility has implemented a Security Plan or process in accordance with the applicable industry guidelines but is not seeking or receiving cost recovery for security-related costs, the utility shall submit the Certification Letter required by OAC 165:35-33-7(f) and the Plan shall be subject to review pursuant to the Authorized Participation and Confidentiality provisions of OAC 165:35-33-10 and OAC 165:35-33-11. The utility is not otherwise required to comply with the provisions of this Subchapter.

(g)   The Commission retains its jurisdictional and supervisory authority to address the reasonableness and/or prudence of any proposed security cost recovery.

(h)   Nothing in this subchapter shall relieve any utility from any duty otherwise prescribed by the laws of the State of Oklahoma or this Commission's rules.

(i)   Nothing in this Subchapter is intended to divest the utility of its right to object to any discovery requests from intervenors seeking access to "Highly Sensitive Confidential" materials.

(j)   If any provision of this Subchapter is held invalid, such invalidity shall not affect other provisions or applications of this Subchapter which can be given effect without the invalid provision or application, and to this end, the provisions of this Subchapter are declared to be severable.

[Source: Added at 22 Ok Reg 704, eff 7-1-05; Amended at 31 Ok Reg 1030, eff 9-12-14; Amended at 36 Ok Reg 620, eff 7-25-19]