SECTION 165:35-33-7. Reporting requirements

(a)   Subsequent to the preparation of the initial Plan prepared under OAC 165:35-33-5(a), each utility shall prepare a Plan Update Report by March 1 of each succeeding year, following the same format as the initial Plan with redlines of all new changes, marked "Highly Sensitive Confidential" and kept on site at the utility's business office.

(b)   Each subsequent Plan Update Report shall update the previous year's report by indicating for each specific coded location, all costs and completion dates (actual and projected) for all current and prior additional security measures claimed under this Subchapter.

(c)   The utility is required to report cybersecurity or infrastructure security events that affect customers immediately to the PUD Director or designee.

(d)   For those security measures previously reported that have not yet been completed, revised estimated costs and estimated completion dates shall be provided.

(e)   The Plan Update Report shall also include (by specific coded location) a description of each proposed security measure that has not been previously reported, the estimated costs for each, as well as the estimated completion date for each measure.

(f)   Costs reflected in the initial Plan and in subsequent Plan Update Reports, whether estimated or actual, shall be identified as either capital or expense costs.

(g)   Beginning August 1, 2005 and by March 1 of every year thereafter, and/or when a change is made, each utility shall submit a Certification Letter to the PUD Director, marked as "Highly Sensitive Confidential" and certifying that as of the date of the Certification Letter:

(1)   The utility does not have a Homeland Security and Critical Infrastructure Plan as contemplated and defined by this Subchapter;

(2)   The utility does not have a Homeland Security and Critical Infrastructure Plan as contemplated or defined by this Subchapter but has otherwise taken steps to secure Critical Infrastructure and is not seeking cost recovery under this Subchapter;

(3)   The utility does have a Plan but is not seeking cost recovery; or

(4)   The utility has a Plan and/or has prepared its Plan Update Report updating the Plan and/or previous year's Plan Update Report;

(A)   The redlines contained within the current Plan Update Report encompass in the entirety, all of the changes made to the utility's Plan since the Plan's inception or the previous year's certification; and

(B)   The Plan is available for Commission and/or Attorney General review at the utility's local place of business.

(h)   A utility shall not be required to file its initial Plan or any of its subsequent Plan Update Reports with the Commission. Each utility shall instead, secure and maintain on site, at the utility's local place of business, its initial Plan and all subsequent Plan Update Reports.

[Source: Added at 22 Ok Reg 704, eff 7-1-05; Amended at 36 Ok Reg 620, eff 7-25-19]