Critical Infrastructure

“shall adopt by 17 January 2026 a strategy for enhancing the resilience of critical entities (the ‘strategy’).”

“shall update their strategies at least every four years.”

“shall account for the relevant natural and man-made risks, including those of a cross-sectoral or cross-border nature, accidents, natural disasters, public health emergencies and hybrid threats or other antagonistic threats, including terrorist offences as provided for in Directi”

“shall establish a list of the critical entities identified pursuant to paragraph 2 and ensure that those critical entities are notified that they have been identified as critical entities within one month of that identification.”

“shall inform critical entities in the sectors set out in points 3, 4 and 8 of the table in the Annex that they have no obligations under Chapters III and IV, unless national measures provide otherwise.”

“shall support critical entities in enhancing their resilience.”

“shall ensure that critical entities carry out a risk assessment within nine months of receiving the notification referred to in Article 6(3), whenever necessary subsequently, and at least every four years, on the basis of Member State risk assessments and other relevant sources o”

“shall ensure that critical entities take appropriate and proportionate technical, security and organisational measures to ensure their resilience, based on the relevant information provided by Member States on the Member State risk assessment and on the outcomes of the critical e”

“are required to undergo such background checks, and laying down appropriate training requirements and qualifications;”

“shall ensure that critical entities notify the competent authority, without undue delay, of incidents that significantly disrupt or have the potential to significantly disrupt the provision of essential services.”

“shall, where useful and without imposing or discriminating in favour of the use of a particular type of technology, encourage the use of European and international standards and technical specifications relevant to the security and resilience measures applicable to critical entit”

“shall be considered a critical entity of particular European significance where it: (a) has been identified as a critical entity pursuant to Article 6(1);”

“shall also inform the Critical Entities Resilience Group of the main findings of the advisory mission and the lessons learned with a view to promoting mutual learning.”

“shall, where appropriate, support Member States and critical entities in complying with their obligations under this Directive.”

“shall adopt and publish the measures necessary to comply with this Directive.”

“shall not prevent Member States from subjecting products with digital elements to additional cybersecurity requirements for the procurement or use of those products for specific purposes, including where those products are procured or used for national security or defence purpose”

“shall promote measures and strategies aiming to: (a) develop cybersecurity skills and create organisational and technological tools to ensure sufficient availability of skilled professionals in order to support the activities of the market surveillance authorities and conformity ”

“shall be deemed to comply with the cybersecurity requirements set out in Article 15 of that Regulation where: (a) those products fulfil the essential cybersecurity requirements set out in Part I of Annex I;”

“shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I.”

“shall notify any actively exploited vulnerability contained in the product with digital elements that it becomes aware of simultaneously to the CSIRT designated as coordinator, in accordance with paragraph 7 of this Article, and to ENISA.”

“shall prepare, every 24 months, a technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group established pursuant to Article 14 of Directive (EU) 2022/2555.”

“shall not subject the notifying natural or legal person to increased liability.”

“shall be presumed to be in conformity with the essential cybersecurity requirements set out in Annex I covered by those standards or parts thereof.”

“shall designate a notifying authority that shall be responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and their monitoring, including compliance with Article 41.”

“shall inform the Commission of their procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies, and of any changes thereto.”

“shall restrict, suspend or withdraw notification as appropriate, depending on the seriousness of the failure to meet those requirements or fulfil those obligations.”

“shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council.”

“shall also apply to all entities who are not established in the Union but who deliver services to entities in the Union, provided they have been identified as high or critical-impact entities by the competent authorities in accordance with Article 24(2).”

“shall develop, in cooperation with the EU DSO entity, proposals for the terms and conditions or methodologies pursuant to paragraph 2, or for plans pursuant to paragraph 3.”

“shall monitor the implementation of this Regulation in accordance with Article 32(1) of Regulation (EU) 2019/943 and Article 4(2) of Regulation (EU) 2019/942.”

“shall establish a non-binding cybersecurity benchmarking guide.”

“shall submit a proposal for the cybersecurity risk assessment methodologies at Union level, at regional level and at Member State level.”

“shall, without prejudice to Article 22 of Directive (EU) 2022/2555, perform a Union-wide cybersecurity risk assessment and draw up a draft Union-wide cybersecurity risk assessment report.”

“shall include: (a) an assessment of the possible consequences of a cyber-attack using the metrics defined in the cybersecurity risk assessment methodology developed pursuant to Article 18(2), (3) and (4), and approved pursuant to Article 8;”

“shall perform a regional cybersecurity risk assessment for each system operation region using the methodologies developed pursuant to Article 19, and approved pursuant to Article 8, to identify, analyse, and evaluate the risks of cyber-attacks affecting the operational security o”

“shall develop a regional cybersecurity risk mitigation plan for each system operation region.”

“shall provide to the Electricity Coordination Group a report on the outcome of the assessment of cybersecurity risks with regard to cross-border electricity flows (the ‘comprehensive cross-border electricity cybersecurity risk assessment report’).”

“shall perform cybersecurity risk management for all its assets in its high-impact and critical-impact perimeters.”

“shall, within 12 months after the notification of the high-and critical-impact entities pursuant to Article 24(6), and every three years thereafter, provide to the competent authority a report containing the following information: (1) a list of controls selected for the entity-le”

“shall be composed of the following controls and cybersecurity management system: (a) the minimum cybersecurity controls, developed in accordance with”

“shall apply the minimum cybersecurity controls pursuant to paragraph 1 point (a) within their high-impact perimeter.”

“shall decide whether a derogation from the minimum and advanced cybersecurity controls is to be granted.”

“shall be able to demonstrate its compliance with the cybersecurity management system and the minimum or advanced cybersecurity controls at the request of the competent authority.”

“shall establish a cybersecurity management system, and review it every three years thereafter, to: (a) determine the scope of the cybersecurity management system considering interfaces and dependencies with other entities;”

“shall develop a proposal for minimum and advanced cybersecurity controls in the supply chain that mitigate the supply chain risks identified in the Union-wide cybersecurity risk assessments, supplementing the minimum and advanced cybersecurity controls developed pursuant to Artic”

“shall develop a proposal for a matrix to map the controls set out in Article 28(1), points (a) and (b) against selected European and international standards as well as relevant technical specifications (‘the mapping matrix’).”

“shall develop, in a work programme to be established and updated each time a regional cybersecurity risk assessment report is adopted, sets of non-binding cybersecurity procurement recommendations that high-impact and critical-impact entities may use as a basis for the procuremen”

“shall closely cooperate with ENISA in providing the sector-specific guidance included in non-binding cybersecurity procurement recommendations pursuant to paragraph 1.”

“shall assess the level of confidentiality of that information and inform the entity about the outcome of its assessment without undue delay and not later than within 24 hours of receipt of the information;”

“shall disseminate that information or any other information of importance for preventing, detecting, responding to or mitigating the related risk to critical-impact and high-impact entities in its Member State and, where appropriate, to all concerned CSIRTs and to its national si”

“shall develop the necessary capabilities to handle detected cyber-attacks with the necessary support from the relevant competent authority, the ENTSO for Electricity and the EU DSO entity.”

“shall jointly create an ad hoc cross-border crisis coordination group.”

“shall in close cooperation with ENISA, the ENTSO for Electricity, the EU DSO entity, CS-NCAs, competent authorities, RP-NCAs, the NRAs and the NIS national cyber crisis management authorities, develop a Union-level cybersecurity crisis management and response plan for the electri”

“shall cooperate with ENISA to develop Electricity Cybersecurity Early Alert Capabilities (ECEAC) as part as the assistance to Member States pursuant to Articles 6(2) and (7) of Regulation (EU) 2019/881.”

“shall perform a cybersecurity exercise including one or more scenarios with cyber-attacks affecting cross-border electricity flows directly or indirectly and related to the risks identified during the cybersecurity risk assessments at Member State and entity levels in accordance ”

“shall organise a regional cybersecurity exercise.”

“shall participate in the cybersecurity exercises referred to in Article 43(1) and (2) and in Article 44(1) when they provide services for the critical-impact entity in the area corresponding with the scope of the relevant cybersecurity exercise.”

“shall ensure that information provided, received, exchanged or transmitted under this Regulation is accessible only on a need-to-know basis and in accordance with relevant Union and national rules on security of information.”

“shall not apply to such entities.”

“shall designate or establish one or more competent authorities responsible for the management of large-scale cybersecurity incidents and crises (cyber crisis management authorities).”

“shall designate or establish one or more CSIRTs.”

“shall cover at least the sectors, subsectors and types of entity referred to in Annexes I and II, and shall be responsible for incident handling in accordance with a well-defined process.”

“shall comply with the following requirements: (a) the CSIRTs shall ensure a high level of availability of their communication channels by avoiding single points of failure, and shall have several means for being contacted and for contacting others at all times;”

“shall cooperate with each other with regard to the fulfilment of the obligations laid down in this Directive.”

“shall be composed of representatives of the CSIRTs designated or established pursuant to Article 10 and the computer emergency response team for the Union’s institutions, bodies and agencies (CERT-EU).”

“shall be composed of the representatives of Member States’ cyber crisis management authorities as well as, in cases where a potential or ongoing large-scale cybersecurity incident has or is likely to have a significant impact on services and activities falling within the scope of”

“shall include particular policy recommendations, with a view to addressing shortcomings and increasing the level of cybersecurity across the Union, and a summary of the findings for the particular period from the EU Cybersecurity Technical Situation Reports on incidents and cyber”

“shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with”

“shall ensure that an entity that finds that it does not comply with the measures provided for in paragraph 2 takes, without undue delay, all necessary, appropriate and proportionate corrective measures.”

“shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in accordance with paragraph 4 of any incident that has a significant impact on the provision of their services as referred to in paragraph 3 (s”

“shall encourage essential and important entities to use qualified trust services.”

“shall ensure that entities falling within the scope of this Directive and, where relevant, other entities not falling within the scope of this Directive are able to exchange on a voluntary basis relevant cybersecurity information among themselves, including information relating t”

“shall ensure that, in addition to the notification obligation provided for in Article 23, notifications can be submitted to the CSIRTs or, where applicable, the competent authorities, on a voluntary basis, by: (a) essential and important entities with regard to incidents, cyber t”

“shall ensure that the supervisory or enforcement measures imposed on essential entities in respect of the obligations laid down in this Directive are effective, proportionate and dissuasive, taking into account the circumstances of each individual case.”

“shall ensure that the competent authorities take action, where necessary, through ex post supervisory measures.”

“shall apply mutatis mutandis to the supervisory and enforcement measures provided for in this Article for important entities.”

“shall, without undue delay, inform the supervisory authorities as referred to in Article 55 or 56 of that Regulation.”

“shall lay down rules on penalties applicable to infringements of national measures adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented.”

“shall cooperate with and assist each other as necessary.”

“shall ensure a level of security of network and information systems appropriate to the risks posed when implementing and applying the technical and methodological requirements of cybersecurity risk-management measures set out in the Annex to this Regulation.”

“shall be considered to be significant for the purposes of Article 23(3) of Directive (EU) 2022/2555 with regard to the relevant entities where one or more of the following criteria are fulfilled: (a) the incident has caused or is capable of causing direct financial loss for the r”

“shall not be considered to be significant incidents.”

“shall be considered significant under Article 3(1)(g), where it fulfils one or more of the following criteria: (a) a recursive or authoritative domain name resolution service is completely unavailable for more than 30 minutes;”

“shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria: (a) an authoritative domain name resolution service is completely unavailable;”

“shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria: (a) a cloud computing service provided is completely unavailable for more than 30 minutes;”

“shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria: (a) a data centre service of a data centre operated by the provider is completely unavailable;”

“shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria: (a) a content delivery network is completely unavailable for more than 30 minutes;”

“shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria: (a) a managed service or managed security service is completely unavailable for more than 30 minutes;”

“shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria: (a) an online marketplace is completely unavailable for more than 5 % of an online marketplace’s users in the Union, or for more than 1 million of an online marketplace’s”

“shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria: (a) an online search engine is completely unavailable for more than 5 % of that online search engine’s users in the Union, or for more than 1 million of that online searc”

“shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria: (a) a social networking service platform is completely unavailable for more than 5 % of that social networking service platform’s users in the Union, or for more than 1 m”

“shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria: (a) a trust service is completely unavailable for more than 20 minutes;”

“An OES must take appropriate and proportionate technical and organisational measures to manage risks posed to the security of the network and information systems on which their essential service relies.”

“An OES must take appropriate and proportionate measures to prevent and minimise the impact of incidents affecting the security of the network and information systems used for the provision of an essential service, with a view to ensuring the continuity of those services.”

“The measures taken under paragraph (1) must, having regard to the state of the art, ensure a level of security of network and information systems appropriate to the risk posed.”

“Operators of essential services must have regard to any relevant guidance issued by the relevant competent authority when carrying out their duties imposed by paragraphs (1) and (2).”

“An OES must notify the designated competent authority about any incident which has a significant impact on the continuity of the essential service... without undue delay and in any event no later than 72 hours after the operator is aware that a NIS incident has occurred.”

“the operator's name and the essential services it provides; the time the NIS incident occurred; the duration of the NIS incident; information concerning the nature and impact of the NIS incident; information concerning any, or any likely, cross-border impact”

“In order to determine the significance of the impact of an incident an OES must have regard to the following factors— (a) the number of users affected by the disruption of the essential service; (b) the duration of the incident; and (c) the geographical area affected by the incid”

“Operators of essential services must have regard to any relevant guidance issued by the relevant competent authority when carrying out their duties imposed by paragraphs (1) to (4).”

“A RDSP must identify and take appropriate and proportionate measures to manage the risks posed to the security of network and information systems on which it relies to provide, within the European Union, the following services— (a) online marketplace; (b) online search engine; or”

“prevent and minimise the impact of incidents affecting their network and information systems with a view to ensuring the continuity of those services; and (c) take into account the following elements... (ii) incident handling; (iii) business continuity management; (iv) monitoring”

“A RDSP must notify the Information Commissioner about any incident having a substantial impact on the provision of any of the digital services... without undue delay and in any event no later than 72 hours after the RDSP is aware that an incident has occurred.”

“In order to determine whether the impact of an incident is substantial the RDSP must— (a) take into account the following parameters... (i) the number of users affected... (ii) the duration of the incident; (iii) the geographical area... (iv) the extent of the disruption... (v) t”

“contain sufficient information to enable the Information Commissioner to determine the significance of any cross-border impact.”

“The notification mentioned in paragraph (3) must provide the following information— (a) the operator's name and the essential services it provides; (b) the time the NIS incident occurred; (c) the duration of the NIS incident; (d) information concerning the nature and impact of th”

“If an OES is reliant on a RDSP to provide an essential service, the operator must notify the relevant competent authority in relation to it about any significant impact on the continuity of the service it provides caused by an incident affecting the RDSP as soon as it occurs.”

“The NIS national strategy must, in particular, address the following matters— ... (c) the measures relating to preparedness, response and recovery, including cooperation between public and private sectors.”

“The CSIRT must— (a) monitor incidents in the United Kingdom; (b) provide early warning, alerts, announcements and dissemination of information to relevant stakeholders about risks and incidents; (c) respond to any incident notified to it under regulation 11(5)(b) or regulation 12”

“provide dynamic risk and incident analysis and situational awareness; ... promote the adoption and use of common or standardised practices for— (i) incident and risk handling procedures, and (ii) incident, risk and information classification schemes”

“After receipt of a notification under paragraph (1), the competent authority must— (a) assess what further action, if any, is required in respect of that incident; and (b) share the NIS incident information with the CSIRT as soon as reasonably practicable.”

“After receipt of a notification under paragraph (3) the Information Commissioner must share the incident notification with the CSIRT as soon as reasonably practicable.”

“After receipt of the NIS incident information under paragraph (5)(b), and based on that information, the CSIRT must inform the relevant authorities in a Member State if the incident has a significant impact on the continuity of an essential service provision in that Member State.”

“A designated competent authority may serve an information notice upon an OES requiring that person to provide it with information that it reasonably requires to assess— (a) the security of the OES's network and information systems; and (b) the implementation of the operator's sec”

“the OES or RDSP (as the case may be) must— (a) pay the reasonable costs of the inspection; (b) co-operate with the person who is conducting the inspection... (c) provide the inspector with reasonable access to their premises; (d) allow the inspector to inspect, copy or remove suc”

“The Information Commissioner may serve upon a RDSP an information notice requiring that RDSP to provide the Information Commissioner with information that the Information Commissioner reasonably requires to assess— (a) the security of the RDSP's network and information systems; a”

“The NIS national strategy must, in particular, address the following matters— ... (f) a risk assessment plan identifying any risks.”

“ensure that there is in place at all times a written plan to maintain the normal operation of the public electronic communications network in the event that the supply, provision or making available of goods, services or facilities by a third party supplier is interrupted”

“create or acquire, for the purposes mentioned in that paragraph, and to retain within the United Kingdom— (i) an online copy of information necessary to maintain the normal operation of the public electronic communications network or public electronic communications service, and ”

“for promptly identifying the occurrence of any security compromise and assessing its severity, impact and likely cause, (ii) for promptly identifying any mitigating actions required as a result of the occurrence of any security compromise”

“for dealing with the occurrence of a security compromise within a reasonable period appropriate to the assessed security risk of the network provider or service provider, and without creating any risk of a further security compromise occurring”

“if the network provider or service provider is unable to take steps for the purposes of preventing any adverse effects... within the period of 14 days beginning with the day on which it occurs, the network provider or service provider is able to prepare a written plan as to how a”

“for dealing with any unauthorised access to, or control over, security critical functions by taking action as soon as reasonably possible, and without creating any risk of a further security compromise occurring, to ensure that only authorised users have access to the network or ”

“for replacing information damaged by security compromises with the information contained in the copy referred to in sub-paragraph (a)”

“where the occurrence of a security compromise gives rise to the risk of a connected security compromise, for preventing the transmission of signals that give rise to that risk”

“ensure that the policy includes procedures for the management of security incidents, at varying levels of severity, (c) to have a standardised way of categorising and managing security incidents”

“ensure that the policy provides for a post-incident review procedure in relation to security incidents and that the procedure involves consideration of the outcome of the review at an appropriate governance level and the use of that outcome to inform future policy”

“give a person or committee at board level (or equivalent) responsibility for— (i) supervising the implementation of the policy, and (ii) ensuring the effective management of persons responsible for the taking of measures”

“takes appropriate measures to co-operate with the primary provider in the resolution of incidents which cause or contribute to the occurrence of a security compromise in relation to the primary provider's network or service or of an increased risk of such a compromise occurring”

“to have appropriate written plans to manage the termination of, and transition from, contracts with third party suppliers while maintaining the security of the network or service”

“takes appropriate measures to enable the primary provider to monitor all activity undertaken or arranged by the third party supplier in relation to the primary provider's network or service”

“to ensure that all network connections and data sharing with third party suppliers, or arranged by third party suppliers, are managed securely”

“take such measures as are appropriate and proportionate to identify and reduce the risks of security compromises occurring in relation to the public electronic communications network or public electronic communications service as a result of things done or omitted by third party ”

“take such measures as are appropriate and proportionate to ensure that the public electronic communications network or public electronic communications service is designed in such a way that the occurrence of a security compromise in relation to part of the network or service doe”

“is able, without reliance on persons, equipment or stored data located outside the United Kingdom, to identify the risks of security compromises occurring... if it should become necessary to do so, would be able to operate the network without reliance on persons, equipment or sto”

“A network provider must have in place, and use where appropriate, means and procedures for isolating security critical functions from signals which the provider does not believe on reasonable grounds to be safe.”

“monitor and analyse the operation of security critical functions of the public electronic communications network or public electronic communications service for the purpose of identifying the occurrence of any security compromise, using automated means of monitoring and analysis ”

“carry out, or arrange for a suitable person to carry out, such tests in relation to the network or service as are appropriate and proportionate... The tests must involve simulating, so far as is possible, techniques that might be expected to be used by a person seeking to cause a”

“undertake at least once in any period of 12 months a review of the risks of security compromises occurring in relation to the network or service in order to produce a written assessment of the extent of the overall risk of security compromises occurring within the next 12 months”

“deploy the patch or mitigation within such period as is appropriate in the circumstances having regard to the severity of the risk... decision as to what period the network provider or service provider considers appropriate... to be taken at an appropriate governance level and re”

“the relevant person must, so far as is appropriate and proportionate, provide information about the security compromise to the network provider or service provider in relation to the other network or service”

“ensure that all data required for the purposes of a duty under paragraph (1) or sub-paragraphs (a) to (c) is held securely for at least 13 months”

“it requires TSA-specified Owner/Operators of critical pipelines to promptly report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (CISA).”

“it requires those Owner/Operators to designate a Cybersecurity Coordinator who must be available to TSA and CISA at all times to coordinate cybersecurity practices and address any incidents that arise.”

“it requires Owner/Operators to review their current cybersecurity practices against TSA's Pipeline Security Guidelines related to cybersecurity and to assess cyber risks, identify any gaps, and develop necessary remediation measures, along with a timeline for achieving them.”

“Implement specified mitigation measures to reduce the risk of compromise from a cyberattack, drawing on guidelines published by the National Institute of Standards and Technology (NIST) and recommendations from CISA”

“Develop a Cybersecurity Contingency/Response Plan to reduce the risk of operational disruption or functional degradation of information technology and operational technology systems in the event of a malicious cyber intrusion”

“Test the effectiveness their cybersecurity practices through an annual cybersecurity architecture design review conducted by a third party.”

“Report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 12 hours”

“appoint a cybersecurity coordinator to be available 24/7 to coordinate with TSA and CISA”

“conduct a self-assessment of cybersecurity practices, identify any gaps, and develop a plan and timeline for remediation.”

“Designate a Cybersecurity Coordinator who is required to be available to TSA and CISA at all times (all hours/all days) to coordinate implementation of cybersecurity practices, manage cybersecurity incidents”

“Report cybersecurity incidents to CISA”

“Conduct a Cybersecurity Vulnerability Assessment to identify gaps in current cybersecurity measures, identify remediation measures, and develop a plan for the owner/operator to implement the remediation measures”

“Develop a Cybersecurity Incident Response Plan to reduce the risk of operational disruption should their Information and/or Operational Technology systems be affected by a cybersecurity incident.”

“appoint a cybersecurity coordinator to be available 24/7 to coordinate with TSA and CISA”

“Report cybersecurity incidents to CISA... updating the definition of cybersecurity incident applicable in the pipeline context to mirror the definition used by the subsequent security directives”

“conduct a self-assessment of cybersecurity practices, identify any gaps, and develop a plan and timeline for remediation”

“Implement specified mitigation measures to reduce the risk of compromise from a cyberattack”

“Develop a Cybersecurity Contingency/Response Plan to reduce the risk of operational disruption or functional degradation of information technology and operational technology systems in the event of a malicious cyber intrusion”

“Test the effectiveness of their cybersecurity practices through an annual cybersecurity architecture design review conducted by a third party.”

“Made clear that both contractors and subcontractors are responsible for reporting known or suspected incidents to the Department; Made clear that subcontractors are required to notify the prime contractor that they have reported a known or suspected incident”

“Identifies incident reporting requirements, including timelines and required data elements, inspection provisions, and post-incident activities”

“Increased the amount of time a vendor must retain monitoring/packet capture data from 90 days to 180 days”

“Made the requirements of paragraph (c), Authority to Operate, into Alternate I to the basic clause...applicable when Federal information systems, which include contractor information systems operated on behalf of the agency, are used to collect, process, store, or transmit CUI”

“Alternate I to the basic clause is applicable when Federal information systems, which include contractor information systems operated on behalf of the agency, are used to collect, process, store, or transmit CUI...DHS Sensitive Systems Policy Directive 4300A and DHS 4300A Sensiti”

“When the Government determines that a contractor information system is being operated on its behalf, that information system is considered a Federal information system and subject to the requirements of NIST SP 800-53, Security and Privacy Controls for Information Systems and Org”

“The primary contributors to these costs are the independent assessment requirement and reporting and recordkeeping requirements...Agency specific requirements such as an independent assessment and security review are not in conflict with these requirements.”

“increase in the amount of time covered entities have to report cybersecurity incidents to CISA from 12 hours to 24 hours after an incident is identified”

“appoint a cybersecurity coordinator to be available 24/7 to coordinate with TSA and CISA”

“conduct a self-assessment of cybersecurity practices, identify any gaps, and develop a plan and timeline for remediation”

“Implement network segmentation policies and controls to ensure that the Operational Technology (OT) system can continue to safely operate in the event that an Information Technology (IT) system has been compromised”

“Implement access control measures to secure and prevent unauthorized access to critical cyber systems”

“Implement continuous monitoring and detection policies and procedures to detect cybersecurity threats and correct anomalies that affect critical cyber system operations”

“Reduce the risk of exploitation of unpatched systems through the application of security patches and updates for operating systems, applications, drivers and firmware on critical cyber systems in a timely manner using a risk-based methodology”

“Establish and implement a TSA-approved Cybersecurity Implementation Plan that describes the specific cybersecurity measures employed and the schedule for achieving the security outcomes identified”

“Develop and maintain an up-to-date Cybersecurity Incident Response Plan to reduce the risk of operational disruption, or the risk of other significant impacts on necessary capacity...should the Information and/or Operational Technology systems...be affected by a cybersecurity inc”

“Establish a Cybersecurity Assessment Program and submit an annual plan that describes how the Owner/Operator will proactively and regularly assess the effectiveness of cybersecurity measures and identify and resolve device, network, and/or system vulnerabilities”

“Designate a Cybersecurity Coordinator who is required to be available to TSA and CISA at all times (all hours/all days) to coordinate implementation of cybersecurity practices, manage cybersecurity incidents”

“Report cybersecurity incidents to CISA”

“Conduct a Cybersecurity Vulnerability Assessment to identify gaps in current cybersecurity measures, identify remediation measures, and develop a plan for the owner/operator to implement the remediation measures”

“require covered entities to continuously update and maintain these plans, once developed... Develop a Cybersecurity Incident Response Plan to reduce the risk of operational disruption should their Information and/or Operational Technology systems be affected”

“Implement network segmentation policies and controls to ensure that the Operational Technology (OT) system can continue to safely operate in the event that an Information Technology (IT) system has been compromised”

“Implement access control measures to secure and prevent unauthorized access to critical cyber systems”

“Implement continuous monitoring and detection policies and procedures to detect cybersecurity threats and correct anomalies that affect critical cyber system operations”

“Reduce the risk of exploitation of unpatched systems through the application of security patches and updates for operating systems, applications, drivers, and firmware on critical cyber systems in a timely manner using a risk-based methodology”

“Establish and implement a TSA-approved Cybersecurity Implementation Plan that describes the specific cybersecurity measures employed and the schedule for achieving the security outcomes identified”

“Establish a Cybersecurity Assessment Program and submit an annual plan that describes how the Owner/Operator will proactively and regularly assess the effectiveness of cybersecurity measures and identify and resolve device, network, and/or system vulnerabilities”

“covered entities to report to CISA within certain prescribed timeframes any covered cyber incidents...CIRCIA requires covered entities to report to CISA covered cyber incidents within 72 hours after the covered entity reasonably believes that the covered cyber incident has occurr”

“ransom payments made in response to a ransomware attack within 24 hours after the ransom payment has been made”

“any substantial new or different information discovered related to a previously submitted report”

“Section 226.13 of the proposed regulation sets forth the proposed data and records preservation requirements. It includes a recitation of the types of data and records that a covered entity must preserve; the required preservation period; the format or form in which the data and ”

“the storage, protection, and allowable uses of the preserved data and records”

“The information CISA proposes that covered entities must include in each of the four types of CIRCIA Reports is enumerated in Sec. Sec. 226.7 through 226.11”

“The information CISA proposes that covered entities must include in each of the four types of CIRCIA Reports is enumerated in Sec. Sec. 226.7 through 226.11”

“Section 226.6 of the proposed regulation sets forth the proposed manner and form of reporting, which CISA proposes to be through a web-based CIRCIA Incident Reporting Form available on CISA's website or in any other manner and form of reporting approved by the Director.”

“the proposed regulation also affirms the statutorily mandated obligation for a third party to advise the covered entity of its ransom payment reporting obligations under CIRCIA when the third party knowingly makes a ransom payment on behalf of a covered entity”

“A covered entity may use a third party to submit a CIRCIA Report to CISA on the covered entity's behalf to satisfy the covered entity's reporting obligations. The proposed procedures and requirements for using a third party to submit a CIRCIA Report on behalf of the covered entit”

“CIRCIA authorizes CISA to use various mechanisms to obtain information from a covered entity about a covered cyber incident or ransom payment that was not reported in accordance with CISA's proposed regulatory reporting requirements...These mechanisms include the issuance of an R”

“CIRCIA authorizes CISA to use various mechanisms to obtain information from a covered entity about a covered cyber incident or ransom payment that was not reported...These mechanisms include...the issuance of a subpoena”

“The main industry cost drivers of this proposed rule are the initial costs associated with becoming familiar with the proposed rule, followed by the recurring data and records preservation requirements, and then reporting requirements.”

“when a covered entity reports substantially similar information in a substantially similar timeframe to another Federal agency pursuant to an existing law, regulation, or contract when a CIRCIA Agreement is in place between CISA and the other Federal agency”

“If your CISWI or air curtain incinerator is equipped with a control device, you must continue to run that control device in order to qualify for this exclusion, unless the control device is infeasible to operate as a result of the disaster.”

“you must notify the Administrator that the temporary-use CISWI or air curtain incinerator will be used for more than 8 weeks and request permission to continue to operate the unit... submitted in writing by the date 8 weeks after you start operation.”

“you may continue to operate the CISWI or air curtain incinerator for another 8 weeks, which is a total of 16 weeks...so long as control devices continue to run as able...you must cease operation of the unit or comply with all requirements of this subpart, unless the Administrator”

“If your CISWI or air curtain incinerator is equipped with a control device, you must continue to run that control device in order to qualify for this exclusion, unless the control device is infeasible to operate as a result of the disaster.”

“you must notify the Administrator that the temporary-use CISWI or air curtain incinerator will be used for more than 8 weeks and request permission to continue to operate the unit...submitted in writing by the date 8 weeks after you start operation.”

“If your CISWI or air curtain incinerator is equipped with a control device, you must continue to run that control device in order to qualify for this exclusion, unless the control device is infeasible to operate as a result of the disaster.”

“you must notify the Administrator that the temporary-use CISWI or air curtain incinerator will be used for more than 8 weeks and request permission to continue to operate the unit...submitted in writing by the date 8 weeks after you start operation.”

“If the Administrator has approved in writing your request to continue operation, then you may continue to operate the CISWI or air curtain incinerator...until the date specified in the approval.”

“Each community water system serving a population of greater than 3,300 persons shall conduct an assessment of the risks to, and resilience of, its system.”

“Each community water system described in paragraph (1) shall submit to the Administrator a certification that the system has conducted an assessment complying with paragraph (1).”

“Each community water system described in paragraph (1) shall review the assessment of such system conducted under such paragraph at least once every 5 years after the applicable deadline for submission of its certification.”

“Each community water system serving a population greater than 3,300 shall prepare or revise, where necessary, an emergency response plan that incorporates findings of the assessment conducted under subsection (a) for such system.”

“strategies and resources to improve the resilience of the system, including the physical security and cybersecurity of the system;”

“plans and procedures that can be implemented, and identification of equipment that can be utilized, in the event of a malevolent act or natural hazard that threatens the ability of the community water system to deliver safe drinking water;”

“actions, procedures, and equipment which can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the safety and supply of drinking water provided to communities and individuals, including the development of alternative source ”

“strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system.”

“Each community water system shall certify to the Administrator, as soon as reasonably possible after October 23, 2018, but not later than 6 months after completion of the assessment under subsection (a), that the system has completed such plan.”

“Community water systems shall, to the extent possible, coordinate with existing local emergency planning committees established pursuant to the Emergency Planning and Community Right-To-Know Act of 1986 when preparing or revising an assessment or emergency response plan under thi”

“Each community water system shall maintain a copy of the assessment conducted under subsection (a) and the emergency response plan prepared under subsection (b) (including any revised assessment or plan) for 5 years after the date on which a certification of such assessment or pl”

“A community water system that is required to comply with the requirements of subsections (a) and (b) may satisfy such requirements by using and complying with technical standards that the Administrator has recognized under paragraph (2); and submitting to the Administrator a cert”

“require applicants and licensees to certify that they have created, updated, and implemented a cybersecurity and physical security risk management plan and will take reasonable measures to protect their systems and services from cybersecurity and physical security risks”

“require applicants to provide detailed information about the submarine cable system and to report whether or not they use and/or will use third-party foreign adversary service providers in the operation of the submarine cable.”

“we require cable landing licensees and common carriers to provide certain information about their SLTEs in the Capacity Holder Report.”

“as long as the first daily DIRS report for the activation is due before the NORS submission under section 4.9 of this chapter would be due for the outage”

“are not required to make submissions in the Network Outage Reporting System (NORS) under this chapter pertaining to any outage...as long as...the outage is timely reported in DIRS.”

“providers must continue to comply with applicable 911 and 988 outage notification requirements during DIRS activations.”

“confirm that providers must continue to comply with applicable 911 and 988 outage notification requirements during DIRS activations.”

“we do not preclude communications service providers from withdrawing NORS reports if there are other reasons in addition to the activation of DIRS that support withdrawal...But absent some other reason...we find that the public interest is best served by maintaining such NORS rep”

“This waiver does not apply to outages occurring outside of the geographic area where DIRS is activated, nor does it apply to outages with notification deadlines that occur after DIRS is deactivated.”

“nor does it apply to outages with notification deadlines that occur after DIRS is deactivated.”

“requiring cable communications, wireless, wireline, and interconnected Voice over Internet Protocol (VoIP) providers to report their infrastructure status information in the Disaster Information Reporting System (DIRS) daily when the Commission activates DIRS”

“require Subject Providers to provide a final report to the Commission within 24 hours of the Commission's deactivation of DIRS...that details the state of their infrastructure at the time of DIRS deactivation and provides an estimated date of resolution of any remaining outages.”

“Subject Providers will not be required to file reports of system outages in the FCC's Network Outage Reporting System (NORS) that arise during the DIRS activation and that are timely reported in DIRS.”

“we require that all CLAs and the Lead Administrator create, update, and implement cybersecurity risk management plans. Such a cybersecurity risk management plan must identify the cyber risks that the entity faces, the controls used to mitigate those risks”

“The plans must also describe how each entity employs its organizational resources and processes to ensure the confidentiality, integrity, and availability of its information and information systems.”

“we additionally require each applicant seeking to serve as a CLA or Lead Administrator to submit with its application an attestation that it already has created and implemented--or upon selection will create and implement--a cybersecurity risk management plan”

“We also require that CLAs and the Lead Administrator make such cybersecurity risk management plans available to the Commission upon request.”

“Knowledge of Federal law and guidance governing the security and privacy of agency information systems”

“The ability to securely handle large volumes of information, including a description of Applicant's related internal security practices.”

“Collaborating with the Lead Administrator and other stakeholders to develop those items to be submitted to the Commission within 90 days of election of the Lead Administrator, and listed in 47 CFR 8.221(a)(4)”

“The Commission also makes eligible security updates and patches, which will help to ensure that participants are protected even as threat vectors evolve over the course of the Pilot.”

“an 'advanced' or 'next-generation' firewall as 'equipment, services, or a combination of equipment and services that limits access between networks, excluding basic firewall services and components that are currently funded through the E-Rate program.'”

“Provide daily reports on their infrastructure status from the start of DIRS activation until DIRS has been deactivated.”

“Provide a single, final report to the Commission within 24 hours of the Commission's deactivation of DIRS...detailing the state of their infrastructure at the time of DIRS deactivation and an estimated date of resolution of any remaining outages.”

“providers should: (1) use the Operations Center or otherwise notify the Commission if they are unable to file; and (2) make a filing as soon as they are capable, but no later than the final report due upon deactivation of DIRS.”

“submissions made in DIRS under the rule adopted in the Order shall be based on information known by the provider at the time...submissions must be provided with a reasonable basis for believing the information therein is accurate.”

“providers who provide a DIRS report pursuant to paragraph (a) of this section are not required to make submissions in the Network Outage Reporting System (NORS)...pertaining to any incidents arising during the DIRS activation and that are timely reported in DIRS.”

“we propose requiring TV and radio broadcasters report in both NORS and DIRS subject to a simplified reporting process based on the type and modality of certain broadcast infrastructures.”

“Should we also require broadcasters to notify us within 24 hours of going silent when DIRS has been activated and within 24 hours of resuming service after DIRS activation has been lifted?”

“Should we require notice when a broadcaster's ability to access IPAWS is disrupted regardless of the operational status of the transmitter?”

“We seek comment on whether to require DBS providers, SDARS providers, Fixed Satellite Service (FSS) providers, and Mobile Satellite Service (MSS) providers report in DIRS.”

“we seek comment on whether and how the NORS reporting thresholds for satellite providers should be modified to reflect technological changes to these networks since the Commission's original 2004 reporting rules were effectuated.”

“we seek comment on whether FirstNet, or AT&T, should file outage reports with the Commission in NORS with respect to FirstNet infrastructure and services.”

“as the related Second Report and Order adopts a mandatory obligation for subject providers to file in DIRS, we seek comment in this Second Further Notice on whether this obligation should be extended with regard to FirstNet.”

“we renew our inquiry into whether BIAS providers should be required to submit outage reports in NORS... we believe that reported data to NORS and DIRS should also encompass disruptions to BIAS, including mobile and fixed wireless BIAS service.”

“We also seek comment on whether participation in DIRS when activated should also be mandatory.”

“we seek comment on whether current or future providers who are subject to DIRS reporting requirements should be required to supply the Commission with information concerning the location of their mobile recovery assets, and specifically whether providers should be required to sup”

“could providers report on select metrics such as the number of texts, voice minutes, broadband data provided by a recovery asset over the last 24 hours as well as the total data provided since that recovery asset was incorporated into that location.”

“we further seek comment on whether the reporting should indicate whether the mobile recovery assets support WEAs, as we note in particular the ability to disseminate WEAs in disaster environments may be of critical importance.”

“we seek comment as to whether providers subject to DIRS reporting requirements should be required to supply the Commission with 'after action' reports detailing more specifically how their networks fared after the event or exigency and the nature, timing, duration, and effectiven”

“how an appropriate threshold would support the ability of the Commission to discern when outages or significant network degradation stemming from issues such as cybersecurity breaches, wire cuts, infrastructure damages from natural disasters, and/or operator errors or misconfigur”

“the Commission has limited ability to know or understand on a timely basis when broadcast stations' facilities are impacted by infrastructure, equipment, or power failures, cybersecurity incursions or other issues that impact their ability to disseminate a signal.”

“the Commission requires covered 988 service providers...to report outages that potentially affect the 988 Lifeline to the Commission's Network Outage Reporting System (NORS)”

“requires cable, satellite, wireless, wireline, and interconnected VoIP providers to report in NORS outages that potentially affect the 988 special facilities”

“defines 'outages that potentially affect a 988 special facility' as events that result in the loss of the ability of the 988 Lifeline to receive, process, or forward calls, potentially affecting at least 900,000 user-minutes and lasting at least 30 minutes”

“requires covered 988 service providers to directly notify 988 special facilities about outages that potentially affect those facilities...within 30 minutes”

“For outages lasting longer than 2 hours, the providers would follow-up with subsequent notifications of material information as soon as possible after discovery of the new material information, and continue providing additional material information until the outage is completely ”

“requires covered 988 service providers and originating service providers to exercise special diligence to maintain accurate, up-to-date contact information for 988 special facilities”

“reliance upon a third-party service provider to manage, route, or otherwise contribute to 988 call processing does not relieve providers of the obligation to provide outage notification to 988 special facilities”

“The Commission declines to allow alternatives to NORS reporting...the Commission will add a checkbox to NORS so that reporting providers can clearly indicate whether a reported outage potentially affects a 988 special facility”

“The Notification is due within 480 minutes (8 hours) of the time of determining that an event is reportable for the first three years...After three years...Notifications shall be due within 240 minutes (4 hours).”

“The Interim Report is due within 24 hours of receiving the Plan of Work.”

“The Final Outage Report is due seven (7) days after the repair is completed.”

“An outage of a portion of submarine cable system between submarine line terminal equipment (SLTE)...occurs for 30 minutes or more...An 'outage' does not require reporting under this section if the outage is caused by announced planned maintenance.”

“An outage of any fiber pair, including due to terminal equipment, on a cable segment occurs for four hours or more, regardless of the number of fiber pairs that comprise the total capacity of the cable segment.”

“'outage' is defined as a failure or significant degradation in the performance of a licensee's cable service regardless of whether the traffic can be re-routed to an alternate path.”

“An 'outage' does not require reporting under this section if the outage is caused by announced planned maintenance and the licensee notified its customers in advance of the planned maintenance and its expected duration.”

“if the planned maintenance duration surpasses the shortest announced duration for the planned maintenance and this additional time triggers the requirements in paragraph (a)(1)...the outage becomes reportable as of the time the maintenance exceeds the shortest announced duration.”

“The Notification, Interim Report, and Final Outage Reports are to be submitted electronically to the Commission...If there are technical impediments to using the Web-based system during the Notification stage, then a written Notification to the Commission by email...is permitted.”

“Licensees shall provide: The name of the reporting entity; the name of the cable...date and time of onset of the outage, if known...a brief description of the event, including root cause if known; nearest cable landing station; best estimate of approximate location...best estimat”

“The Final Report must also contain an attestation as described in paragraph (b)(2)(i)...Each Final report shall be attested...that the information contained therein is true, correct, and accurate to the best of his/her knowledge and belief.”

“licensees of that cable may designate a Responsible Licensee that files outage reports under this rule on behalf of all licensees...must jointly notify the Chief of the Public Safety and Homeland Security Bureau's Cybersecurity and Communications Reliability Division of this deci”

“in the event that a licensee determines that a Notification, Interim Report, or Final Report filed for an outage was not required because the licensee later determines that the event does not meet the outage definition in 47 CFR 4.15(a), the licensee may withdraw the filing.”

“Service providers are required to submit a notification to NORS generally within two hours of determining that an outage is reportable to provide the Commission with timely preliminary information.”

“provide an initial report within three calendar days, followed by a final report with complete information on the outage within 30 calendar days of the notification”

“The Second Report and Order requires service providers to make adjustments to their NORS reporting processes to accommodate the Commission's adjustments to its NORS web-based form pursuant to section 47 CFR 4.11.”

“Treat NORS and DIRS filings as confidential and not disclose them, absent a finding by the Commission allowing the disclosure”

“limiting access to five user accounts”

“requiring initial and annual security training; requiring participating agencies to receive training on their privileges and obligations under the framework”

“reporting any known or reasonably suspected breach of protocol to the Commission and service providers”

“the new requirement that agencies file certification forms, pursuant to 47 CFR 4.2, to request access to NORS and DIRS reports”

“limiting agency access to events occurring within an agency's jurisdiction”

“each participating agency make available for Commission inspection, upon Commission request, a list of all localities for which the agency has disclosed NORS and DIRS data”

“We expressly forbid the use of NORS and DIRS information obtained through the procedures we adopt today for non-emergency-related regulatory purposes, including merger review, consumer protection activities, contract disputes with a state”

“allow these agencies to share confidential information derived from NORS and DIRS filings with non-credentialed individuals at the participating agency and at non-participating agencies on a strict 'need to know' basis”

“participating state and Federal agencies be granted direct access to NORS and DIRS filings in a read-only manner to help prevent the improper manipulation of NORS and DIRS data”

“An agency applying for direct access to NORS and DIRS must demonstrate its 'need to know' by citing to statutes or other regulatory authority that establishes it has official duties making it directly responsible for emergency management and first responder support functions.”

“requiring agencies to certify that they will take appropriate steps to safeguard the information contained in the filings, including notifying the Commission of unauthorized or improper disclosure”

“these licensees will need to report specific unplanned outages greater than 30 minutes on a portion of the cable system between submarine line terminal equipment (SLTE) or greater than four hours when it affects a fiber pair.”

“we seek comment on improvements to the Framework to ensure roaming is operational prior to an event and seamless during emergencies--addressing both resiliency and restoration--such as annual testing of roaming capabilities and coordination processes.”

“we seek comment on whether we should require wireless providers to submit reports to the Commission detailing implementation of the voluntary Framework in real time or in the aftermath of a disaster.”

“should the Commission consider requiring the nation's service providers...to report their infrastructure status information in DIRS when the Commission activates DIRS in geographic areas in which they broadcast or otherwise provide service?”

“Should providers with ongoing outages at the time of DIRS deactivation be required to report those outages in NORS?”

“we seek comment on the public interest benefits and the costs of reporting of broadband service outages. Would such reporting likewise improve emergency managers' situational awareness during disasters?”

“we seek comment on what steps service providers would need to take with respect to backup power deployment to significantly reduce the number of communications disruptions caused by power outages. How many hours of on-site backup power would be appropriate at their facilities?”

“we seek comment on how signatories fostered mutual aid, such as through sharing physical assets, during Hurricane Ida and other recent disasters, and how effective this mutual aid has been in ensuring continuity of communications.”

“should the voluntary Framework include provisions regarding the placement of back-up systems, such as Cells on Light Trucks, so that they are ready to deploy for vulnerable infrastructure to improve service restoration time?”

“Should the Framework include provisions that address backhaul redundancy and resiliency? For example, could the Framework address a limit on the number of cell sites operating on a single backhaul fiber link?”

“we seek to identify actions the Commission, communications providers, and power companies can cooperatively take to encourage and increase coordination in the power and communications sectors before, during, and after an emergency or disaster.”

“Are there steps the Commission can take, such as revisions to our resiliency rules (see, e.g., 47 CFR parts 4, 9) or encouraging of voluntary measures, to make it more likely that PSAPs will have the necessary resources to continue service during and after disasters?”

“Should the Framework include requirements for restoration or prioritization of text-to-911 capability in areas where the PSAP is text-capable, as text-to-911 can be an important communications solution in emergencies?”

“Should providers establish processes for sharing real-time restoration efforts? Should the Framework include coordination obligations and particular coordination activities or best practices?”

“the Commission has observed that, while the nation's large providers typically elect to voluntarily report in DIRS, smaller providers often do not...reduces the Commission's situational awareness...in locations served by smaller providers, which are often vulnerable rural or othe”

“Are there steps the Commission can take to encourage voluntary participation beyond the scope of the existing signatories, such as to include smaller wireless providers, or entities beyond the mobile-wireless industry, such as facilities-based backhaul providers, covered 911 serv”

“We also seek comment on any alternatives to on-site backup power that have also proven successful or have the potential to reduce the frequency, duration, or severity of disruptions to communications services caused by power outages.”

“we seek comment on whether to codify in our part 4 rules the Commission's typical practice of granting to providers a waiver of their NORS reporting requirements when they report the outage in DIRS.”

“should there be minimum timeframes by which a provider must respond to a disaster roaming request? Are there conditions or other criteria that could be incorporated into the Framework to determine that, once met, roaming should be available automatically in qualifying disaster ar”

“Should there be any improvement in the standards or their implementations to ensure the emergency roaming is automatically and seamlessly accessible to user devices without requiring any action from the user? Can providers' readiness to execute such disaster-triggered roaming be ”

“Is the deployment of on-site backup power sufficient to keep networks online in view of other potentially independent factors that may cause a network to fail during a disaster, e.g., lack of hardened and resilient network equipment? If it is not sufficient, what other steps shou”

“Mobile support recipients are also required to file reports and data regarding the use of support for hardening networks and 5G technology deployment, and to maintain a Disaster Preparation and Response Plan.”

“a mobile carrier report and explain the network security controls that it has implemented and how they are commensurate with established best practices or an established risk management framework.”

“it should also require that mobile carriers report and explain to the Commission instances of unauthorized access to their systems and services.”

“the Commission proposes to limit transitional support to restoring, hardening, or expanding networks with 5G-capable networks, and to end use of this support for 4G LTE.”

“an incumbent LEC must limit its use of the phase-down support to resiliency and redundancy measures...and that the incumbent LEC must at least maintain its current footprint for voice and broadband services.”

“The Commission seeks comment on requiring an incumbent LEC receiving additional phase-down support to maintain its Disaster Preparation and Preparedness Plan.”

“An incumbent LEC interested in receiving this support would be required to submit a spending plan for its use of phase-down support for redundancy and resiliency measures to the Wireline Competition Bureau (the Bureau) for approval.”

“the incumbent LEC would be required to provide the Commission with a report of how the phase-down support was spent on resiliency and redundancy measures consistent with the Bureau-approved plan.”

“along with a certification pursuant to section 54.313(n) of the Commission's rules that the support was used only for authorized purposes.”

“use of transitional phase-down support to purchase and maintain generators to address power failures would be appropriate under the Commission's proposal.”

“part of the Disaster Preparation and Response Plan adopted by the 2019 PR USVI Order includes ensuring network diversity and backup power.”

“requiring EAS Participants and Participating CMS Providers to annually certify to having a cybersecurity risk management plan in place and employing sufficient security controls to ensure the confidentiality, integrity, and availability of their respective alerting systems”

“requiring EAS Participants to report any incident of unauthorized access of their EAS equipment, communications systems, or services...to the Commission via NORS within 72 hours of when it knew or should have known that an incident has occurred”

“any incident involving the unauthorized access to EAS equipment, communications systems, or services, regardless of whether the event resulted in the transmission of a false alert would require EAS Participants to report the unauthorized access to the Commission”

“requiring that mobile devices only present WEA alerts from valid base stations”

“The cybersecurity risk management plan must contain among other things, a description of how organizational resources are employed to ensure the confidentiality, integrity, and availability of the alerting system.”

“We require covered 911 service providers and OSPs to annually use special diligence to obtain a 911 special facility's contact information and maintain it up-to-date.”

“OSPs and covered 911 service providers shall transmit initial 911 special facility notifications as soon as possible, but no later than 30 minutes after discovering that they have experienced an outage that potentially affects a 911 special facility.”

“will communicate additional material information to potentially affected 911 special facilities as the information becomes available, but no later than two hours after the initial notification.”

“we should require covered 911 service providers and OSPs to provide the following material informational elements in their 911 special facility outage notifications: An identifier unique to each outage; The name, telephone number, and email address at which the notifying service ”

“OSPs shall transmit their 911 special facility notifications by telephone and in writing via electronic means in the absence of another method mutually agreed upon in writing in advance by the 911 special facility and the provider.”

“continue to require covered 911 service providers to file 911 reliability certifications annually. We find that maintaining an annual frequency for 911 reliability certification is necessary to ensure that our 911 network remains resilient and robust.”

“reliance upon a third-party service provider to manage, route, or otherwise contribute to 911 call processing does not relieve a service provider of its obligation to notify 911 special facilities about outages that potentially affect them within 30 minutes of when the outage is ”

“When general outages do 'potentially affect a 911 special facility,' however, service providers, including interconnected VoIP providers, must notify 911 special facilities.”

“47 CFR 4.9(g)(1)(i) requires VoIP providers to notify 911 special facilities of outages that potentially affect them... reliance upon a third-party service provider... does not relieve a covered 911 service provider or an OSP, including an interconnected VoIP provider, of the obl”

“Service providers must provide 911 special facilities with all available material information they have about the outage 30 minutes from the time of discovery, even if the service provider does not have available all the informational elements described above.”

“for outages that last longer than two hours, a service provider's obligation to continue to follow up with additional material information as soon as possible after it becomes available continues until the outage is completely repaired and service is fully restored.”

“Including 'best known cause' as an informational element is necessary because, if known, the cause of the outage can provide guidance which might assist the 911 special facility in mitigating the effect of the outage.”

“The expected date and time of restoration, including a notation of the relevant time zone... A statement of whether the message is the notifying service provider's initial notification to the 911 special facility, an update to an initial notification, or a message intended to be ”

“An identifier unique to each outage... Commenters overwhelmingly support covered 911 service providers' and OSPs' use of a standardized set of informational elements in their 911 outage reports.”

“A statement of the notifying service provider's expectations for how the outage potentially affects the 911 special facility (e.g., dropped calls or missing metadata could include an intermittent, partial, or complete loss of Automatic Location Identification (ALI) or Automatic N”

“The geographic area affected by the outage... Commenters overwhelmingly support covered 911 service providers' and OSPs' use of a standardized set of informational elements in their 911 outage reports.”

“We expect service providers to address these responsibilities within their 911 service contracts with third parties as needed.”

“We also decline the request of CTIA and others to clarify that an OSP is under no obligation to notify a 911 special facility if the OSP discovers an outage only after it has been resolved.”

“we amend our part 4 rules to expand the outage reporting exemption for satellite and wireless providers to include all 'special offices and facilities' as defined in Sec. 4.5(b), as adopted in the 2016 Part 4 Order.”

“The type of communications service(s) affected... Commenters overwhelmingly support covered 911 service providers' and OSPs' use of a standardized set of informational elements in their 911 outage reports.”

“The name, telephone number, and email address at which the notifying service provider can be reached for follow-up; The name of the service provider(s) experiencing the outage.”

“The date and time when the incident began (including a notation of the relevant time zone).”

“Whether or not a covered 911 service provider is required to file an annual certification in a given year, it would still be required to create and maintain records supporting compliance with the elements of the 911 reliability certification and retain those records for two years”

“Not later than 72 hours after discovering the outage, the provider shall submit electronically an Initial Communications Outage Report to the Commission. Not later than 30 days after discovering the outage, the provider shall submit electronically a Final Communications Outage Re”

“a submarine cable licensee must file a Notification, Interim Report, and Final Report in the manner prescribed in 47 CFR 4.15.”

“All cable communications providers shall submit electronically a Notification to the Commission within 120 minutes of discovering that they have experienced...an outage of at least 30 minutes duration”

“Not later than 72 hours after discovering the outage, the provider shall submit electronically an Initial Communications Outage Report...Not later than 30 days after discovering the outage, the provider shall submit electronically a Final Communications Outage Report.”

“All wireline communications providers shall submit electronically a Notification to the Commission within 120 minutes of discovering...an outage of at least 30 minutes duration...Not later than 72 hours...Initial...Not later than 30 days...Final.”

“All wireless service providers shall submit electronically a Notification to the Commission within 120 minutes of discovering...an outage of at least 30 minutes duration...Not later than 72 hours...Initial...Not later than 30 days...Final.”

“Signaling System 7 (SS7) providers shall submit electronically a Notification to the Commission within 120 minutes of discovering...an outage of at least 30 minutes duration...Not later than 72 hours...Initial...Not later than thirty days...Final.”

“All satellite operators shall submit electronically a Notification to the Commission within 120 minutes of discovering...an outage of at least 30 minutes duration that manifests itself as a failure of any of the following key system elements.”

“Within 240 minutes of discovering...an outage...that potentially affects a 911 special facility...or within 24 hours of discovering...an outage...that potentially affects at least 900,000 user minutes...results in complete loss of service.”

“providers shall provide a 911 outage notification to a potentially affected 911 special facility as soon as possible, but no later than within 30 minutes of discovering...an outage that potentially affects a 911 special facility.”

“cable, satellite, wireless, wireline and interconnected VoIP providers shall send the first follow-up notification to potentially affected 911 special facilities no later than two hours after the initial contact.”

“providers shall exercise special diligence to identify, maintain, and, on an annual basis, confirm current contact information appropriate for 911 outage notification for each 911 special facility that serves areas that the service provider serves.”

“'material information' includes the following, where available: An identifier unique to each outage...date and time when the incident began...types of communications service(s) affected...geographic area affected...Expected date and time of restoration...best-known cause.”

“Covered 988 service providers shall provide an outage notification to a potentially affected 988 special facility as soon as possible, but no later than within 30 minutes of discovering...an outage that potentially affects a 988 special facility.”

“providers shall send the first follow-up notification to potentially affected 988 special facilities no later than two hours after the initial contact...continue to provide material information...until the outage is completely repaired and service is fully restored.”

“covered 988 service providers shall exercise special diligence to identify, maintain, and, on an annual basis, confirm current contact information appropriate for outage notification for each 988 special facility that serves areas that the service provider serves.”

“The Notification is due within 480 minutes (8 hours) of the time of determining that an event is reportable for the first three years from the effective date of these rules. After three years...Notifications shall be due within 240 minutes (4 hours).”

“The Interim Report is due within 24 hours of receiving the Plan of Work. The Interim Report shall be submitted in good faith.”

“The Final Outage Report is due seven (7) days after the repair is completed...Licensees shall provide: the name of the reporting entity; the name of the cable; the date and time of onset of the outage...root cause...restoration method.”

“Provide for reasonable roaming under disaster arrangements (RuDs) when technically feasible, where: A requesting provider's network has become inoperable and the requesting provider has taken all appropriate steps to attempt to restore its own network.”

“Establish mutual aid arrangements with other facilities-based mobile wireless providers for providing aid upon request to those providers during emergencies, where such agreements address the sharing of physical assets and commit to engaging in necessary consultation.”

“Providers subject to the requirements of paragraph (a) of this section are required to perform annual testing of their roaming capabilities and related coordination processes, with such testing performed bilaterally with other providers that may foreseeably roam.”

“Providers...are required to submit reports to the Commission detailing the timing, duration, and effectiveness of their implementation of the Mandatory Disaster Response Initiative's provisions...within 60 days of when the Public Safety and Homeland Security Bureau issues a Publi”

“Cable Communications, Wireline, Wireless, and Interconnected VoIP providers shall be required to report their infrastructure status information each day in the Disaster Information Reporting System (DIRS) when the Commission activates DIRS...even when their reportable infrastruct”

“Provide a single, final report to the Commission within 24 hours of the Commission's deactivation of DIRS...detailing the state of their infrastructure at the time of DIRS deactivation and an estimated date of resolution of any remaining outages.”

“Providers must report IXC and LEC tandem outages of at least 30 minutes duration in which at least 90,000 calls are blocked or at least 667 OC3-minutes are lost...Providers may use historic carried call load data.”

“we approve the 11 proposed modified CIP Reliability Standards as just, reasonable, not unduly discriminatory or preferential, and in the public interest.”

“Responsible entities, however, will be required to maintain documentation adequate to demonstrate compliance with the Reliability Standards approved by this final rule.”

“a clear set of criteria that promote consistency and ensure that responsible entities understand the parameters for invoking the per system capability exception, documentation requirements, and the obligation to implement alternative mitigation”

“mandatory reporting requirements to the ERO Enterprise (i.e., the relevant Regional Entity, NERC, or both) for responsible entities that invoke the per system capability language”

“including the relevant CIP Reliability Standard and Requirement, an explanation of the need for the exception, description of alternative mitigation, and any other fields of information that NERC determines are useful for monitoring exceptions”

“the obligation to implement alternative mitigation... we believe that clear guidance is vital to ensure (1) that responsible entities properly identify, document and mitigate per system capability exceptions”

“NERC must submit an annual report to the Commission that provides adequate data and analysis on responsible entity usage of the per system capability exception... filed with the Commission 12 months after compliance with the 11 virtualization Reliability Standards becomes mandato”

“The total number of registered entities with active per system capability exceptions... Categorization of active per system capability exceptions by applicable Requirements covered... Generalized discussion indicating the types of assets and/or systems... Discussion on types of m”

“we also direct NERC to ensure the per system capability exception program with the above criteria is available in time for the early adoption of the 11 proposed CIP Reliability Standards by responsible entities that choose to comply early.”

“CIP-008-7.1 (Cyber Security--Incident Reporting and Response Planning)”

“CIP-007-7.1 (Cyber Security--Systems Security Management)”

“CIP-005-8 (Cyber Security--Electronic Security Perimeter(s))”

“CIP-010-5 (Cyber Security--Configuration Change Management and Vulnerability Assessments)”

“CIP-013-3 (Cyber Security--Supply Chain Risk Management)”

“CIP-006-7.1 (Cyber Security--Physical Security of BES Cyber Systems)”

“the Responsible Entity will need to document the limit to the system's capability and demonstrate during compliance monitoring activities that the system's incapability prevents the Responsible Entity from implementing the control within the requirement.”

“the ERO Enterprise must develop mandatory reporting requirements through a request for data--through Align or another reporting mechanism--on basic information from entities using the per system capability exceptions”

“Reliability Standard CIP-003-11, Requirement R2 and Section 4 of Attachment 1 require entities to have Cyber Security Incident Response plans for low impact BES Cyber Systems, including identification, classification, and response to Cyber Security Incidents.”

“R2, Attachment 1, Section 2, Physical Security Controls.”

“R2, Attachment 1, Section 3, Electronic Access Controls.”

“adding controls to authenticate remote users, protecting authentication information in transit, and detecting malicious communications to or between assets containing low impact BES Cyber Systems with external routable connectivity.”

“protecting the authentication information in transit”

“R2, Attachment 1, Section 3.1.2....... 1,673 1 1,673 20 hrs.; $1,940”

“R2, Attachment 1, Section 3.1.3....... 1,673 1 1,673 60 hrs.; $5,820”

“R2, Attachment 1, Section 3.1.4....... 1,673 1 1,673 60 hrs.; $5,820”

“R2, Attachment 1, Section 3.1.5....... 1,673 1 1,673 1 hr.; $97”

“R2, Attachment 1, Section 3.1.6....... 1,673 1 1,673 1 hr.; $97”

“R2, Attachment 1, Section 3.2......... 1,673 1 1,673 1 hr.; $97”

“The expansion of detection requirements to include all traffic into or out of a low impact BES Cyber System, as opposed to just detecting malicious traffic in vendor-based electronic access.”

“Reliability Standard CIP-003-11, Requirement R2 and Section 4 of Attachment 1 require entities to have Cyber Security Incident Response plans for low impact BES Cyber Systems, including identification, classification, and response to Cyber Security Incidents.”

“Responsible entities, however, will be required to maintain documentation adequate to demonstrate compliance with the Reliability Standard approved by this final rule.”

“requires entities with assets containing low impact BES Cyber Systems to document and maintain plans that include controls specified in Attachment 1 of the Standard.”

“proposed Attachment 1, Section 3.1.2 would expand the scope of Reliability Standard CIP-003 to include all communications, rather than only vendor specific communications.”

“proposed Attachment 1, Section 3.1.3 would mitigate the risk of unauthenticated access to networks on which low impact BES Cyber Systems reside; specifically, it would require entities to implement controls to authenticate users prior to permitting access.”

“proposed Attachment 1, Section 3.1.4 would require responsible entities to protect their user authentication information while in transit between a remote user's Cyber Asset and either the asset containing the low impact BES Cyber Systems or the entity's authentication system.”

“NERC also states that the proposed changes remove the word 'remote' from the phrase 'electronic remote access' as the section would now include all electronic access.”

“Create one or more documented process(es) (R2).”

“R2, Attachment 1, Section 2, Physical Security Controls.”

“NERC explains that its proposed implementation plan reflects the time needed for entities to: (1) revise their cyber security policy, plan, and procedures.”

“CIP-008-7.1 (Cyber Security--Incident Reporting and Response Planning)”

“proposed Reliability Standard CIP-007-7.1, Requirement R1, holds the security objective of preventing unneeded routable protocol network accessibility, thereby accommodating more varied security controls.”

“NERC proposed to revise the standard to focus on the security objective of securing communications to and from BES Cyber Systems.”

“proposed revisions to the Standards would let responsible entities focus more on a forward-looking authorization of a change rather than a backward-looking baseline update for compliance purposes.”

“CIP-006-7.1 (Cyber Security--Physical Security of BES Cyber Systems)”

“CIP-002-7 (Cyber Security--BES Cyber System Categorization)”

“CIP-011-4.1 (Cyber Security--Information Protection)”

“CIP-013-3 (Cyber Security--Supply Chain Risk Management)”

“CIP-004-8 (Cyber Security--Personnel & Training)”

“CIP-003-10 (Cyber Security--Security Management Controls)”

“the Responsible Entity will need to document the limit to the system's capability and demonstrate during compliance monitoring activities that the system's incapability prevents the Responsible Entity from implementing the control”

“Entities, however, are required to maintain documentation adequate to demonstrate compliance with the proposed Reliability Standards. Commission and NERC staff conduct periodic audits of entities and auditors rely on the entity's documentation.”

“each generator owner of a NERC-registered IBR must "ensure the design and operation is such that each IBR meets or exceeds Ride-through requirements, in accordance with the 'must Ride-through zone' as specified in Attachment 1"”

“each generator owner of a NERC-registered IBR must adhere to voltage ride-through performance criteria during system disturbances, unless a documented hardware limitation exists in accordance with Requirement R4.”

“each generator owner of a NERC-registered IBR must ensure that its IBR adheres to ride-through requirements during frequency excursion events by continuing to exchange current and remain electrically connected in accordance with the "must ride-through zone," as specified in the p”

“Each Generator Owner identifying an IBR that is in-service by the effective date of PRC-029-1, has known hardware limitations that prevent the IBR from meeting Ride-through criteria as detailed in Requirements R1-R3, and requires an exemption from specific Ride-through criteria s”

“proposed Reliability Standard PRC-024-4 would continue to address ride-through compatible frequency and voltage protection setting ranges for synchronous generators, synchronous condensers, and type 1 and type 2 wind resources.”

“Within 12 months of the effective date of this final rule, we direct NERC to submit to the Commission its determination and, if it deems appropriate, any proposed modifications to Reliability Standard PRC-029-1.”

“we also direct NERC to submit, to the Commission, an informational filing 18 months after the conclusion of the exemption request period in proposed Reliability Standard PRC-029-1, Requirement R4 that assesses the reliability impact of the exemptions to the Standard.”

“the provision in proposed Requirement R1 requiring IBRs to meet or exceed ride-through requirements in Attachment 1 of proposed Reliability Standard PRC-029-1 that restricts the use of momentary cessation satisfies the directive to prohibit momentary cessation in the no-trip zone”

“proposed Reliability Standard PRC-029-1 advances the reliability of the Bulk-Power System by establishing voltage and frequency ride-through criteria for IBRs to prevent unnecessary tripping and momentary cessation and ensuring that post-disturbance ramp rates are unrestricted an”

“to the extent that NERC develops modifications pertaining to long-lead time projects, this final rule should serve as notice that future IBR projects must fully satisfy the ride-through performance requirements (and not later dates as suggested by some commenters).”

“responsible entities would be required to implement process(es) to monitor, detect, and evaluate anomalous activity in 'networks protected by the Responsible Entity's Electronic Security Perimeter(s)'”

“responsible entities would be required to implement process(es) for retaining INSM data associated with anomalous network activity as determined by the applicable responsible entities.”

“responsible entities would be required to implement process(es) to protect INSM monitoring data collected and retained in support of Requirements R1 and R2 to guard against the risk of unauthorized deletion or modification.”

“we direct NERC, pursuant to section 215(d)(5) of the FPA, to develop and file within 12 months of the effective date of this final rule modifications to Reliability Standard CIP-015-1 to extend INSM implementation to EACMS and PACS outside of the electronic security perimeter.”

“the scope of CIP-networked environment includes the systems within the electronic security perimeter and one or more of the following: (1) network segments that are connected to EACMS and PACS outside of the electronic security perimeter; (2) network segments between EACMS and PA”

“communication between PACS and controllers and communications to and from EACMS used solely for electronic access monitoring are included in the term CIP-networked environment.”

“Reliability Standard CIP-015-1 requires INSM for all high impact BES Cyber Systems with and without external routable connectivity and medium impact BES Cyber Systems with external routable connectivity to ensure the identification of anomalous network activity indicating an ongo”

“Reliability Standard CIP-015-1 requires INSM for all high impact BES Cyber Systems with and without external routable connectivity and medium impact BES Cyber Systems with external routable connectivity”

“the new or modified CIP Reliability Standards should address the need for each responsible entity to develop a baseline for their network activity by analyzing for security purposes their network traffic and data flows.”

“the new or modified CIP Reliability Standards should address the need for responsible entities to monitor and detect 'unauthorized activity, connections, devices, network communication protocols, and software' in the CIP-networked environment.”

“the methods ensure: (1) logging of network traffic; (2) maintaining the logs, and other data collected, regarding network traffic that are of 'sufficient data fidelity to draw meaningful conclusions' to investigate an incident”

“maintaining the logs, and other data collected, regarding network traffic that are of 'sufficient data fidelity to draw meaningful conclusions' to investigate an incident”

“maintaining the integrity of the logs and other data by employing measures that minimize the likelihood of an attacker removing evidence of their tactics, techniques, and procedures.”

“responsible entities can take certain steps to mitigate the cost impacts of extending INSM to EACMS and PACS outside the electronic security perimeter by implementing INSM in a risk-based manner pursuant to Requirement R1.1 of proposed Reliability Standard CIP-015-1.”

“a responsible entity could define incident alert thresholds and establish a baseline for normal network activity that could reduce the cost of retaining and protecting INSM data under Requirements R2 and R3, respectively, by reducing the amount of INSM data responsible entities m”

“WGQ Cybersecurity Related Standards (Version 4.0, September 29, 2023)”

“we direct each transmission provider to file, in the above-captioned dockets, a one-time informational report on its extreme weather vulnerability assessment and risk mitigation efforts within 120 days of the publication of this final rule”

“transmission providers: (1) establish a scope; (2) develop inputs; (3) identify vulnerabilities and exposure to extreme weather hazards; (4) estimate the costs of impacts in their extreme weather vulnerability assessments”

“whether, and if so how, transmission providers: (1) establish a scope; (2) develop inputs; (3) identify vulnerabilities and exposure to extreme weather hazards; (4) estimate the costs of impacts”

“identify vulnerabilities and exposure to extreme weather hazards...for the purpose of these reports, we define an extreme weather vulnerability assessment as an analysis that identifies where and under what conditions jurisdictional transmission assets and operations are at risk”

“estimate the costs of impacts in their extreme weather vulnerability assessments”

“use the results of those assessments to develop risk mitigation measures...extreme weather resilience efforts can take many forms but generally involve both measures to prevent or minimize damage to vulnerable assets...and to manage the consequences of such damage when it occurs ”

“the reports we are proposing herein would be filed by either the public utility members of RTOs/ISOs, the RTOs/ISOs themselves, or both, as well as other public utility transmission providers outside of RTO/ISO regions”

“we revise questions 8 and 19...by replacing references to disadvantaged and vulnerable communities, and affected and frontline communities, respectively, with the term 'affected communities'...any other community or stakeholder group respondents consider in their extreme weather ”

“the Commission did not intend in the NOPR to require transmission providers to conduct extreme weather vulnerability assessments where they do not do so already...the proposed reporting requirement was meant only to capture plans that have already been made, but not yet been impl”

“If respondents' policies and processes for developing their own extreme weather vulnerability assessments differ from those the Commission described, the Commission proposed to require that transmission providers still describe in their one-time reports the policies and processes”

“directs the North American Electric Reliability Corporation...to submit a new Reliability Standard or modifications to Reliability Standard TPL-001-5.1 that addresses concerns pertaining to transmission system planning for extreme heat and cold weather events”

“development of benchmark planning cases based on information such as major prior extreme heat and cold weather events and/or future meteorological projections”

“planning for extreme heat and cold weather events using steady state and transient stability analyses expanded to cover a range of extreme weather scenarios including expected availability of the resource mix during extreme heat and cold weather conditions”

“development of corrective action plans that mitigate specified instances where performance requirements during extreme heat and cold weather events are not met”

“We direct NERC to submit the proposed new or modified Reliability Standard no later than 18 months from the publication of this final rule in the Federal Register.”

“we direct NERC to develop a phased-in implementation timeline for the different requirements of the new or modified Reliability Standard...that shall begin within 12 months of the effective date of a Commission order approving the proposed Reliability Standard.”

“in developing extreme heat and cold benchmark events, NERC shall ensure that benchmark events reflect regional differences in climate and weather patterns.”

“NERC to include in the Reliability Standard the framework and criteria that responsible entities shall use to develop from the relevant benchmark event planning cases to represent potential weather-related contingencies (e.g., concurrent/correlated generation and transmission out”

“we agree with MISO that including a mechanism to update the benchmark event at least every five years would strike a reasonable balance between the benefits of using the most up-to-date meteorological data and administrative the burdens”

“failure to study the wide-area impact of extreme heat or cold weather conditions in transmission planning could result in reliability issues affecting multiple regions...remaining undetected in the long-term planning horizon”

“it is important that all responsible entities likely to be impacted by the same extreme weather events use consistent benchmark events...neighboring planning regions are assuming similar weather conditions and are able to coordinate their assumptions accordingly.”

“We also direct NERC to identify the responsible entities for developing benchmark planning cases and conducting wide-area studies under the new or modified Reliability Standard.”

“we direct NERC to ensure that the proposed new or modified Reliability Standard becomes mandatory and enforceable beginning no later than 12 months from the effective date of Commission approval of the new or modified Reliability Standard.”

“each transmission planner and planning coordinator must prepare an annual planning assessment for its portion of the Bulk-Power System...required for both near-term and long-term transmission planning horizons.”

“the framework and criteria that responsible entities shall use to develop...planning cases to represent potential weather-related contingencies (e.g., concurrent/correlated generation and transmission outages, derates)”

“expected future conditions of the system such as changes in load, transfers, and generation resource mix, and impacts on generators sensitive to extreme heat or cold, due to the weather conditions indicated in the benchmark events.”

“establishing one or more benchmark planning cases, based on benchmark events, should form the basis for sensitivity analysis”

“Coordination Among Registered Entities and Sharing of Data and Study Results”

“responsible entities would use the benchmark events to develop benchmark planning cases to conduct studies to assess the limitations of the transmission system locally and over a wide-area, and to understand resource availability and potential firm load shedding requirements unde”

“the impact of concurrent failures of Bulk-Power System generation and transmission equipment and the potential for cascading outages that may be caused by extreme heat and cold weather events should be studied and corrective actions should be identified and implemented.”

“corrective action plans that include mitigation activities for specified instances where performance requirements during extreme heat and cold events are not met”

“Modifications to the Traditional Planning Approach”

“maintaining the reliability of the Bulk-Power System requires transmission system planning to account for the potential impact of extreme heat and cold weather over wide geographical areas, and to consider the changing resource mix.”

“enhances the security posture of public utilities through improvements in the ability to protect against, detect, respond to, or recover from a cybersecurity threat”

“not already mandated by the Reliability Standards, or otherwise mandated by local, State, or Federal law, decision, or directive; otherwise legally mandated; or an action taken in response to a Federal or State agency merger condition”

“requiring a utility to demonstrate that its proposed cybersecurity investments will cause the utility to achieve Maturity Indicator Level 3 of the C2M2 Domains rather than the incremental steps of the lower Maturity Indicator Levels”

“Cybersecurity services may be either automated or manual and can include, but are not limited to... incident response, forensic investigation, network monitoring, data sharing, data recovery, disaster recovery, network restoration”

“a specific cybersecurity recommendation from a relevant Federal authority, such as DHS's CISA, the FBI, NSA, or DOE”

“security controls enumerated in the NIST SP 800-53 'Security and Privacy Controls for Information Systems and Organizations' catalog... security controls satisfying an objective found in the NIST Cybersecurity Framework technical subcategory”

“Cybersecurity products can include, but are not limited to... intrusion detection systems, anomaly detection systems... forensic toolkits, incident response tools... event logging systems”

“Cybersecurity products are generally hardware, software, and cybersecurity services that can be used for information technology (IT) systems and/or operational technology (OT) systems.”

“we direct NERC to develop new or modified CIP Reliability Standards that require applicable responsible entities to implement INSM for all high impact BES Cyber Systems with and without external routable connectivity and medium impact BES Cyber Systems with external routable conn”

“we direct that NERC submit responsive new or modified CIP Reliability Standards within 15 months of the effective date of this final action.”

“any new or modified CIP Reliability Standards should address the need for responsible entities to develop baselines of their network traffic inside their CIP-networked environment.”

“any new or modified CIP Reliability Standards should address the need for responsible entities to monitor for and detect unauthorized activity, connections, devices, and software inside the CIP-networked environment.”

“require responsible entities to identify anomalous activity to a high level of confidence by: (1) logging network traffic (we note that packet capture is one means of accomplishing this goal)”

“require responsible entities to identify anomalous activity to a high level of confidence by: ... (2) maintaining logs and other data collected regarding network traffic”

“implementing measures to minimize the likelihood of an attacker removing evidence of their tactics, techniques, and procedures from compromised devices.”

“INSM is a component of a comprehensive cybersecurity strategy as it provides an additional layer of defense against intrusions regardless of the attack vector or whether existing security controls failed. With INSM, an entity can maintain visibility over communications between ne”

“INSM facilitates the detection of anomalous network activity indicative of an attack in progress, thus increasing the probability of early detection and allowing for quicker mitigation and recovery from an attack.”

“The recorded network traffic can also be retained to facilitate timely recovery and/or perform a thorough post-incident analysis of malicious activity... allowing for: (1) determining the timeframe for backup restoration; (2) creating a record of the attack for incident reporting”

“NERC should include in its study a determination of: (1) ongoing risk to the reliability and security of the Bulk-Power System posed by low and medium impact BES Cyber Systems that would not be subject to the new or modified Reliability Standards, including the number of low and ”

“potential technological or other challenges involved in extending INSM to additional BES Cyber Systems, as well as possible alternative mitigating actions to address ongoing risks.”

“we direct NERC to develop new or modified CIP Reliability Standards that are forward-looking, objective-based, and that address the following three security objectives that pertain to INSM.”

“To address this gap, we direct NERC to develop new or modified CIP Reliability Standards requiring INSM... to ensure the detection of anomalous network activity indicative of an attack in progress. These provisions will increase the probability of early detection and allow for qu”

“A utility should seek CEII treatment, as appropriate, for any part of its filing seeking incentives that includes specific engineering, vulnerability, or detailed design information about proposed or existing critical infrastructure.”

“The comprehensive assessment requires a more in-depth review than the current part 12 inspection, formally incorporates the existing Potential Failure Mode Analysis process, and requires a semi-quantitative risk analysis.”

“This final rule codifies the requirement that licensees of one or more high or significant hazard potential dams must prepare, maintain, file with the Commission, and periodically review and update an Owner's Dam Safety Program.”

“to prepare, maintain, and submit a public safety plan to D2SI, which is the current practice required by existing D2SI guidance.”

“to report rescues in addition to deaths and serious injuries; and to prepare, maintain, and submit a public safety plan to D2SI”

“As revised, Sec. 12.35 establishes the scope of a periodic inspection, which includes review of prior reports, a field inspection, review of the surveillance and monitoring plan and data, and review of dam and public safety programs.”

“The final rule adds a sentence to Sec. 12.35(a) to clarify that it is the licensee's responsibility to provide to the independent consultant team all information and reports necessary to fulfill the requirements of this section.”

“The Commission is codifying the Potential Failure Mode Analysis as part of the scope of a part 12 inspection, specifically during a comprehensive assessment and typically at a 10-year interval.”

“clarify that written approval of the facilitator(s) of the Potential Failure Mode Analysis or risk analysis must also be obtained”

“licensees, in pertinent part, to 'maintain the project works in a condition of repair adequate . . . for the efficient operation of said works,' to 'make all necessary renewals and replacements,' and to 'conform to such rules and regulations as the Commission may from time to tim”

“These pertain to the surveillance, monitoring, and performance of the project, with a focus on whether any potential failure modes, previously identified or not, are active, developing, or warrant further evaluation at the time of the periodic inspection.”

“clarify that the independent consultant team proposal must identify the technical disciplines and level of expertise required to perform the inspection and show that each member of the independent consultant team who is not designated as an independent consultant meets the requir”

“a public utility seeking a cybersecurity incentive for a facility that is classified as a low impact BES Cyber System would invest in ways to make that facility meet all the requirement and sub-requirement protections applicable to medium or high impact BES Cyber Systems”

“all the cyber communications to and from a low impact system location must connect to a medium or high impact BES Cyber System and the cyber communication security controls required for the medium or high impact BES Cyber System must be implemented on the low impact system”

“if the Commission approves a public utility's request for cybersecurity incentives pursuant to either the Med/High or Hub-Spoke Incentive and the public utility subsequently ceases to implement the CIP Reliability Standards consistent with the order approving the application”

“we propose to initially only consider incentives that fall within the first type of security controls, automated and continuous monitoring... continuous monitoring tools that utilize automated features for pulling information from a variety of sources”

“public utilities seeking an incentive under this approach would need to show how a cybersecurity investment...allows the public utility to meet NIST Framework security controls...will go above and beyond the requirements of the CIP Reliability Standards, and materially enhance th”

“Informational Filing and Verification..... 61”

“other implementation expenses, such as risk assessments by third parties or internal system reviews and initial responses to findings of such assessments”

“Commission staff identified five types of security controls included in the NIST Framework that may be considered for incentives under the NIST Framework approach: (1) Automated and continuous monitoring; (2) access control; (3) data protection; (4) incident response; and (5) phy”

“a public utility to install a dynamic asset management program to improve its ability to quickly detect and address new or previously unknown equipment on its network...automatically and continuously scans the current inventory of hardware and software across both the information”

“implementation of a dynamic file analysis program or a 'sandbox'...an automated malware detection environment that continuously scans email attachments and weblinks in the corporate email system for malicious code”

“requires Responsible Entities to develop and implement a plan to address the risks posed by unauthorized disclosure (confidentiality) and unauthorized modification (integrity) of Real-time Assessment and Real-time monitoring data while being transmitted between applicable Control”

“The required plan must include the following: (1) Identification of security protections; (2) identification of where the protections are applied; and (3) identification of the responsibilities of each entity.”

“identification of where the protections are applied; and (3) identification of the responsibilities of each entity in case a Control Center is owned or operated by different responsible entities.”

“identification of the responsibilities of each entity in case a Control Center is owned or operated by different responsible entities.”

“we direct that NERC develop modifications to the CIP Reliability Standards to require protections regarding the availability of communication links and data communicated between bulk electric system Control Centers.”

“responsible entities should therefore plan for both recovery of compromised communication links and use of backup communication capability should it be needed for redundancy (i.e., satellite or other alternate backup communications).”

“entities could enter into service contracts with telecommunication service providers that include an agreed-upon quality of service commitment to maintain the availability of the data exchange capability to minimize the availability risk.”

“requires each planning coordinator and transmission planner to perform an annual planning assessment of its portion of the bulk electric system considering a number of system conditions and contingencies with a risk-based approach”

“For more common scenarios (i.e., planning events), the planning entity must develop a corrective action plan if it determines through studies that its system would experience performance issues.”

“For less common scenarios that could result in potentially severe impacts such as cascading (i.e., extreme events), the planning entity must conduct a comprehensive analysis to understand both the potential impacts on its system and the types of actions that could reduce or mitig”

“Category P5 requires the study of a single-line-to-ground faulted element...along with a failure to operate of a non-redundant component of the protection system (i.e., a single point of failure) protecting the faulted element.”

“if an entity determines that its system will experience cascading as a result of a three-phase fault scenario, the entity would evaluate possible actions designed to reduce the likelihood or mitigate the consequences of the event”

“Reliability Standard TPL-001-5 provides for a more complete consideration of factors for selecting which known outages will be included in near-term transmission planning horizon studies.”

“Reliability Standard TPL-001-5 modifies requirements for stability analysis to require an entity to assess the impact of the possible unavailability of long lead time equipment, consistent with the entity's spare equipment strategy.”

“a properly planned transmission system should ensure the known, planned removal of facilities (i.e., generation, transmission, or protection system facilities) for maintenance purposes without...detrimental impacts to system reliability such as cascading, voltage instability, or ”

“The table lists seven contingency planning events (P1 through P7) that require steady-state and stability analysis as well as five extreme event contingencies: Three for steady-state and two for stability.”

“five extreme event contingencies: Three for steady-state and two for stability...the entity would evaluate possible actions designed to reduce the likelihood or mitigate the consequences of the event”

“requires Responsible Entities to develop and implement a plan to address the risks posed by unauthorized disclosure (confidentiality) and unauthorized modification (integrity) of Real-time Assessment and Real-time monitoring data while being transmitted between applicable Control”

“The required plan must include the following: (1) Identification of security protections; (2) identification of where the protections are applied; and (3) identification of the responsibilities of each entity in case a Control Center is owned or operated by different responsible ”

“identification of where the protections are applied”

“identification of the responsibilities of each entity in case a Control Center is owned or operated by different responsible entities.”

“we direct that NERC develop modifications to the CIP Reliability Standards to require protections regarding the availability of communication links and data communicated between bulk electric system Control Centers”

“responsible entities should therefore plan for both recovery of compromised communication links and use of backup communication capability should it be needed for redundancy (i.e., satellite or other alternate backup communications).”

“entities could enter into service contracts with telecommunication service providers that include an agreed-upon quality of service commitment to maintain the availability of the data exchange capability to minimize the availability risk.”

“protections for the availability of communication links and data communicated between bulk electric system Control Centers should encompass both entity-owned and third-party owned Control Centers...which will require coordination between neighboring responsible entities.”

“measures to address response to, and recover from, a cybersecurity incident”

“all owner/operators within the proposed scope of applicability would be required to have a Cybersecurity Incident Response Plan (CIRP), regardless of whether they identify any Critical Cyber Systems”

“owner/operators to whom the proposed rule applies would be required to annually conduct an enterprise-wide cybersecurity evaluation that would identify the current profile of cybersecurity...compared to the target profile”

“owner/operators subject to the proposed rule would be required to have a CAP that includes a schedule for assessments, an annual report of assessment results, and identification of unaddressed vulnerabilities”

“owner/operators would also be required to ensure any individuals or companies assigned or hired to evaluate the effectiveness of the owner/operator's CRM program are independent, i.e., do not have a personal, financial interest in the results”

“detailed measures to detect cybersecurity incidents and monitor these Critical Cyber Systems”

“identification of Critical Cyber Systems, specific network architecture issues, and baseline communications”

“detailed measures to protect these Critical Cyber Systems”

“identification of individuals/positions responsible for the governance of the owner/operator's CRM program, including an accountable executive and Cybersecurity Coordinator(s)”

“TSA is proposing that all owner/operators currently required to report significant security concerns to TSA...report cybersecurity incidents to CISA”

“The presence of backups could allow for system restoration, data recovery, and unhindered system operations”

“ensuring that OT and IT systems are separate and segregated will help protect against intrusions that can exploit vulnerabilities from one system and move laterally to infect another”

“Documentation To Establish Compliance (Proposed Sec. Sec. 1580.331, 1582.231, and 1586.231)”

“A commitment to patch management, system segmentation, and firewalls could limit the resources potential malicious actors would be able to access during an intrusion”

“Continuous monitoring of the network could help to detect and respond to potential threats and limit system degradation”

“owner/operators to whom the proposed rule applies would be required to develop a COIP”

“TSA is requesting comments on whether proposed requirements for supply chain risk management should also include requirements to ensure that any new software purchased for, or to be installed on, Critical Cyber Systems meets CISA's Secure-by-Design”

“a more limited requirement, on certain over-the-road bus (OTRB) owner/operators, to report cybersecurity incidents”

“improving the owner/operator's ability to identify, detect, protect against, respond to, and recover from cybersecurity incidents”

“TSA is proposing that owner/operators of designated pipeline facilities and systems also report both physical and cybersecurity incidents”

“A contingency plan required under § 1542.301.”

“Alternate security procedures, if any, that the airport operator intends to use in the event of natural disasters, and other emergency or unusual conditions.”

“Incident management procedures used to comply with § 1542.307.”

“Each airport operator must notify TSA no more than 6 hours after the discovery of any changed condition described in paragraph (a) of this section... The airport operator must inform TSA of each interim measure being taken to maintain adequate security.”

“For changed conditions expected to be less than 60 days duration, each airport operator must forward the information required in paragraph (b) of this section in writing to TSA within 72 hours of the original notification.”

“For changed conditions expected to be 60 days or more duration, each airport operator must forward the information...in the form of a proposed amendment to the airport operator's security program...within 30 days of the discovery.”

“Ensure that an individual is immediately denied entry to a secured area when that person's access authority for that area is withdrawn.”

“Provide for detection of, and response to, each unauthorized presence or movement in, or attempted entry to, the secured area by an individual whose access is not authorized.”

“Provide for detection of, and response to, each unauthorized presence or movement in, or attempted entry to, the AOA by an individual whose access is not authorized.”

“Is available to TSA on a 24-hour basis.”

“Immediately initiate corrective action for any instance of non-compliance with this part, its security program, and applicable Security Directives.”

“Auditing the system at a minimum of once a year or sooner, as necessary, to ensure the integrity and accountability of all identification media.”

“A record is made of each law enforcement action taken in furtherance of this part; and The record is maintained for a minimum of 180 days.”

“Procedures by which the aircraft operator or foreign air carrier will immediately notify the airport operator and provide for alternative security measures when there are changed conditions as described in § 1542.103(a).”

“Procedures by which the tenant will immediately notify the airport operator of and provide for alternative security measures for changed conditions as described in § 1542.103(a).”

“Revalidate the identification system or reissue identification media if a portion of all issued, unexpired identification media are lost, stolen, or otherwise unaccounted for, including identification media that are combined with access media.”

“Review with sufficient frequency all security-related functions to ensure that all are effective and in compliance with this part, its security program, and applicable Security Directives. Immediately initiate corrective action for any instance of non-compliance.”

“Owners or operators must also prepare and document a Cyber Incident Response Plan that outlines instructions on how to respond to a cyber incident and identifies key roles, responsibilities, and decision-makers amongst personnel.”

“this final rule requires that owners or operators of U.S.-flagged vessels, facilities, or Outer Continental Shelf (OCS) facilities required to have a security plan under 33 CFR parts 104, 105, and 106 to develop and maintain a Cybersecurity Plan and Cyber Incident Response Plan.”

“Revised Sec. 101.655 to reflect that the Cybersecurity Plan must also be submitted to the Coast Guard for review and approval within 24 months of the effective date of this final rule.”

“Owners or operators must also designate a Cybersecurity Officer (CySO) who must ensure that U.S.-flagged vessel, facility, or OCS facility personnel implement the Cybersecurity Plan and the Cyber Incident Response Plan.”

“The CySO must also ensure that the Cybersecurity Plan is up to date and undergoes an annual audit.”

“amended Sec. 101.620(b)(7) to clarify that all entities not subject to 33 CFR 6.16-1 must report all reportable cyber incidents to the National Response Center (NRC) and amended Sec. 101.650(g)(1) to clarify...report reportable cyber incidents to the NRC without delay.”

“Revised Sec. 101.650(e)(1) to specify that owners and operators will need to conduct the cyber assessment within 24 months of the effective date of this final rule...Revised Sec. 101.650(e)(1)(i) to limit the identification of vulnerabilities to only 'critical' OT and IT systems.”

“revised Sec. 101.650(e)(iv) to remove 'mitigate any unresolved vulnerabilities' and, instead, require that the owner or operator ensure patching or implementation of documented compensating controls for all known exploited vulnerabilities (KEVs) in critical IT or OT systems, with”

“Revised Sec. 101.650(e)(2) in this final rule to clarify that penetration testing must be completed in conjunction with renewing the Cybersecurity Plan and to specify that the CySO must submit a letter verifying that the test was conducted, as well as all vulnerabilities identifi”

“Revised Sec. 101.635(b)(1) to require two cybersecurity drills every 12 months instead of requiring at least one cybersecurity drill every 3 months and added 'as required by 33 CFR 104.230, 105.220, or 106.225,' where appropriate.”

“The CySO must also arrange for cybersecurity inspections, ensure that personnel have adequate cybersecurity training, record and report cybersecurity incidents to the owner or operator, and take steps to mitigate them.”

“enabling of automatic account lockout after repeated failed log in attempts on all password protected information technology (IT) systems”

“changing default passwords (or implementing other compensating security controls if unfeasible) before using any IT or OT systems”

“implementing multifactor authentication on password-protected IT and remotely accessible OT systems”

“applying the principle of least privilege to administrator or otherwise privileged accounts on both IT and OT systems”

“removing or revoking user credentials when a user leaves the organization”

“maintain an accurate inventory of network-connected systems including those critical IT and OT systems”

“develop and document the network map and OT device configuration information”

“ensure that logs are securely captured, stored, and protected and accessible only to privileged users”

“Revised Sec. 101.650(c)(2) to specify that effective encryption must be deployed to maintain confidentiality of sensitive data and integrity of IT and OT traffic and to require that only sensitive data be encrypted.”

“develop and maintain a list of any hardware, firmware, and software approved by the owner or operator that may be installed on IT or OT systems”

“ensure that applications running executable code are disabled by default on critical IT and OT systems”

“Revised Sec. 101.625(d)(10), regarding the CySO's responsibilities in reporting incidents, to refer to reportable cyber incidents...CySO must also arrange for cybersecurity inspections...record and report cybersecurity incidents to the owner or operator, and take steps to mitigat”

“Revised Sec. 101.630(e)(1)(ii) to clarify that the owner and operator will have at least 60 days to submit its proposed amendments...Revised Sec. 101.630(e)(2) to add new paragraph (e)(2)(i) to note that nothing...should be construed as limiting the owner or operator...from the t”

“Any owner or operator required to have a security plan under part 104 or 105 of this subchapter shall, without delay, report a TSI to their local COTP and immediately thereafter begin following the procedures set out in their security plan”

“An owner or operator required to have a security plan under parts 104, 105, or 106 of this subchapter shall, without delay, report breaches of security to the National Response Center”

“An owner or operator required to have a security plan under part 104, 105, or 106 of this subchapter shall, without delay, report activities that may result in a transportation security incident to the National Response Center”

“Each owner or operator of a vessel or facility required to have a security plan under parts 104 or 105 of this subchapter affected by a change in the MARSEC Level must ensure confirmation to their local COTP the attainment of measures or actions described in their security plan”

“Each owner or operator of a vessel or facility to whom a MARSEC Directive applies is required to comply with the relevant instructions contained in a MARSEC Directive issued under this section within the time prescribed by that MARSEC Directive.”

“Within the time prescribed in the MARSEC Directive, acknowledge receipt of the MARSEC Directive to their local COTP... and specify the method by which the measures in the MARSEC Directive have been implemented”

“In the event that the owner or operator...is unable to implement the measures in the MARSEC Directive, the owner or operator must submit proposed equivalent security measures and the basis for submitting the equivalent security measures to the COTP”

“vessels and facilities required to have security plans under part 104, 105, or 106 of this subchapter shall implement the measures specified in their security plans for the applicable MARSEC Level.”

“The list of cancelled TWICs used to conduct the card validity check must be updated within 12 hours of any increase in MARSEC level, no matter when the information was last updated.”

“Any owner or operator required to have a security plan under part 106 of this subchapter shall, without delay, report a TSI to their cognizant District Commander and immediately thereafter begin following the procedures set out in their security plan”