1. (1) By July 1st of each calendar year, all utilities shall submit documentation that the utility has prepared and implemented a cybersecurity plan. At a minimum, the documentation shall include:

   1. (a) Contact information for utility employee(s) responsible for cybersecurity;
   2. (b) A statement indicating whether the utility conducts annual cybersecurity training for the utility personnel with access to any utility Information Technology System or Operational Technology System; and
   3. (c) A statement indicating whether the utility has procured cybersecurity insurance.

2. (2) The documentation filed must include a sworn statement by the utility’s chief executive officer, president, or another person with an equivalent role and authority, over the development and implementation of the cybersecurity plan. Such statement shall, at a minimum, confirm that:

   1. (a) The utility has prepared and implemented the cybersecurity plan described in the filing;
   2. (b) The cybersecurity plan has been prepared or updated within the last two (2) years; and
   3. (c) All documentation and information filed is current and accurate.

Authority: T.C.A. §§ 65-2-102 and 65-4-127. Administrative History: New rules filed June 27, 2023; effective September 25, 2023.