Edition 2026-10-16-r2. This HTML manual provides the complete procedural content for reading and navigation. Use the editable workbook or fillable PDF for controlled project records.
State and local research scope
This companion supports the four sector planning packs. It contains a selected-authority profile for each of the 50 states and a method for resolving local and facility-specific requirements.
What the state profiles establish
Each profile identifies the authority reviewed, the relevant scope issue and the next facility decision. Some identify an enacted sector law; others identify guidance, a public-entity standard, a proposal or a research gap. They do not establish that every potentially applicable state provision was located.
A state profile is not a completed facility determination. Each state and sector row in the workbook starts Unresolved until a responsible person records the facility facts, exact instrument, evidence and reason. No inferred absence of law is treated as an exemption.
Research limits that affect use
All 50 states received targeted primary-source searches. Selected instruments were examined more deeply where they could change the assessment plan. Louisiana and Vermont sector-wide obligations remain research gaps. Several authorities restrict full-text retrieval. The bibliography records those limits.
This edition does not inventory every municipal ordinance, county requirement, tribal authority, port rule, permit, insurance term or private agreement nationwide. That work requires a facility list, footprint, ownership, permits and contracts. US territories and a full District of Columbia review are outside the requested 50-state inventory.
Use with the project workbook
Filter the Applicability sheet by facility state and sector. Copy a screening row for each distinct obligation rather than replacing a source note with a conclusion. Link the Local duties, Evidence, Notifications and Work plan records. Keep the source note and facility decision in separate fields.
Using the corrected workbook edition
Edition 2026-10-16-r2 adds structured execution records and separates evidence gaps from supported conclusions.
Before execution
Use the exact criterion, population, period, sampling rationale, permitted method, execution date, actual observation, evidence IDs and reviewer. A proposed test is not an assessment result. Keep sources and operating authority separate.
Open and incomplete decisions
The open count includes blanks, invalid decision text and resolved selections missing required record fields. Fields present still requires qualified review. Actual approvals remain uncompleted until the responsible people review the work.
Scope and authority
Record every proposed exclusion, its reason and responsible reviewer in Scope decisions. Deferred work remains visible. State research is a separately labelled routing register; the 200 state-sector rows are research tasks. For NY use the Clause matrix and Q01-Q10. Missing current instruments and local facts remain unresolved.
Source access and revision
Sources list retrieval status and available snapshot hashes. A restricted URL is not proof that a duty does not exist. Edition record tracks actual project revisions and reviews. Retain the previous edition and do not treat a template publication as a personal technical or legal approval.
Sources: F01 Guide to Operational Technology Security Revision 3, F03 Technical Guide to Information Security Testing and Assessment
How to resolve a state profile
The compliance owner owns the applicability decision. The project manager tracks the evidence and prevents an unresolved legal assumption from becoming a completed task.
Read the actual instrument
Start with the linked authority and obtain the current codified text, adopted rule, final order or issued directive. Verify legal status, effective date, compliance date, entity definition, system scope, exemptions and incorporated documents. Preserve the copy and retrieval date.
Prove the facility facts
Establish the legal owner and operator, public/private status, regulated service, registrations, permits, contracts and physical/control-center footprint. Water population, customer count and service connections need separate evidence. A federal registration or grant condition can create a different boundary from a state utility franchise.
Decide and document
Use Applicable, Not applicable with reason, or Unresolved. An applicable record names the work, frequency, due-date rule, evidence, recipient and authorized official. A nonapplicability record names the exclusion and the facts that satisfy it. An unresolved record names the missing instrument or fact and how it limits the assessment.
Recheck changes
Review after an ownership change, new state footprint, changed service population, material process or architecture change, new contract, amended rule or significant incident. Assign a named owner and event-based or dated review. Do not roll an old filing date forward without checking the governing cycle.
State and sector differences
Use federal scope and the state instrument together. A state can regulate an entity for a different reason than its federal sector regulator.
| Sector | Additional state and local checks |
|---|---|
| Water and wastewater | Drinking-water primacy agency, wastewater permit authority, public-health reporting, utility commission where applicable, public-body cyber law and local emergency arrangements. Keep drinking-water and wastewater populations separate. |
| Power and energy | State utility and pipeline jurisdiction, investor-owned/municipal/cooperative status, current security and emergency orders, interconnection contracts, public-entity policies and the relevant federal system boundaries. |
| Manufacturing | State-plan occupational safety coverage, environmental and discharge permits, chemical emergency arrangements, government contracts, product/quality requirements and personal-information duties. Insurance-licensee laws are not a substitute. |
| Transportation | Mode and operating authority, state DOT and local ownership, rail-transit State Safety Oversight, port/airport agreements, pipeline authority, public-body policies and current issued federal security instruments. |
Local jurisdiction work instructions
Create a local record for each facility and significant remote site. Resolve overlapping authorities before deciding the notification and operating plan.
Identify the authorities
Confirm street address, municipality, county, state, tribal jurisdiction if relevant, owner, operator, permit identifiers and emergency response district. Include the local emergency manager, fire/HazMat authority, water or sewer authority, port/airport authority and relevant transportation or utility board as applicable.
Identify the controlling record
Review permit conditions, local ordinances, franchise or concession agreements, board policies, leases, procurement requirements, mutual-aid agreements, emergency plans and insurer terms. Record whether each is law, permit, adopted policy, contract or voluntary guidance. Do not presume a local technical checklist is legally binding.
Connect physical consequences and cyber events
An OT event can require separate cyber, public-health, environmental, safety, customer and contractual notices. Where EPCRA/CERCLA applies, EHS determines chemical thresholds and the appropriate state/tribal and local emergency recipients. Treat the release decision independently of whether personal data was taken.
Confirm the route without creating an incident
Use the authority's published procedure and an authorized non-incident clarification if needed. Record the official role, verified channel, after-hours route and alternate. Do not send a fabricated report to test the process. During a real incident, follow the applicable reporting duty and preserve the submission receipt.
Sources: F06 State Plans, F07 Emergency Release Notifications under EPCRA
Information needed for local determinations
The following inputs are required before a location-specific local pack can be completed. The worksheets in this volume record the decision and source.
| Input | Why it changes the pack |
|---|---|
| Facility and remote-site addresses | Identifies city, county, tribal/other authority and emergency response district. A corporate headquarters address is insufficient. |
| Owner operator and public-body status | Determines public-agency cyber duties, utility jurisdiction, board policies and responsibility for filings. |
| Permits licenses registrations and awards | Identifies required plans, operating conditions, audit or reporting duties and the actual filing official. |
| Contracts leases and insurance terms | Identifies supplier, landlord, customer, grant, franchise and insurance requirements that are not visible in public rulebooks. |
| Operating and information boundaries | Distinguishes IT/OT, process safety, quality records, SSI/CEII/CUI and cross-state dependencies. |
| Prior reports and approvals | Establishes actual certification dates, existing regulator conditions and recurring cycles rather than estimated dates. |
Alabama applicability profile
ADEM encourages periodic water and wastewater cyber assessments. Treat this page as guidance. Separately inspect applicable utility rules, permit conditions and public-entity policies.
Authority and research status
ADEM. Research classification: Agency guidance. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S01 Alabama selected authority
Alaska applicability profile
DEC explains federal AWIA coverage. Confirm the actual PWSID and certification history. The page does not establish a uniform state OT assessment frequency for all four sectors.
Authority and research status
Alaska DEC. Research classification: Agency guidance. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S02 Alaska selected authority
Arizona applicability profile
ARS 18-552 concerns investigation and notice of personal-information breaches. A SCADA disruption without the statutory data trigger must be assessed under other operational, utility and contractual duties.
Authority and research status
Arizona Legislature. Research classification: Selected enacted law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S03 Arizona selected authority
Arkansas applicability profile
An official Act 260 implementation memo identifies public-entity and contractor security-incident reporting to the Legislative Auditor. Verify the current statute and covered-entity definition before using its five-business-day reference. This is not a general private-industry OT assessment law.
Authority and research status
Arkansas Division of Elementary and Secondary Education. Research classification: Official implementation memo. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S04 Arkansas selected authority
California applicability profile
Use the CPUC emergency-reporting route for covered utilities. Identify applicable general orders and utility-specific decisions separately. Municipal utilities, investor-owned utilities, ports and state agencies can have different authorities.
Authority and research status
California PUC. Research classification: Regulator routing source. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S05 California selected authority
Colorado applicability profile
Selected 4 CCR 723-3 Rule 3539 requires a distribution-grid cybersecurity and physical-security narrative in the relevant planning context. Verify current rule version, filing scope and utility status. It is not a statewide manufacturing audit mandate.
Authority and research status
Colorado Secretary of State and PUC. Research classification: Selected rule text. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S06 Colorado selected authority
Connecticut applicability profile
The DPH circular is an older implementation record. Use it to identify water planning and self-assessment expectations, then obtain current DPH requests and PURA cyber-review instructions. Do not reuse its 2021 dates as current deadlines.
Authority and research status
Connecticut DPH. Research classification: Historical agency circular. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S07 Connecticut selected authority
Delaware applicability profile
The PSC describes annual cybersecurity question-and-response filings for Class A utilities in DelaFile. Determine classification, filing instructions and corporate coverage. An annual questionnaire does not prove a particular field test is mandated.
Authority and research status
Delaware PSC. Research classification: Regulator program. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S08 Delaware selected authority
Florida applicability profile
Section 282.3185 governs local-government cybersecurity and incident reporting. Identify the covered local government and severity/ransomware trigger before populating the clock. Do not extend local-government obligations to every privately owned plant.
Authority and research status
Florida Senate. Research classification: Selected enacted law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S09 Florida selected authority
Georgia applicability profile
The GTA reporting page identifies public-agency and utility reporting routes and references HB156. Obtain current statutory text and determine whether a federal report or public-entity status triggers the particular state duty.
Authority and research status
Georgia Technology Authority. Research classification: Agency reporting source. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S10 Georgia selected authority
Hawaii applicability profile
Use the PUC statute and order library to identify the regulated electric or gas entity. County water systems and transportation operators require their own agency and board-policy review. No uniform assessment interval was established by the selected directory.
Authority and research status
Hawaii PUC. Research classification: Regulator directory. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S11 Hawaii selected authority
Idaho applicability profile
The former S6010 URL is unavailable. Use the official indexed ITS Information Security Policy Manual version 4.0 as a research route. Full retrieval, operative adoption and actual agency scope remain to be verified. Private facilities require separate statutory, permit and contract review.
Authority and research status
Idaho Technology Authority. Research classification: Agency standard. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S12 Idaho ITS Information Security Policy Manual, version 4.0
Illinois applicability profile
HB3576 describes proposed water cybersecurity duties. Enactment and an applicable effective date were not established from the retrieved records. Keep it on the watchlist and require an enacted Public Act before treating its proposed deadlines as mandatory.
Authority and research status
Illinois General Assembly. Research classification: Bill status unresolved. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S13 Illinois selected authority
Indiana applicability profile
IC 13-18-16.5 covers specified SCADA/computerized water and wastewater facilities. IDEM identifies annual assessment by December 31 from 2026, certification every other year from December 31 2026, and annual August 31 reporter designation, plus faster operational-impact incident reporting. Confirm facility type and the 500-person drinking-water threshold.
Authority and research status
IDEM. Research classification: Agency implementation guidance. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S14 Indiana selected authority
Iowa applicability profile
The adopted Chapter 21 source addresses covered water, sanitary-sewage and storm-water utilities. Determine service and ownership coverage and current chapter text. A uniform OT cyber audit requirement was not established from this source.
Authority and research status
Iowa Utilities Commission. Research classification: Selected utility rule. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S15 Iowa selected authority
Kansas applicability profile
KSA 75-7244 concerns cyber-incident reporting by defined public entities and government contractors. Resolve the statutory definitions and current reporting instructions. Do not infer a universal private-utility assessment requirement.
Authority and research status
Kansas Legislature. Research classification: Selected enacted law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S16 Kansas selected authority
Kentucky applicability profile
Determine PSC jurisdiction, applicable 807 KAR service rules and incident instructions. Training material for water district commissioners does not establish a plant-wide annual cyber assessment obligation. Site orders and public-entity policies remain to be checked.
Authority and research status
Kentucky PSC. Research classification: Regulator routing source. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S17 Kentucky selected authority
Louisiana applicability profile
Obtain current utility, water, incident-reporting and public-agency instruments for the named facility. Search results centered on insurance-licensee cybersecurity law and were excluded as a basis for industrial obligations. Sector-specific state requirements remain unresolved.
Authority and research status
Louisiana Legislature. Research classification: Research gap. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S18 Louisiana selected authority
Maine applicability profile
Title 35-A section 710 governs utility accident investigation and reporting. Determine whether the physical consequence meets the trigger. Personal-data breach and public-agency incident duties require separate review.
Authority and research status
Maine Legislature. Research classification: Selected enacted law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S19 Maine selected authority
Maryland applicability profile
Chapter 495 establishes duties for community water and sewerage systems. Enhanced assessment scope uses more than 3,300 customers or a specified vulnerability determination. The first maturity assessment date was July 1 2026, then every two years. Separate agency certification-collection duties from operator filing instructions.
Authority and research status
Maryland General Assembly and MDE. Research classification: Enacted sector law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S20 Maryland selected authority, W06 Guidance on Senate Bill 871
Massachusetts applicability profile
MassDEP publishes cybersecurity assessment resources and sanitary-survey inspection notices. Obtain the current facility-specific request and controlling state authority before deciding mandatory scope or frequency. Older EPA survey policies are not sufficient evidence of a current federal duty.
Authority and research status
MassDEP. Research classification: Agency program with scope review. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S21 Massachusetts selected authority
Michigan applicability profile
MPSC incident instructions and electric technical standards provide distinct utility reporting and security-review paths. Confirm utility classification, the current R 460.3205 text and event thresholds. Do not substitute an insurance data-security statute.
Authority and research status
Michigan PSC. Research classification: Regulator implementation source. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S22 Michigan selected authority
Minnesota applicability profile
MDH indexed guidance expects annual cyber assessments for public water systems using OT. Full-page retrieval and the controlling legal basis were not resolved. Record this as an agency expectation pending confirmation. Public-agency incident reporting under 16E.36 is a separate check.
Authority and research status
Minnesota Department of Health. Research classification: Agency expectation needing confirmation. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S23 Minnesota selected authority
Mississippi applicability profile
ITS identifies state-agency incident-reporting requirements under the enterprise security program and state law. Determine whether a public operator is within that scope. Private-sector utility and plant duties require separate instruments.
Authority and research status
Mississippi ITS. Research classification: Agency reporting source. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S24 Mississippi selected authority
Missouri applicability profile
Section 640.142 requires a cyber-risk plan for certain community water systems, with express exemptions for systems without Internet-connected control and specified cities, counties and large PSC-regulated utilities. Resolve every exemption before declaring applicability.
Authority and research status
Missouri Legislature. Research classification: Selected enacted sector law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S25 Missouri selected authority
Montana applicability profile
State guidance identifies a reporting route for large local-government incidents on SummitNet. Connection and government status matter. This guidance does not establish a uniform deadline or assessment duty for every private industrial operator.
Authority and research status
Montana Department of Administration. Research classification: Agency guidance. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S26 Montana selected authority
Nebraska applicability profile
Determine whether NITC standards apply to the actual public entity or adopted board policy. Public-power ownership alone does not establish that every state-agency standard applies. Review utility, water and public-contract instruments separately.
Authority and research status
Nebraska Information Technology Commission. Research classification: Standards directory. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S27 Nebraska selected authority
Nevada applicability profile
NRS 480 addresses political-subdivision cybersecurity incident-response planning. The selected NAC 480 implementation material also identifies incident reporting. Obtain current codified sections and scope before fixing a clock. Utility safety and personal-data duties remain separate.
Authority and research status
Nevada Legislature. Research classification: Selected enacted law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S28 Nevada selected authority
New Hampshire applicability profile
RSA 485:3-e and 485-A:5-f establish water and wastewater cyber-program duties with Internet-connected-control exemptions. Read each enacted section separately and obtain implementing rules. Electric utility cyber plans require a separate current rule check.
Authority and research status
New Hampshire Legislature. Research classification: Enacted sector law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S29 New Hampshire selected authority, NH-WW Wastewater cybersecurity protection program
New Jersey applicability profile
For WQAA scope, use more than 500 service connections, not AWIA population. Annual controls assessment and certification, program maintenance and incident duties must be mapped to WQAA and any BPU order. The broader 2023 incident-reporting law needs its own scope review.
Authority and research status
New Jersey DEP and Legislature. Research classification: Enacted sector framework. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S30 New Jersey selected authority, W08 Water cybersecurity amendments
New Mexico applicability profile
The DoIT library identifies agency IT policy and incident standards. Obtain the current Cybersecurity Act, implementing rules and public-body definitions. Do not treat a passed bill version or an agency policy as a blanket rule for all private operators.
Authority and research status
New Mexico DoIT. Research classification: Policy directory and scope review. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S31 New Mexico selected authority
New York applicability profile
Separate DOH drinking-water requirements, DEC SPDES incident duties and POTW controls, and PSC utility IT rules. DEC identifies a 24-hour initial and 30-day second incident report for SPDES permittees. POTW controls and initial certification have distinct March 2027 dates.
Authority and research status
New York DEC and DOH. Research classification: Adopted sector rules. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S32 New York selected authority, W09 New York drinking water cybersecurity applicability
North Carolina applicability profile
State and local government cyber-incident reporting must be checked against current GS 143B-1379 and reporting instructions. A municipal operator can be covered because of government status. Private operators need separate sector or contract triggers.
Authority and research status
North Carolina DIT. Research classification: Agency implementation guidance. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
North Dakota applicability profile
Chapter 54-59.1 addresses cyber incident reporting and coordinated response. Resolve covered public entities and current instructions. Electric reliability planning and private-entity duties require separate utility instruments.
Authority and research status
North Dakota Legislature. Research classification: Selected enacted law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S34 North Dakota selected authority
Ohio applicability profile
OAC 3745-81-31 addresses public-water reporting, including facts affecting safe operations. Determine the relevant incident trigger. Ohio EPA cyber guidance and PUCO electric standards must be scoped separately; insurance-licensee rules are not industrial mandates.
Authority and research status
Ohio EPA. Research classification: Selected operational reporting rule. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S35 Ohio selected authority
Oklahoma applicability profile
OMES identifies statutory and regulatory IT reporting for state agencies. Resolve government status and the applicable standard. OCC utility rules, water permits and private-entity contractual duties remain facility-specific.
Authority and research status
Oklahoma OMES. Research classification: Agency reporting directory. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S36 Oklahoma selected authority
Oregon applicability profile
ORS 276A and state cyber security services define government IT responsibilities. Identify the covered body and contract. ODOT technical requirements can bind a specific transportation procurement without becoming a rule for every operator.
Authority and research status
Oregon Legislature. Research classification: Selected enacted law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S37 Oregon selected authority
Pennsylvania applicability profile
DEP provides water cybersecurity guidance. The 2025 PUC supplemental advance notice proposed changes including Chapter 104 incident reporting; a final operative rule was not established here. Do not apply proposed clocks as law. Retrieve current utility orders and any final adoption.
Authority and research status
Pennsylvania DEP and PUC. Research classification: Guidance and rulemaking watchlist. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S38 Pennsylvania selected authority
Rhode Island applicability profile
Section 39-2-26 addresses investor-owned electric and gas emergency-response planning. Determine whether cyber loss scenarios need integration into that plan and inspect current PUC standards. The selected source is not a general manufacturing cyber audit law.
Authority and research status
Rhode Island Legislature. Research classification: Selected utility law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S39 Rhode Island selected authority
South Carolina applicability profile
DES water cybersecurity materials provide practical guidance. Confirm any inspection or permit-specific requirements. Insurance-licensee cybersecurity duties were excluded as a basis for water, manufacturing or transportation obligations.
Authority and research status
South Carolina DES. Research classification: Agency guidance. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
South Dakota applicability profile
The selected law criminalizes interference with critical infrastructure. It does not itself establish a periodic operator cyber assessment. Obtain PUC, environmental, public-entity and contract instruments for affirmative duties.
Authority and research status
South Dakota Legislature. Research classification: Criminal statute only. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S41 South Dakota selected authority
Tennessee applicability profile
Chapter 1220-04-15 establishes utility cyber plans and reporting within TPUC jurisdiction. Current annual confidential filing dockets corroborate implementation. Confirm the latest codified chapter and utility coverage before assigning July 1 or incident deadlines.
Authority and research status
Tennessee Secretary of State. Research classification: Filed utility rule. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S42 Tennessee selected authority, TN-DOCKET Annual utility cybersecurity plan reports
Texas applicability profile
Utilities Code 39.1516 addresses electric cybersecurity coordination, monitoring and preparedness. Scope ERCOT, non-ERCOT, municipal and cooperative roles separately. PUCT EOP requirements and Texas public-entity incident reporting are additional checks.
Authority and research status
Texas Legislature. Research classification: Selected enacted utility law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S43 Texas selected authority
Utah applicability profile
DEQ provides a water and wastewater cyber-plan route. Determine whether individual items are guidance, permit conditions or adopted requirements. Utah government IT rules do not automatically govern every privately operated plant.
Authority and research status
Utah DEQ. Research classification: Agency guidance. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S44 Utah selected authority
Vermont applicability profile
A current sector-wide OT assessment mandate was not established. Retrieve current PUC electric and gas rules, water requirements and any public-entity cyber law for the facility. A bill passed by one chamber is not sufficient enactment evidence.
Authority and research status
Vermont Legislature. Research classification: Research gap. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S45 Vermont selected authority
Virginia applicability profile
Section 32.1-174.5 and 12 VAC 5-590-570 identify water contaminant-release and equipment-malfunction reporting. Determine physical and public-health consequences independently of personal-data breach analysis. State agency IT policies require a separate scope decision.
Authority and research status
Virginia Legislature. Research classification: Selected enacted operational law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S46 Virginia selected authority
Washington applicability profile
RCW 43.105.470 addresses major state-agency cyber incidents under agency policy. Resolve entity coverage. DOH water guidance, utility tariffs and local public-utility policies can create other assessment or reporting expectations.
Authority and research status
Washington Legislature. Research classification: Selected enacted agency law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S47 Washington selected authority
West Virginia applicability profile
The codified cybersecurity program section addresses agency risk assessments. The separate cyber incident reporting chapter 15-5C and current definitions must also be checked. A private operator is not covered solely because it operates critical infrastructure.
Authority and research status
West Virginia Legislature. Research classification: Selected enacted agency law. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S48 West Virginia selected authority
Wisconsin applicability profile
DNR provides water cybersecurity resources. Use the actual PWS and utility authority to determine obligations. A percentage risk-reduction statement on a guidance page was excluded because its supporting causal evidence was not evaluated.
Authority and research status
Wisconsin DNR. Research classification: Agency guidance. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S49 Wisconsin selected authority
Wyoming applicability profile
ETS security and risk-assessment standards require an agency-scope decision. PSC jurisdiction and current water or electric orders must be reviewed separately. Do not extend an agency standard to all private or municipal facilities.
Authority and research status
Wyoming ETS and PSC. Research classification: Standards directory. This is selected-source screening as of October 16, 2026. The cited source is not a substitute for all current instruments.
Water and wastewater
Establish PWSID/permit and system type, ownership, population, customers, service connections, computerized controls and the relevant regulator. Apply federal drinking-water and separate wastewater duties alongside the specific state finding above.
Power and energy
Establish registered functions, system categorization, utility jurisdiction, public-power/cooperative status and pipeline or nuclear boundaries. Obtain applicable state orders, security filings and incident instructions rather than extending one program to all energy systems.
Manufacturing and transportation
For manufacturing, resolve process safety, product, environmental, public-contract and incident duties. For transportation, resolve mode, owner, public-agency status, federal security instruments and local operating agreements. The selected state source alone does not establish every sector's obligations.
Required next record
Assign an owner to retrieve the current instrument, document site facts, identify each duty/exception and record a signed applicability decision. Keep an unresolved item open when the controlling text, enactment, facility fact or approval is missing. Use the workbook to record the source, decision date and next trigger.
Sources: S50 Wyoming selected authority
Local duty and contact worksheet
Complete for a named facility. Do not use this blank form as proof that local requirements have been reviewed.
Working record fields
- Facility address owner operator municipality county and other jurisdiction
- Complete this field in the controlled editable workbook or fillable PDF.
- Authority regulator emergency role and official source
- Complete this field in the controlled editable workbook or fillable PDF.
- Law permit policy contract version section and evidence ID
- Complete this field in the controlled editable workbook or fillable PDF.
- Duty applicability trigger deadline rule and exceptions
- Complete this field in the controlled editable workbook or fillable PDF.
- Verified recipient channel after hours route and authorized reporter
- Complete this field in the controlled editable workbook or fillable PDF.
- Compliance decision unresolved facts approval date and next review
- Complete this field in the controlled editable workbook or fillable PDF.
Incident notification decision worksheet
Record concurrent duties separately. Use the applicable definition and clock; do not wait for complete attribution before escalating a possible reporting duty.
Working record fields
- Event facts process consequence awareness time and timezone
- Complete this field in the controlled editable workbook or fillable PDF.
- Applicable instrument and exact triggering definition
- Complete this field in the controlled editable workbook or fillable PDF.
- Clock start deadline calculation calendar or business days and source
- Complete this field in the controlled editable workbook or fillable PDF.
- Recipient approved channel responsible official and alternate
- Complete this field in the controlled editable workbook or fillable PDF.
- Initial facts submission time receipt and required follow up
- Complete this field in the controlled editable workbook or fillable PDF.
- Open questions decision owner and escalation record
- Complete this field in the controlled editable workbook or fillable PDF.
Sources and instrument status
F01 Guide to Operational Technology Security Revision 3
NIST. Final guidance. September 2023 final publication; chapters 4 through 6 and OT control tailoring.
F03 Technical Guide to Information Security Testing and Assessment
NIST. Final guidance. Assessment planning and rules of engagement. Apply OT operating constraints; this IT testing guide does not authorize production testing.
F06 State Plans
OSHA. Jurisdiction directory. State and federal occupational safety jurisdiction. Check public employee coverage and industry exceptions for the actual workplace.
F07 Emergency Release Notifications under EPCRA
EPA. Agency guidance. EPCRA 304 and CERCLA release notification. Chemical thresholds, release facts and recipients require a separate EHS determination.
S01 Alabama selected authority
ADEM. Agency guidance. Selected state authority and applicability research as of October 16 2026.
Sources: F01 Guide to Operational Technology Security Revision 3, F03 Technical Guide to Information Security Testing and Assessment, F06 State Plans, F07 Emergency Release Notifications under EPCRA, S01 Alabama selected authority
Sources and instrument status
S02 Alaska selected authority
Alaska DEC. Agency guidance. Selected state authority and applicability research as of October 16 2026.
S03 Arizona selected authority
Arizona Legislature. Selected enacted law. Selected state authority and applicability research as of October 16 2026.
S04 Arkansas selected authority
Arkansas Division of Elementary and Secondary Education. Official implementation memo. Selected state authority and applicability research as of October 16 2026.
S05 California selected authority
California PUC. Regulator routing source. Selected state authority and applicability research as of October 16 2026.
S06 Colorado selected authority
Colorado Secretary of State and PUC. Selected rule text. Selected state authority and applicability research as of October 16 2026.
Sources: S02 Alaska selected authority, S03 Arizona selected authority, S04 Arkansas selected authority, S05 California selected authority, S06 Colorado selected authority
Sources and instrument status
S07 Connecticut selected authority
Connecticut DPH. Historical agency circular. Selected state authority and applicability research as of October 16 2026.
S08 Delaware selected authority
Delaware PSC. Regulator program. Selected state authority and applicability research as of October 16 2026.
S09 Florida selected authority
Florida Senate. Selected enacted law. Selected state authority and applicability research as of October 16 2026.
S10 Georgia selected authority
Georgia Technology Authority. Agency reporting source. Selected state authority and applicability research as of October 16 2026.
S11 Hawaii selected authority
Hawaii PUC. Regulator directory. Selected state authority and applicability research as of October 16 2026.
Sources: S07 Connecticut selected authority, S08 Delaware selected authority, S09 Florida selected authority, S10 Georgia selected authority, S11 Hawaii selected authority
Sources and instrument status
S12 Idaho ITS Information Security Policy Manual, version 4.0
Idaho Technology Authority. Official agency policy manual. Incident Response IR-06; establish actual agency and system scope. Replaces the unavailable S6010 link as the selected research route. Verify current operative adoption and entity scope. Does not bind every private facility.
S13 Illinois selected authority
Illinois General Assembly. Bill status unresolved. Selected state authority and applicability research as of October 16 2026.
S14 Indiana selected authority
IDEM. Agency implementation guidance. Selected state authority and applicability research as of October 16 2026.
S15 Iowa selected authority
Iowa Utilities Commission. Selected utility rule. Selected state authority and applicability research as of October 16 2026.
S16 Kansas selected authority
Kansas Legislature. Selected enacted law. Selected state authority and applicability research as of October 16 2026.
Sources: S12 Idaho ITS Information Security Policy Manual, version 4.0, S13 Illinois selected authority, S14 Indiana selected authority, S15 Iowa selected authority, S16 Kansas selected authority
Sources and instrument status
S17 Kentucky selected authority
Kentucky PSC. Regulator routing source. Selected state authority and applicability research as of October 16 2026.
S18 Louisiana selected authority
Louisiana Legislature. Research gap. Selected state authority and applicability research as of October 16 2026.
S19 Maine selected authority
Maine Legislature. Selected enacted law. Selected state authority and applicability research as of October 16 2026.
S20 Maryland selected authority
Maryland General Assembly and MDE. Enacted sector law. Selected state authority and applicability research as of October 16 2026.
W06 Guidance on Senate Bill 871
Maryland MDE. Agency guidance. April 2026 guidance; system assessments, certification and ERP work. Agency collection or legislative reporting dates must not be assigned to operators as unverified filing deadlines.
Sources: S17 Kentucky selected authority, S18 Louisiana selected authority, S19 Maine selected authority, S20 Maryland selected authority, W06 Guidance on Senate Bill 871
Sources and instrument status
S21 Massachusetts selected authority
MassDEP. Agency program with scope review. Selected state authority and applicability research as of October 16 2026.
S22 Michigan selected authority
Michigan PSC. Regulator implementation source. Selected state authority and applicability research as of October 16 2026.
S23 Minnesota selected authority
Minnesota Department of Health. Agency expectation needing confirmation. Selected state authority and applicability research as of October 16 2026.
S24 Mississippi selected authority
Mississippi ITS. Agency reporting source. Selected state authority and applicability research as of October 16 2026.
S25 Missouri selected authority
Missouri Legislature. Selected enacted sector law. Selected state authority and applicability research as of October 16 2026.
Sources: S21 Massachusetts selected authority, S22 Michigan selected authority, S23 Minnesota selected authority, S24 Mississippi selected authority, S25 Missouri selected authority
Sources and instrument status
S26 Montana selected authority
Montana Department of Administration. Agency guidance. Selected state authority and applicability research as of October 16 2026.
S27 Nebraska selected authority
Nebraska Information Technology Commission. Standards directory. Selected state authority and applicability research as of October 16 2026.
S28 Nevada selected authority
Nevada Legislature. Selected enacted law. Selected state authority and applicability research as of October 16 2026.
S29 New Hampshire selected authority
New Hampshire Legislature. Enacted sector law. Selected state authority and applicability research as of October 16 2026.
NH-WW Wastewater cybersecurity protection program
New Hampshire Legislature. Enacted sector law. RSA 485-A:5-f; current codified text.
Sources: S26 Montana selected authority, S27 Nebraska selected authority, S28 Nevada selected authority, S29 New Hampshire selected authority, NH-WW Wastewater cybersecurity protection program
Sources and instrument status
S30 New Jersey selected authority
New Jersey DEP and Legislature. Enacted sector framework. Selected state authority and applicability research as of October 16 2026.
W08 Water cybersecurity amendments
New Jersey Legislature. Enacted chapter law. P L 2021 chapter 262 and N J S A 58:31-4.1.
S31 New Mexico selected authority
New Mexico DoIT. Policy directory and scope review. Selected state authority and applicability research as of October 16 2026.
S32 New York selected authority
New York DEC and DOH. Adopted sector rules. Selected state authority and applicability research as of October 16 2026.
W09 New York drinking water cybersecurity applicability
New York DOH. Current rule page. 10 NYCRR Appendix 5-E.1; Subpart 5-1.33. Full-page retrieval was restricted. The January 1 2027 transition and immediate training/reporting exceptions are supported by official indexed text; obtain the full rule before facility signoff.
Sources: S30 New Jersey selected authority, W08 Water cybersecurity amendments, S31 New Mexico selected authority, S32 New York selected authority, W09 New York drinking water cybersecurity applicability
Sources and instrument status
S33 North Carolina selected authority
North Carolina DIT. Agency implementation guidance. Selected state authority and applicability research as of October 16 2026.
S34 North Dakota selected authority
North Dakota Legislature. Selected enacted law. Selected state authority and applicability research as of October 16 2026.
S35 Ohio selected authority
Ohio EPA. Selected operational reporting rule. Selected state authority and applicability research as of October 16 2026.
S36 Oklahoma selected authority
Oklahoma OMES. Agency reporting directory. Selected state authority and applicability research as of October 16 2026.
S37 Oregon selected authority
Oregon Legislature. Selected enacted law. Selected state authority and applicability research as of October 16 2026.
Sources: S33 North Carolina selected authority, S34 North Dakota selected authority, S35 Ohio selected authority, S36 Oklahoma selected authority, S37 Oregon selected authority
Sources and instrument status
S38 Pennsylvania selected authority
Pennsylvania DEP and PUC. Guidance and rulemaking watchlist. Selected state authority and applicability research as of October 16 2026.
S39 Rhode Island selected authority
Rhode Island Legislature. Selected utility law. Selected state authority and applicability research as of October 16 2026.
S40 South Carolina selected authority
South Carolina DES. Agency guidance. Selected state authority and applicability research as of October 16 2026.
S41 South Dakota selected authority
South Dakota Legislature. Criminal statute only. Selected state authority and applicability research as of October 16 2026.
S42 Tennessee selected authority
Tennessee Secretary of State. Filed utility rule. Selected state authority and applicability research as of October 16 2026.
Sources: S38 Pennsylvania selected authority, S39 Rhode Island selected authority, S40 South Carolina selected authority, S41 South Dakota selected authority, S42 Tennessee selected authority
Sources and instrument status
TN-DOCKET Annual utility cybersecurity plan reports
Tennessee PUC. Implementation docket. 2025 annual utility filing docket under TCA 65-4-127. Individual reports are confidential and were not obtained.
S43 Texas selected authority
Texas Legislature. Selected enacted utility law. Selected state authority and applicability research as of October 16 2026.
S44 Utah selected authority
Utah DEQ. Agency guidance. Selected state authority and applicability research as of October 16 2026.
S45 Vermont selected authority
Vermont Legislature. Research gap. Selected state authority and applicability research as of October 16 2026.
S46 Virginia selected authority
Virginia Legislature. Selected enacted operational law. Selected state authority and applicability research as of October 16 2026.
Sources: TN-DOCKET Annual utility cybersecurity plan reports, S43 Texas selected authority, S44 Utah selected authority, S45 Vermont selected authority, S46 Virginia selected authority
Sources and instrument status
S47 Washington selected authority
Washington Legislature. Selected enacted agency law. Selected state authority and applicability research as of October 16 2026.
S48 West Virginia selected authority
West Virginia Legislature. Selected enacted agency law. Selected state authority and applicability research as of October 16 2026.
S49 Wisconsin selected authority
Wisconsin DNR. Agency guidance. Selected state authority and applicability research as of October 16 2026.
S50 Wyoming selected authority
Wyoming ETS and PSC. Standards directory. Selected state authority and applicability research as of October 16 2026.
Sources: S47 Washington selected authority, S48 West Virginia selected authority, S49 Wisconsin selected authority, S50 Wyoming selected authority