(a) By July 1, 2023, or within one (1) year after a utility is formed, whichever is later, a utility shall prepare and implement a cyber security plan to provide for the protection of the utility's facilities from unauthorized use, alteration, ransom, or destruction of electronic data.
(b) A utility shall assess and update the cyber security plan implemented pursuant to this section every two (2) years to address new threats.