Security Management for Critical Upstream Petroleum and Coal Infrastructure Regulation (Alta Reg. 91/2013)

Section 2 PETROLEUM AND COAL INFRASTRUCTURE REGULATION AR 91/2013 (g) “pipeline” means a pipeline as defined in the Pipeline Act; (h) “Plan” means the Alberta Counter Terrorism Crisis Management Plan established under the Emergency Management Act; (i) “processing plant” means (i) a processing plant as defined in the Oil and Gas Conservation Act, and (ii) a processing plant as defined in the Oil Sands Conservation Act; (j) “Regulator” means the Alberta Energy Regulator; (k) “security measures” means threat response plans relating to a threat of terrorist activity or terrorist activity against a critical facility in accordance with the Plan; (l) “well” means a well as defined in the Oil and Gas Conservation Act. Security measures to be established for a critical facility 2(1) A licensee or approval holder of a critical facility must establish security measures relating to the critical facility in accordance with the recommended practices outlined in the Plan to enable the licensee or approval holder to respond to the various levels of threat of terrorist activity that may be declared under the Plan. (2) If the Department of Justice and Solicitor General informs a licensee or approval holder of a critical facility that the facility has been threatened and the level of the threat, the licensee or approval holder must implement security measures in accordance with the recommended practices outlined in the Plan related to the level of threat that has been declared. (3) If the Regulator is of the view that the licensee or approval holder of a critical facility has failed to implement security measures in accordance with subsection (2), the Regulator may (a) order the licensee or approval holder to implement security measures in accordance with the recommended practices outlined in the Plan related to the level of threat that has been declared, or (b) whether or not the Regulator has made an order under clause (a), take action to implement security measures in accordance with the recommended practices outlined in 2 SECURITY MANAGEMENT FOR CRITICAL UPSTREAM

Section 3 PETROLEUM AND COAL INFRASTRUCTURE REGULATION AR 91/2013 the Plan related to the level of threat that has been declared and recover the costs incurred in doing so from the licensee or approval holder as a debt owed to the Regulator. (4) The Regulator may audit the security measures of a licensee or approval holder in respect of a critical facility and the capacity of the licensee or approval holder to implement those security measures. (5) Any information filed with the Regulator in relation to the security measures of a critical facility is confidential and may not be accessed except as permitted by the Regulator. Corporate emergency response plan required 3(1) A licensee or approval holder of a critical facility to which Directive 071 does not apply, must (a) at a minimum, prepare a corporate emergency response plan for the critical facility in accordance with Directive 071, (b) update the corporate emergency response plan as required by Directive 071, and (c) implement the corporate emergency response plan in the event of an emergency. (2) The Regulator may, in accordance with Directive 071, audit the corporate emergency response plan of a licensee or approval holder of a critical facility referred to in subsection (1) and the licensee’s or approval holder’s capacity to implement the plan. Threat of terrorist activity 4(1) Where the Regulator has been informed of the existence of a threat of terrorist activity against a coal processing plant, an in situ operation, a mine, a mining operation, a pipeline, a processing plant, a well or a related facility of any of them the Regulator must (a) inform the licensee or approval holder of the threat of terrorist activity and the level of threat, and (b) request the licensee or approval holder to provide information about the manner in which the licensee or approval holder will address the threat. (2) Where the threat of terrorist activity is high or imminent against a coal processing plant, an in situ operation, a mine, a mining operation, a pipeline, a processing plant, a well or a related 3 SECURITY MANAGEMENT FOR CRITICAL UPSTREAM

Section 5 PETROLEUM AND COAL INFRASTRUCTURE REGULATION AR 91/2013 facility of any of them and after consultation with the licensee or approval holder the Regulator is of the view that the licensee or approval holder is unwilling or unable to take measures to address the threat, the Regulator may (a) order the licensee or approval holder to shut down the coal processing plant, in situ operation, mine, mining operation, pipeline, processing plant or related facility or shut in the well and set out the terms under which the order may cease to have effect, or (b) whether or not the Regulator has made an order under clause (a), take action to shut down the coal processing plant, in situ operation, mine, mining operation, pipeline, processing plant or related facility or shut in the well and recover the costs incurred in doing so from the licensee or approval holder as a debt owed to the Regulator. (3) Any information filed with the Regulator in response to a request under subsection (1)(b) is confidential and may not be accessed except as permitted by the Regulator. Expiry 5 For the purpose of ensuring that this Regulation is reviewed for ongoing relevancy and necessity, with the option that it may be repassed in its present form following a review, this regulation expires on May 31, 2022. AR 91/2013 s5;249/2018 Coming into force 6 This Regulation comes into force on the coming into force of section 80 of the Responsible Energy Development Act. 4 *9780779808250* Printed on Recycled Paper