(a) Each borrower shall periodically analyze and document its security, operations and maintenance policies, practices, and procedures to determine if they are appropriate and if they are being followed. The records of inspections and tests are also to be reviewed and analyzed to identify any trends which could indicate deterioration in the physical or cyber condition or the operational effectiveness of the system or suggest a need for changes in security, operations or maintenance policies, practices and procedures. For portions of the borrower's system that are not operated by the borrower, if any, the borrower's written analysis would also include a review of the operator's performance under the operating agreement.

(b) When a borrower's security, operations and maintenance policies, practices, and procedures are to be reviewed and evaluated by RUS, the borrower shall:

(1) Conduct the analysis required by paragraph (a) of this section not more than 90 days prior to the scheduled RUS review;

(2) Complete RUS Form 300, Review Rating Summary, and other related forms, prior to RUS' review and evaluation; and

(3) Make available to RUS the borrower's completed RUS Form 300 (including a written explanation of the basis for each rating) and records related to the operations and maintenance of the borrower's system.

(c) For those facilities not included on the RUS Form 300 (e.g., generating plants), the borrower shall prepare and complete an appropriate supplemental form for such facilities.

[63 FR 3450, Jan. 23, 1998, as amended at 69 FR 60541, Oct. 12, 2004]