; and (B) shall include at least one of any of— (i) an investor-owned electric utility; (ii) a publicly owned utility; (iii) a technology provider; (iv) a rural electric cooperative; (v) a regional transmission organization; or (vi) an independent system operator. (c) Cybersecurity plan Each eligible project carried out pursuant to subsection (a) shall include the development of a cybersecurity plan written in accordance with guidelines developed by the Secretary. (d) Privacy risk analysis Each eligible project carried out pursuant to subsection (a) shall include a privacy impact assessment that evaluates the project against the 5 core concepts in the Voluntary Code of Conduct of the Department of Energy, commonly known as the DataGuard Energy Data Privacy Program , or the most recent revisions to the privacy program of the Department.