Runs an essential service, in Indiana

Ind. Code sec. 13-18-16.5-1(a), (b)(1) to (b)(3) and (c) · Read the law's page

• This binds a community water system with a population of 500 or more, a publicly owned treatment works, or a semipublic facility classified Class III or Class IV, that uses a computerized system to monitor and control its processes from a central location or another vulnerable monitoring or management system identified by the department (reached by declaring that you operate an essential service).
• Conduct a cybersecurity vulnerability assessment at least once per calendar year, using an assessment tool or framework approved by the department and the Office of Technology.
• Before September 1 each year, give the Office of Technology the name and contact information of the individual who will act as primary reporter of a cybersecurity incident.
• Beginning in 2026, not later than December 31 of each even-numbered year, submit a certification to the department through a secured portal that you completed the assessment, mitigated or have documented plans to mitigate the vulnerabilities found, and updated your emergency response plans.

Ind. Code sec. 13-18-16.5-1(b)(4) · Read the law's page

• This binds a community water system with a population of 500 or more, a publicly owned treatment works, or a semipublic facility classified Class III or Class IV, that uses a computerized system to monitor and control its processes from a central location or another vulnerable monitoring or management system identified by the department (reached by declaring that you operate an essential service).
• When an actual or reasonably suspected cybersecurity breach occurs, report the cybersecurity incident to the Office of Technology not later than 24 hours after discovery if it impacts the operations of the entity, or not later than two business days after discovery if it does not, in a format prescribed by the chief information officer of the Office of Technology.