Law / United States / 
Indiana
Public water and wastewater cybersecurity: annual vulnerability assessment and certification
Ind. Code sec. 13-18-16.5-1(a), (b)(1) to (b)(3) and (c)
In force.
A sector security regimes rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a community water system with a population of 500 or more, a publicly owned treatment works, or a semipublic facility classified Class III or Class IV, that uses a computerized system to monitor and control its processes from a central location or another vulnerable monitoring or management system identified by the department (reached by declaring that you operate an essential service).
- Conduct a cybersecurity vulnerability assessment at least once per calendar year, using an assessment tool or framework approved by the department and the Office of Technology.
- Before September 1 each year, give the Office of Technology the name and contact information of the individual who will act as primary reporter of a cybersecurity incident.
- Beginning in 2026, not later than December 31 of each even-numbered year, submit a certification to the department through a secured portal that you completed the assessment, mitigated or have documented plans to mitigate the vulnerabilities found, and updated your emergency response plans.
These lines are LexLint's reading of the law's text, as of .
What this law does
The chapter applies to a community water system with a population of five hundred or more, a publicly owned treatment works, or a Class III or Class IV semipublic facility that uses a computerized system to monitor and control its processes from a central location. An entity must conduct a cybersecurity vulnerability assessment at least once per calendar year.
Beginning in 2026, not later than December 31 of each even-numbered year, an entity must submit a certification to the department via a secured portal. Before September 1 of each year, an entity must give the Office of Technology the name and contact information of its primary reporter of a cybersecurity incident. An assessment must use an assessment tool or framework approved by the department and the Office of Technology.
When LexLint raises it
When your app profile says your app runs an essential service.