Law / United States / 
Indiana
Public water and wastewater cybersecurity: incident reporting to the Office of Technology
Ind. Code sec. 13-18-16.5-1(b)(4)
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a community water system with a population of 500 or more, a publicly owned treatment works, or a semipublic facility classified Class III or Class IV, that uses a computerized system to monitor and control its processes from a central location or another vulnerable monitoring or management system identified by the department (reached by declaring that you operate an essential service).
- When an actual or reasonably suspected cybersecurity breach occurs, report the cybersecurity incident to the Office of Technology not later than 24 hours after discovery if it impacts the operations of the entity, or not later than two business days after discovery if it does not, in a format prescribed by the chief information officer of the Office of Technology.
These lines are LexLint's reading of the law's text, as of .
What this law does
The chapter applies to a community water system with a population of five hundred or more, a publicly owned treatment works, or a Class III or Class IV semipublic facility that uses a computerized system to monitor and control its processes from a central location. When an actual or reasonably suspected cybersecurity breach occurs, an entity must report the incident to the Office of Technology not later than twenty-four hours after discovery if the incident impacts the operations of the entity.
If the incident does not impact the operations of the entity, the report is due not later than two business days after discovery.
When LexLint raises it
When your app profile says your app runs an essential service.