Law / United States / 
Indiana
State agency and political subdivision cybersecurity incident reporting to the Office of Technology
In force.
A vulnerability and incident reporting rule binding government bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a state agency other than a state educational institution, and a political subdivision other than a department of public utilities established under IC 8-1-11.1. It does not apply to an entity subject to IC 13-18-16.5, which carries its own reporting duty.
- Report any cybersecurity incident to the Office of Technology, using your best professional judgment, without unreasonable delay and not later than two business days after discovery, in a format prescribed by the chief information officer.
- Give the Office of Technology the name and contact information of the individual who will act as primary reporter of a cybersecurity incident before September 1 of each year.
- Nothing in the section requires reporting that conflicts with federal privacy laws or is prohibited due to an ongoing law enforcement investigation.
These lines are LexLint's reading of the law's text, as of .
What this law does
A state agency other than a state educational institution, and a political subdivision, must report any cybersecurity incident to the Office of Technology without unreasonable delay and not later than two business days after discovery. The reporting duty excludes a department of public utilities established under section 8-1-11.1 of the Indiana Code and an entity subject to the water and wastewater cybersecurity chapter.
Each such entity must give the Office of Technology the name and contact information of its primary reporter of a cybersecurity incident before September 1 of each year. Nothing in the section requires reporting that conflicts with federal privacy laws or is prohibited due to an ongoing law enforcement investigation.