Committee hears cybersecurity bill to set statewide standards and create grant fund; consumer-data amendment deferred

Senate Bill 472, authored by Senator Brown, drew extended testimony and discussion as sponsors sought to require local units of government and schools to adopt cybersecurity guidelines created by the Indiana Office of Technology (IOT), create a grant fund and an optional statewide insurance pool, and provide technical assistance. The committee discussed two posted amendments: amendment number 7 (a refinement to a liability/grant fund) was adopted by consent; amendment number 6 (a consumer-data-related change) was discussed and not added to the bill at this time.

Sponsor Senator Brown said the bill updates an earlier AI/cybersecurity task force effort and responds to school and local-government concerns about cyber insurance costs and best practices: "The idea as I said literally the entire bill started with schools having concerns about their insurance fund and how they're gonna pay for it and then we expanded into best practices," Brown said. She told the committee the bill pushes the timeline to 2027 so local units have time to implement guidelines and that the grant fund is structured as a program but currently has no money.

Amendment 7: Liability/grant fund Senator Brown described amendment number 7 as tightening the language that creates a fund to help schools with liability insurance and clarified that the amendment creates a program but does not appropriate money. The amendment was adopted by unanimous consent.

Amendment 6: Consumer data privacy and opt-out A posted amendment (number 6) that would have affected consumer data collection for rewards programs and opt-out options was discussed at length. The sponsor and LSA staff said it was drafted after constituent concerns, but Senator Brown and Representative Lehman said the amendment raised issues they preferred to address through the ongoing task force rather than in this bill. The committee did not take a vote on amendment 6, and senators said they would revisit related language before second reading.

What the bill would require and what it would not Senator Brown and sponsor Representative Lehman said local units and schools would be required to adopt a list of cybersecurity guidelines and standards created by IOT, but the bill would not require every unit to fund or complete an assessment; if a unit conducts an assessment voluntarily, the results would be shared with the state to help identify gaps. Brown said, "We're not requiring assessments because again that costs money, and, but what we are saying some communities may already be doing this, the local unit of government, if they're doing an assessment, we want them to share the results with us." The revised fund is intended to be a grant program to help offset costs if money ever becomes available. Brown added that money for the fund likely would only materialize from fines or other penalties collected from bad actors; currently no appropriation exists.

Testimony from stakeholders Jeremy Miller, representing the Indiana Technology and Innovation Association and CEO of Lionfish Cybersecurity, urged passage and highlighted resource gaps: "The majority of the 92 counties lack resources, both financially and human, to adequately protect their networks and data," Miller said. He described workforce shortages and proposed a training initiative to help implement the bill’s resilience goals.

Amy Krieg, testifying for AIM (representing cities and towns), said the bill "provides a level of protection" and gives local governments more tools, including access to a grant program and a board with local government representation, and expressed support.

Bridget O’Connor, director of government affairs and regulatory policy for Citizens Energy Group (a municipal utility for Indianapolis), said Citizens already maintains a robust cybersecurity program and raised concerns about requiring submission of detailed cyber plans to a central repository. O’Connor asked the committee to allow an informational meeting in lieu of plan submission, citing a concern that storing full plans centrally could create a single point of vulnerability.

Clarifications on insurance and costs Committee members asked for practical clarifications about cyber insurance. Senator Brown described cyber insurance as covering recovery costs when systems are disrupted or data must be reconstructed, and said premiums are rising. She reiterated that participation in the grant or insurance pool would be voluntary and that the fund is currently unfunded.

Committee action and next steps The committee consented to amendment number 7 and did not adopt amendment number 6; there was no final vote on Senate Bill 472 during this meeting. Senator Brown said she expected to bring a technical amendment addressing excluded entities (to avoid requiring submission from entities already protected) by second reading and asked permission to have Representative Lehman carry that tweak if scheduling conflicts arise. The bill’s timeline for compliance was adjusted in the draft to 2027 to allow local units time to implement guidance.

Ending The committee concluded with no final vote on the bill; sponsors and witnesses said they expect further drafting to address plan-submission language and excluded entities before the bill’s next consideration.