House panel OKs cybersecurity reporting, assessments for water and wastewater systems

The House Environmental Affairs Committee voted unanimously to pass Senate Bill 459, requiring water and wastewater utilities to report cyber incidents to the Indiana Department of Environmental Management and the state's Office of Technology and to conduct annual vulnerability assessments, during a committee meeting.

The measure, introduced to address incidents such as a summer hack of networks serving Tipton, Indiana, directs the Environmental Rules Board to adopt standards for reclaimed wastewater and establishes a two-tiered incident reporting schedule and a requirement for annual vulnerability assessments. The committee adopted an amendment that explicitly adds wastewater systems to the bill’s scope and adjusts reporting language to align with another pending cybersecurity bill.

Jake Tory, legislative director for the Indiana Department of Environmental Management, told the committee that IDEM had not learned of the Tipton intrusion until “a great deal of time later,” and said the bill aims both to equip utilities to respond and to ensure timely notification to state authorities. “Thankfully it was during regular business hours and a technician was there and saw something on the controls kind of going haywire and was able to switch it over to manual operations, thankfully preventing higher levels of chemicals than normal from going into the water,” Tory said.

Under the bill as described in committee testimony, utilities must notify IDEM and the Office of Technology: within 24 hours when an incident affects operations, and within two business days when it does not. The bill also requires an annual vulnerability assessment for covered systems. Chairman Niemeyer and staff said an amendment was adopted to align the bill’s timing language with a related cybersecurity bill and to avoid duplicative reporting requirements.

Representative Kyle Pierce asked why the bill used different reporting windows for incidents that affect operations and those that do not; Tory said the two-tiered approach follows recommended best practices and mirrors language in a separate, broader cybersecurity bill. Representative Carolyn Jackson asked whether the bill includes community notification immediately after an incident; Tory said he could not address that immediately but would look into it and report back.

Rick Cochran, a volunteer board member of the Indiana Wildlife Federation, supported the bill’s goal of protecting waterways, telling the committee that a wastewater compromise “could be catastrophic” for fish and wildlife and that monitoring steps are warranted.

The committee approved the bill as amended on a voice/roll call vote. The clerk recorded 13 yeas and 0 nays. The bill, as passed by the committee, adds wastewater to the covered systems, requires reporting to IDEM and the Office of Technology on the timelines described in testimony, and requires annual vulnerability assessments; it also includes language intended to eliminate duplicative reporting obligations across state requirements.

The bill now moves to the full House for further consideration.