Committee approves amendment to require local governments to adopt cyber liability best practices; AG-funded grant removed

The Ways and Means Committee on Oct. 27 approved an amended version of Senate Bill 472 that would require local governments to implement uniform best practices for cyber liability and removed a proposal to create an Attorney General–funded grant program to help pay cyber claim costs.

The bill’s sponsor, Representative Layman, told the committee that SB 472 “is a product of an issue we've currently been dealing with on the AI task scribe, cybersecurity.” He said the bill converts an earlier “may” provision in state law to a “shall,” adding: “They shall implement best practices around their cyber liability.”

The change to a mandatory requirement is the bill’s first part, Layman said, and is intended to ensure local governments that handle state-shared data “are stepping up and having the type of systems they should have.” The bill originally included a second part to create a fund — financed by fines and other Attorney General receipts — to assist municipalities and schools with cyber liability expenses. Representative Layman said that portion of the bill would be deleted by amendment.

Representative Jordan, who explained the amendment on the floor, said the proposed language removed the unfunded grant program and took out “the language that it would be funded through AG action.” Jordan added that the amendment “takes out the second half of the bill.”

Representative Schlager asked why the Indianapolis Department of Public Utilities was exempted from the bill’s coverage. Representative Layman responded that certain quasi-governmental entities “are, through an agreement with the city, already providing that data and that information so they were taken out of this bill,” and that he would confirm specific contractual relationships as needed.

Committee members adopted the amendment by consent and then voted to pass the bill as amended. The committee reported the bill out of committee with a unanimous vocal tally recorded in committee as 19 to 0 in favor.

The amended bill now requires local governments to adopt uniform cyber liability best practices and no longer includes the Attorney General–funded grant or trust described in earlier drafts. Committee discussion noted the deleted funding provision was not included in the state budget and reflected concern about creating incentives for agencies to generate funds through litigation.

The committee did not specify implementation details, such as timelines for compliance, certification or reporting requirements, or enforcement mechanisms; those items were discussed conceptually but not specified in committee testimony.

Committee action: The bill was passed as amended and will move forward in the legislative process; the committee amendment removed the fund-creation and AG-funded language.