Committee unanimously backs bill requiring water‑system cyber reporting and annual vulnerability assessments

The Senate Environmental Committee unanimously approved Senate Bill 459 after accepting an amendment that lengthened state reporting windows for cybersecurity incidents affecting water and wastewater utilities.

IDEM representatives told the committee the bill responds to a rising number of cybersecurity threats to supervisory control and data acquisition (SCADA) systems. Drake Abramson, IDEM’s legislative director, described an incident notified to the U.S. Environmental Protection Agency earlier in the year in which a SCADA system at a wastewater plant appeared to be accessed by a hacking group; operators put the system into manual mode and avoided a significant impact.

The committee accepted an amendment that replaced a two‑hour reporting window with 24‑hour and 72‑hour reporting tiers, giving utilities more time to triage and notify state officials. The bill also creates a statutory requirement for annual vulnerability assessments of water and wastewater systems, with the first assessments and certifications due to the department by Dec. 1, 2026, and requires updated emergency plans addressing identified vulnerabilities.

Bill Blomquist, water policy coordinator for the White River Alliance, testified in support, saying that both the cybersecurity and water reuse provisions merited attention. He told the committee that water reuse and conservation are among the least‑cost sources of additional water supply and that a regulatory framework encourages utilities and potential users to adopt reuse practices. Blomquist also supported the bill’s cybersecurity tightening and said existing federal rules do not cover many smaller systems in Indiana.

IDEM staff asked the committee to approve the amendment and said the state requirement would bolster state and federal coordination during incidents. Matt Prater, IDEM’s drinking water branch chief, was present to answer technical questions.

The committee approved the amended bill on a recorded vote of 9‑0. Several senators praised the agency for acting on a pressing risk to critical infrastructure and public health during committee debate.

Ending: With committee approval, the bill will move forward with the amended reporting timelines and the statutory requirement for annual vulnerability assessments and certification; IDEM and stakeholders indicated they will continue technical work on thresholds and implementation details.