Indiana Enhances Water and Wastewater Cybersecurity in Response to Growing Threats

Strategic Insights -

The state of Indiana has ramped up its cybersecurity efforts for water and wastewater facilities after a series of cyber attacks targeting a drinking water utility in New Castle and a wastewater utility in Tipton. In July, the Indiana Senate passed Bill 459 (SB459), mandating vulnerability assessments and other cybersecurity measures for certain water and wastewater facilities. This legislation establishes a process for incident reporting, requiring facilities to notify the Indiana Office of Technology (IOT) and the Indiana Department of Environmental Management (IDEM) in the case of a cyber incident. The collaboration between IDEM and IOT aims to improve water and wastewater cybersecurity across the state.

Key Takeaways:

  • The Indiana Department of Environmental Management (IDEM) has partnered with the Indiana Office of Technology (IOT) to enhance water and wastewater cybersecurity in response to recent cyber attacks.
  • The partnership aims to implement Indiana Senate Bill 459 (SB459), which passed in July, mandating cybersecurity vulnerability assessments and other measures for certain water and wastewater facilities.
  • SB459 establishes a process for incident reporting, requiring facilities to notify IOT and IDEM in the case of a cyber incident, with various notification timelines depending on the type of breach or impact to systems.
  • Facilities must designate primary cybersecurity contacts and adhere to a compliance timeline for SB459.
  • IDEM has made available on its website a Risk Assessment Guidance, Risk Assessment Tools, fact sheets on Cyber Smart Guidance, and Top Cyber Actions for Securing Water Systems.
  • IDEM is seeking to enhance education and outreach efforts on cybersecurity initiatives by developing informational videos and graphics.

Statistics:

  • 2 drinking water utilities and 1 wastewater utility in Indiana have been targeted by cyber attacks in recent years.
  • SB459 establishes a compliance timeline of 180 days for vulnerability assessments and cybersecurity measures.
  • The Indiana Office of Technology (IOT) and the Indiana Department of Environmental Management (IDEM) coordinate with other state agencies for on-the-ground response to cyber incidents.
  • The Risk Assessment Guidance and Tools are available on the IDEM website, providing information on required entities, compliance timelines, and procedures.

Sources:

  • Environmental Council of the States press release
  • Indiana Senate Bill 459 (SB459)
  • Indiana Department of Environmental Management (IDEM) website
  • Indiana Office of Technology (IOT) website