Lawmakers push cybersecurity requirements for schools & local governments

By GARRETT BERGQUIST
WISH-TV | wishtv.com

Cybersecurity is a state and national security issue, cybersecurity professionals and local government representatives alike told a House panel Monday.

The Indiana Office of Technology already researches and publishes cybersecurity best practices, but there is no requirement to follow them. That could change under legislation working its way through the General Assembly.

Beginning in 2027, every unit of local government in the state, along with all school corporations and public universities, would have to follow cybersecurity rules and policies developed by the agency. They also would need to carry cybersecurity insurance.

Bill author Sen. Liz Brown, R-Fort Wayne, said the bill originated out of conversations surrounding school cybersecurity but was later expanded to local government units.

“They are connected to the state, they have critical infrastructure, they have a lot of data on individuals, as do schools,” Brown said.

Jeremy Miller, CEO of the Indianapolis-based cybersecurity firm Lionfish Cyber Security, said critical municipal-level systems such as water, sewer, and gas systems are vulnerable to cyberattack. He said the vast majority of Indiana’s counties lack the resources to adequately protect their systems and the bill provides critical guidelines for local governments to follow.

Amy Krieg, of Accelerate Indiana Municipalities, which represents municipal governments, said the bill provides a healthy level of accountability for local governments.

The bill has already passed the Senate with near-unanimous support. The House Committee on Government and Regulatory Reform did not vote on the bill Monday morning due to concerns over a provision requiring individual units of government to share their cybersecurity plans with the state, something cybersecurity experts pointed out might make them vulnerable in the event of an external hack. Brown and House bill sponsor Rep. Matt Lehman, R-Berne, said they would work on language to either tighten or remove that provision.

This story was originally published by WISH-TV at wishtv.com/news/politics/indiana-local-government-cybersecurity.