By Clint Woods This summer, water utilities across the country reported malicious cyber activity targeting their operational systems. The intrusions prompted federal action warning water and wastewater operators of malicious cyber actors and urging immediate mitigations. Fortunately, in Indiana, none of our utility providers experienced operational disruptions or degraded service. However, this emerging cybersecurity threat has been on the radar of the Indiana Department of Environmental Management (IDEM) for several years. During that time, we have watched cybersecurity shift from being considered an “IT problem” to a core operational concern, especially in the water sector. To help address these risks proactively, IDEM partnered with the Indiana Office of Technology (IOT) over the last several years to raise awareness among legislators and stakeholders and to support legislation that promotes uniform cybersecurity practices for Hoosier utilities. In July 2025, Senate Enrolled Act 459 became law. The legislation requires Indiana water and wastewater facilities to conduct baseline cybersecurity vulnerability assessments, follow incident reporting protocols, and complete biennial certifications. As an agency tasked with overseeing environmental regulatory operations, we know these actions will provide stronger public health safeguards for Hoosiers and help utilities strengthen their overall cyber hygiene. The Problem: Automation Creates New Vulnerabilities Indiana’s water and wastewater systems are critical infrastructure that support public health, safety, and the economy. As these systems rely more on digital control tools, including the systems that automate treatment and monitoring, they also become more vulnerable to cyber threats. A single breach can disrupt service, damage equipment, or interfere with chemical treatment processes, creating risks for communities statewide. The Solution: Indiana’s Senate Enrolled Act 459 Indiana’s law is among the first in the nation to establish statewide cybersecurity requirements for water and wastewater utilities. Here’s what the law mandates: - Annual Cyber Vulnerability Assessments Facilities must conduct a