Indiana § 4-13.1-2-9 State agency reporting requirements

Indiana Statutes

§ 4-13.1-2-9 — State agency reporting requirements

Indiana § 4-13.1-2-9

Art. 13.1OFFICE OF TECHNOLOGY

This text of Indiana § 4-13.1-2-9 (State agency reporting requirements) is published on Counsel Stack Legal Research, covering Indiana primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

Ind. Code § 4-13.1-2-9 (2026).

Text

(a)This section does not apply to an entity subject to IC 13-18-16.5.

(b)A state agency (as defined in IC 4-1-10-2) other than a state educational institution, and a political subdivision (as defined in IC 36-1-2-13), other than a political subdivision established under IC 8-1-11.1, shall:

(1)report any cybersecurity incident using their best professional judgment to the office without unreasonable delay and not later than two (2) business days after discovery of the cybersecurity incident in a format prescribed by the chief information officer; and

(2)provide the office with the name and contact information of any individual who will act as the primary reporter of a cybersecurity incident described in subdivision (1) before September 1, 2021, and before September 1 of every year there

Free access — add to your briefcase to read the full text and ask questions with AI

(a) This section does not apply to an entity
subject to IC 13-18-16.5.
(b) A state agency (as defined in IC 4-1-10-2) other than a state
educational institution, and a political subdivision (as defined in IC 36-1-2-13), other than a political subdivision established under IC 8-1-11.1, shall:
(1) report any cybersecurity incident using their best professional
judgment to the office without unreasonable delay and not later
than two (2) business days after discovery of the cybersecurity
incident in a format prescribed by the chief information officer;
and
(2) provide the office with the name and contact information of
any individual who will act as the primary reporter of a
cybersecurity incident described in subdivision (1) before
September 1, 2021, and before September 1 of every year
thereafter.
Nothing in this section shall be construed to require reporting that
conflicts with federal privacy laws or is prohibited due to an ongoing
law enforcement investigation.