Indiana § 13-18-16-16 - Nonprofit water utility reconstituted as water authority by resolution; status as political subdivision; existing obligations; treatment as nonprofit; independent audits

§ 13-18-16-16. Nonprofit water utility reconstituted as water authority by resolution; status as political subdivision; existing obligations; treatment as nonprofit; independent audits

Sec. 16. (a) A nonprofit water utility may adopt a resolution approved by its board of directors under this section that reconstitutes the nonprofit water utility as a water authority to be named as provided in the resolution.

(b) A resolution adopted under this section must allow:

(1) the structure of the board of directors; and

(2) the rules governing the water authority;

to remain the same as those applicable to the nonprofit water utility.

(c) The water authority shall retain all its powers, privileges, rights, and exemptions as a nonprofit water utility under:

(1) its existing bylaws and articles; and

(2) all laws applicable to nonprofit water utilities and local water corporations, including powers granted under IC 32-24-4-1.

(d) Except as provided in subsection (g), a water authority constituted under this section is a political subdivision of the state.

(e) A copy of a resolution adopted under this section must be filed with the secretary of state. When the secretary of state receives a copy of a resolution under this subsection, the secretary of state shall dissolve the corporate status of the nonprofit water utility for purposes of state law.

(f) A water authority constituted under this section shall:

(1) remain obligated under any existing contracts or agreements; and

(2) remain obligated and assume the indebtedness;

of the nonprofit water utility.

(g) Notwithstanding any other law and subject to subsections (h) and (i), a water authority constituted under this section is subject only to the laws applicable to nonprofit water utilities and local water corporations and is not subject to the following:

(1) IC 5-3.

(2) IC 5-4-1.

(3) IC 5-11.

(4) IC 5-13.

(5) IC 5-14-1.5.

(6) IC 5-14-3.

(7) IC 5-22.

(8) IC 36-1-8.

(9) IC 36-1-10.

(10) IC 36-1-10.5.

(11) IC 36-1-11.

(12) IC 36-1-12.

(13) IC 36-1-15.

(h) A water authority constituted under this section is subject to IC 8-1.5-3-8 for purposes of setting rates and charges.

(i) For each fiscal or calendar year of a water authority constituted under this section that ends after December 31, 2006, the water authority:

(1) shall:

(A) have an audit of its financial records performed by an independent certified public accounting firm; and

(B) keep the audit report on file at the water authority; and

(2) notwithstanding IC 5-11-1-9, is not subject to the following:

(A) Audit or examination by the state board of accounts.

(B) The examination guidelines and reporting requirements of the state board of accounts.

As added by P.L.104-1998, SEC.3. Amended by P.L.220-1999, SEC.3; P.L.2-2002, SEC.57; P.L.166-2006, SEC.1.

IC 13-18-16.5Chapter 16.5. Public Water and Wastewater Cybersecurity

13-18-16.5-1Cybersecurity vulnerability assessment; reporting requirements

IC 13-18-16.5-1Cybersecurity vulnerability assessment; reporting requirements Sec. 1. (a) This chapter applies to an entity that:

(1) is:

(A) a community water system (as defined in IC 13-11-2-35.5(b)) with a population of five hundred (500) or more;

(B) a publicly owned treatment works (as defined in IC 13-11-2-177.5); or

(C) a semipublic facility (as defined in 327 IAC 5-1.5-59) with a classification of Class III or Class IV (as described in 327 IAC 5-23-3(4) and 327 IAC 5-23-3(5)); and

(2) utilizes:

(A) a computerized system to monitor and control the processes of the entity's operation from a central location; or

(B) another vulnerable monitoring or management system identified by the department.

(b) An entity shall do the following:

(1) Conduct a cybersecurity vulnerability assessment at least once per calendar year.

(2) Before September 1 of each year, provide the office of technology established by IC 4-13.1-2-1 with the name and contact information of any individual who will act as the primary reporter of a cybersecurity incident.

(3) Beginning in 2026, not later than December 31 of each even-numbered year, submit a certification to the department via a secured portal verifying that the entity:

(A) completed the assessment described in subdivision (1);

(B) mitigated or has documented plans to mitigate identified vulnerabilities; and

(C) updated emergency response plans to account for vulnerabilities and mitigating procedures.

(4) When an actual or reasonably suspected cybersecurity breach occurs, report the cybersecurity incident to the office of technology established by IC 4-13.1-2-1:

(A) either:

(i) not later than twenty-four (24) hours after discovery of the cybersecurity incident, if the cybersecurity incident impacts the operations of the entity; or

(ii) not later than two (2) business days after discovery of the cybersecurity incident, if the cybersecurity incident does not impact the operations of the entity; and

(B) in a format prescribed by the chief information officer of the office of technology.

(c) In conducting an assessment under subsection (b)(1), the entity shall utilize an assessment tool or framework approved by the department and the office of technology established by IC 4-13.1-2-1.

(d) An assessment conducted under subsection (b)(1) is confidential under IC 5-14-3-4(b)(19).

As added by P.L.139-2025, SEC.3.

IC 13-18-17Chapter 17. Groundwater Protection

13-18-17-1Repealed 13-18-17-2Registry of contaminated sites 13-18-17-3Repealed 13-18-17-4Investigation; contamination of private water supply wells; advisory; emergency action 13-18-17-5Quality standards; onsite sewage systems 13-18-17-5.5Water well testing costs incurred by nontransient noncommunity water systems operated by certain nonprofit centers; reimbursement by department; procedures 13-18-17-6Water pollution control board; protection zones; notice and hearing 13-18-17-7Repealed