Ind. Code ch. 4-13.1-4

in effect

Ind. Code § 4-13.1-4-1 "Political subdivision"

Sec. 1. As used in this chapter, "political subdivision" has the meaning set forth in IC 36-1-2-13. As added by P.L.108-2024, SEC.2.

Ind. Code § 4-13.1-4-2 "Public entity"

Sec. 2. (a) Except as provided in subsection (b), as used in this chapter, "public entity" means a: (1) political subdivision; (2) state agency; (3) school corporation; or (4) state educational institution. (b) The term does not include an acute care hospital licensed under IC 16-21 that is established and operated under IC 16-22-2, IC 16-22-8, or IC 16-23, or a department of public utilities established under IC 8-1-11.1. As added by P.L.108-2024, SEC.2. Amended by P.L.142-2025, SEC.2; P.L.23-2026, SEC.12.

Ind. Code § 4-13.1-4-3 "School corporation"

Sec. 3. As used in this chapter, "school corporation" has the meaning set forth in IC 20-18-2-16(a). As added by P.L.108-2024, SEC.2.

Ind. Code § 4-13.1-4-4 "State educational institution"

Sec. 4. As used in this chapter, "state educational institution" has the meaning set forth in IC 21-7-13-32. As added by P.L.108-2024, SEC.2.

Ind. Code § 4-13.1-4-5 Development and adoption of technology resources policies, cybersecurity policies, and training programs

Sec. 5. (a) The office shall: (1) develop: (A) standards and guidelines regarding cybersecurity for use by political subdivisions and state educational institutions; and (B) a uniform cybersecurity policy for use by state agencies; and (2) develop, in collaboration with the department of education: (A) a uniform technology resources policy governing use of technology resources by the employees of a school corporation; and (B) a uniform cybersecurity policy for use by school corporations. (b) Not later than December 31, 2027, each public entity shall adopt the following: (1) A policy governing use of technology resources by the public entity's employees. If the public entity is a school corporation, the public entity shall adopt the uniform technology resources policy developed under subsection (a)(2)(A). (2) A cybersecurity policy as follows: (A) If the public entity is a political subdivision or state educational institution, the public entity shall adopt a cybersecurity policy based on standards and guidelines developed under subsection (a)(1)(A). (B) If the public entity is a school corporation, the public entity shall adopt the uniform cybersecurity policy developed under subsection (a)(2)(B). (C) If the public entity is a state agency, the public entity shall adopt the uniform cybersecurity policy developed under subsection (a)(1)(B). (3) A training program regarding the public entity's technology resources policy adopted under subdivision (1) and cybersecurity policy adopted under subdivision (2), completion of which is mandatory for the public entity's employees. (c) The uniform technology resources policy developed under subsection (a)(2)(A) and a technology resources policy adopted by a public entity other than a school corporation under subsection (b)(1) must: (1) prohibit an employee of the public entity from using the public entity's technology resources to: (A) engage in lobbying (as defined in IC 2-7-1-9) that is outside the scope of the employee's duties; (B) engage in illegal activity; or (C) violate the public entity's cybersecurity policy; and (2) include disciplinary procedures for violation of the technology resources policy. As added by P.L.108-2024, SEC.2. Amended by P.L.142-2025, SEC.3.

Ind. Code § 4-13.1-4-6 Submission of cybersecurity policy and assessment to office of technology

Sec. 6. (a) Not later than December 31 of each odd-numbered year, a public entity shall submit to the office the public entity's cybersecurity policy adopted by the public entity under section 5 of this chapter. (b) The office shall establish a procedure for collecting and maintaining a record of cybersecurity policies submitted to the office under subsection (a). (c) If a public entity engages a third party to conduct an assessment of the public entity's cybersecurity policy, the public entity shall provide the results of the assessment to the office. As added by P.L.108-2024, SEC.2. Amended by P.L.142-2025, SEC.4.

Ind. Code § 4-13.1-4-7 Public access to technology resources policies and cybersecurity policies

Sec. 7. (a) The technology resources policy adopted by a public entity under section 5 of this chapter is a public record under IC 5-14-3. (b) The cybersecurity policy adopted by a public entity under section 5 of this chapter is confidential and may not be disclosed to the public under IC 5-14-3. As added by P.L.108-2024, SEC.2.

Ind. Code § 4-13.1-4-8 Requirements for connection to state technology infrastructure

Sec. 8. (a) A public entity that connects to the technology infrastructure of the state after July 1, 2027, must: (1) have completed a cybersecurity assessment within the three (3) year period immediately preceding the first date after July 1, 2027, on which the public entity connects to the technology infrastructure of the state; (2) complete a cybersecurity assessment at least once every three (3) years after the first date after July 1, 2027, on which the public entity connects to the technology infrastructure of the state; (3) provide proof to the office of the public entity's compliance with subdivisions (1) and (2) upon request by the office; (4) if the public entity is a state agency or political subdivision, have an "in.gov" or ".gov" domain name; and (5) have a secondary end user authentication mechanism. (b) An entity that is not a public entity and that connects to the technology infrastructure of the state after July 1, 2026, must: (1) have completed a cybersecurity assessment within the two (2) year period immediately preceding the first date after July 1, 2026, on which the entity connects to the technology infrastructure of the state; (2) complete a cybersecurity assessment: (A) at least once every two (2) years after the first date after July 1, 2026, on which the entity connects to the technology infrastructure of the state; and (B) biennially for as long as the entity connects to the technology infrastructure of the state; (3) provide proof to the office of the entity's compliance with subdivisions (1) and (2) upon request by the office; and (4) have a secondary end user authentication mechanism. (c) At the discretion of the office: (1) a public entity that is not in compliance with subsection (a); or (2) an entity that is not in compliance with subsection (b); may be disconnected from the technology infrastructure of the state. As added by P.L.108-2024, SEC.2.

Ind. Code § 4-13.1-4-9 State software and remote server contracts

Sec. 9. (a) This section applies to a contract entered into between a state agency and a person under which the state agency receives a license to use a software application designed to run on generally available desktop or server hardware. (b) A person with which a state agency enters into a contract described in subsection (a) may not, as a provision of the contract or as a condition of the person entering into the contract: (1) require that the state agency install or run the software on hardware dedicated solely to the state agency; or (2) otherwise restrict the state agency from installing or running the software on hardware of the state agency's choosing. (c) If a state agency enters into a contract with a person under which the state agency runs software on hardware owned or operated by the person, the office of technology established by IC 4-13.1-2-1 shall ensure that the state agency fully complies with the licensing terms of all software run on the person's hardware. As added by P.L.108-2024, SEC.2.

Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://iga.in.gov/laws/2026/ic/titles/4Fetched: 10/17/2026