Indiana Water Cybersecurity Law Creates Demand for Utility Services

Indiana’s 2025 Senate Enrolled Act 459 expands cybersecurity responsibilities for many water and wastewater utilities, including evaluation, incident reporting, and requirements for maintaining contact with state officials. The change places cybersecurity readiness more directly on utility operators and creates a potential market for contractors that can help assess systems, develop response processes, and protect operational technology. The requirements are a regulatory driver, not evidence of a currently funded state procurement or an open solicitation.

The structure of the water sector is important to contractors evaluating this opportunity. As Chetrice Romero, Senior Cybersecurity Adviser at Ice Miller LLP, noted, “About 80% of water, wastewater infrastructure is run by local governments.” That means municipal budgets, utility-level planning, and local purchasing processes are likely to shape demand more than a single statewide buying action. Providers should identify individual utility needs and understand how local decision-makers will translate the law’s requirements into funded projects.

Potential work includes cybersecurity assessments, incident-reporting support, managed security services, and protection for operational technology (OT) environments. These services may be particularly relevant to smaller utilities that have limited staff or cybersecurity resources, as well as operators working with aging infrastructure. A useful proposal will connect compliance support to actual operating conditions: the systems in use, available personnel, continuity requirements, and the utility’s ability to adopt and maintain recommended controls.

For GovCon firms and other service providers, the near-term opportunity is market development and customer discovery rather than bidding on a confirmed award. The available information identifies no open solicitation and no committed state funding. Companies can monitor utility procurement plans and legislative funding decisions, engage local operators about implementation challenges, and track how state agencies communicate expectations. Any pursuit strategy should distinguish obligations created by the law from services a utility has independently decided to procure.

• Senate Enrolled Act 459 expands cybersecurity evaluation, incident-reporting, and state-contact requirements for many Indiana water and wastewater utilities.
• The requirements may drive demand for cybersecurity assessments, incident-response and reporting assistance, managed security, and OT protection.
• About 80% of water and wastewater infrastructure is run by local governments, according to Chetrice Romero of Ice Miller LLP.
• Municipal procurement plans and utility budgets are central to market access; a statewide requirement does not itself establish a statewide contract.
• Smaller utilities may face staffing, capacity, and infrastructure constraints, including the challenge of securing aging systems.
• Contractors should tailor solutions to each utility’s operating environment and demonstrate how services can be implemented and sustained with available resources.
• No open solicitation or committed state funding is identified; this is a developing market need, not a confirmed procurement opportunity.
• Providers can track utility purchasing plans and legislative funding decisions while engaging operators on their cybersecurity implementation needs.