Per IC 24-15-4-5 and IC 24-15-4-10 plus the separate Indiana Personal Information Disclosure Statute IC 24-4.9 (Indiana data breach notification law) controllers and processors must implement security + breach response + and records discipline. (1) Reasonable Security (IC 24-15-4-5): establish + implement + and maintain reasonable administrative + technical + and physical data security practices to protect the confidentiality + integrity + and accessibility of personal data + appropriate to the volume and nature of the personal data at issue (FTC reasonable security baseline + NIST CSF + ISO 27001). (2) Indiana Breach Notification (IC 24-4.9): separately requires controllers (database owners) holding personal information of Indiana residents (including SSN + driver license + financial account + credit card with security code + Indian ID + ITIN + biometric) to notify (a) affected Indiana residents without unreasonable delay following discovery of a security breach; (b) Indiana Attorney General without unreasonable delay; (c) any consumer reporting agencies if the breach affects more than 1000 Indiana residents - notification content + form + and substitute notice rules apply. (3) Records of Processing: while INCDPA does not explicitly require ROPA like GDPR controllers are expected to maintain records of consumer rights requests + DPA assessments + DPA contracts + breach notifications + Indiana Attorney General investigation materials + Internal audit. (4) Encryption: while INCDPA does not mandate encryption + reasonable security practices typically include encryption at rest + in transit + key management + secure software development lifecycle (SDLC) + EDR/MDM/MDM. (5) Pseudonymisation: INCDPA recognises pseudonymous data + which is exempt from certain consumer rights (Access + Portability) but NOT from controller obligations + security + and DPA. (6) De-Identification (IC 24-15-1-13): de-identified data means data that cannot reasonably be linked to an identified or identifiable natural person or a device linked to such a person - exempt from INCDPA upon attestation by controller + public commitment + and contractual prohibition on re-identification. (7) Algorithm Audit: not explicitly required but FTC AI/ML enforcement context applicable (FTC Section 5 + UDAP) + recommended for profiling/automated decision-making affecting consumers. Coordinates with Indiana Breach Notification IC 24-4.9 + FTC Reasonable Security + NIST CSF + GLBA Safeguards Rule (where overlapping) + HIPAA Security Rule (where overlapping) + state attorney general guidance + similar state privacy laws + India CERT-In Directions + DPDP Sec 8. INCDPA Security + Breach applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.