Local officials can strengthen water utility cybersecurity by ensuring applicable risk assessments and emergency plans address cyber threats, asking utility leaders for prioritized IT and operational technology (OT) mitigations, and supporting practiced incident response. EPA provides free assessment, planning, and preparedness resources; its technical assistance is not emergency response or recovery.
What cybersecurity planning does federal law require?
Under the federal Safe Drinking Water Act requirements described by EPA, community water systems serving more than 3,300 people must prepare or revise a risk and resilience assessment (RRA), certify its completion, and prepare or revise an emergency response plan (ERP). The ERP must incorporate the RRA’s findings and strategies and resources to improve resilience, including cybersecurity. See EPA’s Cybersecurity Planning page for the requirements and planning resources.
As an Amazon Associate I earn from qualifying purchases.
This scope should not be generalized to every water provider or wastewater system. EPA says wastewater utilities are not required to develop ERPs under SDWA section 1433, although it recommends that they use ERP guidance voluntarily. Officials should ask the utility which requirements apply to its system and who tracks assessment, plan, and certification deadlines.
How should officials assess cybersecurity risk?
Start with a prioritized picture of what the utility depends on, what is exposed or remotely managed, and what could happen if a system were disrupted. Cybersecurity is part of operational resilience: EPA notes that an inadequately protected internet-exposed human-machine interface (HMI) could let an unauthorized remote user view or change real-time settings, potentially disrupting treatment. That example does not mean every HMI is internet-exposed or compromised. See EPA Cybersecurity for the Water Sector.
#1 Best Overall
- BUSINESS CYBERSECURITY SOLUTION: SafeBiz is an advanced cybersecurity solution that protects your work network and safeguards your Business data and all internet connected devices in your business from cyber threats and hackers. SafeHome blocks phishing, malware, ransomware, online scams and dark web threats.
- ADVANCED THREAT PREVENTION: SafeBiz includes a Next-Gen Firewall, DNS Security, Web Filtering, Dark Web Protection, Geo-fencing and other AI Powered cybersecurity features protecting your Business and Sensitive Data from internet threats and hackers.
- BUSINESS DATA & IDENTITY SECURITY: Safeguards your Official and financial data, protecting them from online theft and unauthorized access.
- EASY SETUP: Connects effortlessly to any existing wireless router or internet connection, setting up in minutes without the need for any changes to your Business internet connection.
- HIGH SPEED CONNECTIVITY: Supports an aggregate throughput of up-to 4.3 Gbps, maintaining high-speed browsing and streaming performance for up to 128 devices.
EPA’s Cybersecurity Assessments page describes its Water Cybersecurity Assessment Tool for self-assessment and mitigation planning, as well as third-party assessment resources and a free evaluation program. Confirm the current scope and availability of any evaluation before relying on it.
| Assessment route | What it offers | What officials should verify |
|---|---|---|
| Utility-led self-assessment | EPA’s tool supports a utility’s own assessment and mitigation planning. | Whether staff have enough capacity and OT expertise, and whether findings lead to named owners, priorities, and timelines. |
| Third-party assessment or evaluation | EPA identifies third-party resources and a free evaluation program; program scope and availability should be confirmed with EPA. | Whether the assessment’s independence and depth fit the system’s complexity, what it costs, and whether its recommendations include follow-through. |
In either route, the useful outcome is not merely a checklist. Ask whether the utility has inventoried essential IT and OT assets, assessed vulnerabilities and consequences, and assigned responsibility and schedules for mitigating the highest-priority risks.
What should local officials ask utility leadership?
Officials generally govern, budget, seek evidence of risk management, and coordinate with public-safety and emergency-management partners; operators and technical staff manage day-to-day operations and technical controls. This is practical governance guidance, not a legal allocation of duties. Where authority is unclear, consult local counsel and the utility’s governing documents.
Recommended Free Tools
A short, appropriately protected briefing can cover these questions:
Rank #2
- Funny Cybersecurity merch - perfect design for men and women who love making others laugh.
- Variation of The "H" in Cybersecurity Stands for Happiness
- Dual-wall insulated stainless steel construction keeps beverages hot or cold, dishwasher safe and BPA free
- Leak-proof flip lid includes BPA free plastic drinking straw
- Has the utility completed the applicable RRA and ERP work, and who tracks certification deadlines?
- Which IT and OT assets are essential to safe, reliable service, and which are internet-accessible or remotely managed?
- What are the highest-priority risks, what mitigations are underway, and who owns each action?
- Does the response plan define decision authority, escalation, communications, evidence preservation, continuity, recovery, and required notifications?
- Have operations staff, IT/OT vendors, emergency management, communications staff, and relevant government partners rehearsed the plan?
- Which funding routes might support the prioritized work, and what are the current application requirements?
EPA provides tools and templates, but a template is a starting point, not evidence that a utility is ready. Do not request or publicly disclose credentials, network diagrams, or detailed vulnerabilities; the sources do not establish a universal public-reporting format.
How should the utility create and exercise an incident response plan?
A plan should fit the utility’s operations and local reporting obligations, rather than simply reproduce a generic template. The joint CISA, FBI, and EPA Incident Response Guide: Water and Wastewater Sector says planning should account for the utility’s characteristics and state, local, territorial, tribal, insurance, and other reporting requirements. It also emphasizes building relationships with local cyber communities before an incident so coordination is not being established during a crisis.
EPA links a customizable incident response plan template through its Cybersecurity Planning page. Use it to clarify, at minimum:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- who can make operational and escalation decisions;
- how staff will communicate internally and with vendors, government partners, and the public;
- how relevant evidence will be preserved;
- how essential service will continue and how systems will be recovered; and
- which notifications are required, by whom, and through which channels.
Exercise the procedures with the people expected to use them, including operations, IT/OT vendors, emergency management, communications staff, and relevant government partners. EPA’s Incident Action Checklists for Water Utilities support preparation, response, and recovery. EPA also announced additional planning materials on October 23, 2025, including a wastewater ERP guide, an incident response plan template, incident action checklists, and a cybersecurity procurement checklist; use the live EPA pages for current versions: EPA’s resource announcement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should happen during a cyber incident?
Use the utility’s incident response plan and the appropriate current state and federal reporting and response channels. The EPA incident action checklists can help organize actions across preparation, response, and recovery, while the joint CISA/FBI/EPA guide addresses coordination with federal agencies.
Do not treat an EPA technical assistance request as emergency incident response. EPA’s 2024 Guidance on Improving Cybersecurity at Drinking Water and Wastewater Systems says its technical assistance program does not support incident response or recovery and that incident reports are redirected to CISA or the FBI. Because operational contact and reporting instructions can change, check the current instructions when an incident occurs.
What funding may be available?
EPA identifies several potential public funding routes. This is a starting map, not a promise of eligibility, an open application window, or an award; check EPA’s Cybersecurity Funding page and the relevant state administrator before budgeting or applying.
| Program | Potentially relevant work described by EPA | Route or qualification |
|---|---|---|
| Clean Water State Revolving Fund | Measures to increase security of publicly owned treatment works. | Check current details with the state program administrator. |
| Drinking Water State Revolving Fund | Risk and resilience assessments, technical assistance, equipment, and infrastructure, including cybersecurity. | Check current details and eligibility with the state program administrator. |
| Resilience program for midsize and large drinking water systems | EPA lists a resilience program for these systems. | Confirm current availability, eligibility, and application timing; a past announcement does not establish that a round remains open. |
| CISA State and Local Cybersecurity Grant Program | Potential support for state and local cybersecurity priorities. | EPA says local-government sub-awards go through the applicable state administrative agency; confirm current requirements and windows there. |
Appropriations, deadlines, and eligibility can change. EPA’s October 23, 2025 announcement described a grant announcement for midsize and large water systems, but that announcement alone does not establish current availability.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
