EPA Releases New Resources to Help Protect Water Systems, Strengthen Cyber Resilience
WASHINGTON – This week, U.S. Environmental Protection Agency (EPA) released new and updated planning tools that water systems across the country can use to help prevent and respond to cybersecurity incidents. These tools will help all public water systems protect access to safe water and aid systems conducting risk and emergency planning for cybersecurity.
“Strengthening cybersecurity for the U.S. water sector is critically important because cyber resilience and water security are key to national security. Water systems across the country are facing cyberattacks that threaten the ability to provide safe water. As part of advancing the Powering the Great American Comeback Initiative, EPA is committed to ensuring every American has access to clean and safe water. Guarding against cyberattacks is central to this mission,” said EPA Assistant Administrator for Water Jess Kramer.
To better address potential vulnerabilities and ensure all water systems have the best information and emergency safeguards available to maintain protections for drinking water and wastewater treatment operations, EPA has developed the following resources:
- Emergency Response Plan (ERP) Guide for Wastewater Utilities: This updated plan describes strategies, resources, plans, and procedures utilities can use to prepare for and respond to an incident, natural or man-made, that threatens life, property, or the environment.
- Template for Developing an Incident Response Plan: This new template assists drinking water and wastewater systems with developing a Cybersecurity Incident Response Plan (CIRP).
- Incident Action Checklists: EPA is publishing two new checklists, as requested by the water sector, to help drinking water utilities prepare for, respond to, and recover from specific emergencies such as wildfires, power outages, floods, and cybersecurity incidents.
- Cybersecurity Procurement Checklist: This checklist will help water and wastewater utilities incorporate cybersecurity into the procurement process. It will help utilities generally assess the cybersecurity practices of suppliers, including vendors and manufacturers, and their products during procurement.
Cybersecurity for critical infrastructure is a human health and a national security priority. EPA will continue to fulfill its core mission of protecting human health and the environment by working with the Cybersecurity and Infrastructure Security Agency, state programs, and water associations to help reduce cyber risks at water systems. The agency will also continue to collaborate with water systems to implement best management practices to swiftly address any cybersecurity concerns as they arise.
Background
In August, the Trump EPA announced over $9 million in grant funding for midsize and large water systems to help protect drinking water from cybersecurity threats and improve resiliency for extreme weather events. The agency also published a report highlighting 10 recommendations to strengthen resiliency to cyberattacks in the water sector.
Cyberattacks against water systems have increased several-fold in recent years and can disrupt or contaminate drinking water and compromise the treatment of wastewater. EPA, federal partners, and utilities have a collective responsibility to ensure that cyber threats do not imperil the critical lifeline of clean and safe water. Clean and safe water is central to strengthening the American workforce; powering industries — from auto manufacturing to Artificial Intelligence; and advancing energy dominance. In communities, it supports small businesses, hospitals, military bases, and schools.
Learn more about EPA’s water cybersecurity efforts.