The short answer
Reporting Requirements
A cyber incident at a utility triggers several reporting obligations at once, and the plan lists them with their clocks. Federal law directs covered critical infrastructure entities, which include water and wastewater systems above a size threshold, to report substantial cyber incidents to the federal cybersecurity agency within 72 hours and ransom payments within 24 hours under its implementing rule; a growing number of states require reports to a state agency on similar or shorter timelines; the drinking water primacy agency must be told when treatment, monitoring, or service is affected, and public notification rules apply when water quality or availability is at risk; law enforcement is notified for any intrusion; the sector information sharing center receives a voluntary report that helps other utilities; and insurers and contracts have their own notice clauses. The list, the contacts, the thresholds, and the timelines are prepared in advance, verified each year because the rules change, and kept on paper with the incident plan.
Key points
- Several clocks start at once: federal, state, regulator, public notice, insurer. The plan lists them with the contacts.
- The federal rule for critical infrastructure sets 72 hours for a substantial incident and 24 hours for a ransom payment for covered entities; confirm the current status and thresholds.
- The drinking water regulator is told when treatment, monitoring, or service is affected, and public notification rules apply to the consequences.
- Law enforcement and the sector information sharing center are told for any intrusion; they help, and they aggregate what others are seeing.
- The incident log is the source for every report; keep it from the first hour.
- Rules change; the list is verified annually with counsel and the state.
Who, when, what
| Recipient | Trigger | Timeline | Notes |
|---|---|---|---|
| Federal cybersecurity agency | A substantial cyber incident at a covered entity; any ransom payment | 72 hours for the incident; 24 hours for a ransom payment, under the critical infrastructure incident reporting law and its rule | Coverage depends on the size and role of the system; the rule defines substantial; voluntary reporting is welcomed from everyone |
| State cybersecurity or homeland security agency | Per state law; several states require water systems to report cyber incidents | Commonly 24 to 72 hours; some shorter | Check the state; some also require annual assessments or attestations |
| Drinking water primacy agency | Treatment, monitoring, or service affected; a compliance failure caused by the incident | Per the primacy agency rules, often within 24 hours for events affecting water quality | Loss of monitoring is itself reportable; manual monitoring records are the evidence |
| Public notification | A situation with the potential for serious adverse health effects, or a loss of service | Tier 1 notices within 24 hours under the drinking water rules; other tiers longer | Coordinated with the primacy agency; the template is prepared in advance |
| Wastewater regulator | A permit violation, an overflow, or a bypass caused by the incident | Per the permit, often 24 hours by phone and 5 days in writing | The overflow is reported as an overflow; the cyber cause is part of the report |
| Law enforcement | Any intrusion | As soon as practical | The federal investigative agency field office and its internet crime portal; they may also assist with response |
| Sector information sharing center | Any incident or credible attempt | As soon as practical | Voluntary; the report helps other utilities and returns intelligence |
| Insurer | Per the policy | Often within days; some policies require notice before engaging responders | The policy dictates which responders and counsel may be used |
| Governing board and management | Any incident | Immediately | The internal escalation in the plan |
| Customers and contracts | Service or data affected; contractual notice clauses | Per contract; privacy laws where personal data was exposed | Billing systems often hold personal data |
The federal rule
The critical infrastructure incident reporting law enacted in 2022 directed the federal cybersecurity agency to require covered entities to report substantial cyber incidents within 72 hours of reasonably believing one has occurred and ransom payments within 24 hours, with supplemental reports as information changes. The implementing rule defines which water and wastewater systems are covered, generally by population served, and what counts as substantial. The reports go through the agency portal and are protected from public disclosure and from certain liability. The utility confirms whether it is covered, what the current thresholds are, and how to file, and puts the answer in the plan. Utilities below the threshold are encouraged to report voluntarily, and doing so brings assistance.
The regulator and the public
A cyber incident that stops the SCADA does not by itself change water quality, and it does not by itself trigger public notification. What triggers the regulator and the public notice rules is the consequence: a disinfection failure, a loss of required monitoring, a pressure loss that could allow contamination, an overflow. The plan connects the two: the incident lead tells the primacy agency when monitoring has gone manual and how compliance is being maintained, and the notification decision is made with the agency when a consequence occurs or is possible. Notification templates are written in advance so that the message on the day is accurate and calm.
What every report needs
- The utility, the systems affected, and the date and time the incident was discovered.
- What is known about the nature of the incident: ransomware, unauthorized access, a changed controller, a lost network.
- The effect on operations: what is in manual, what is monitored by hand, whether service or quality is affected.
- The actions taken: isolation, manual operation, responders engaged.
- What is not yet known, stated as such.
- The contact for follow-up.
- Supplemental updates as the investigation changes the picture, and a final report.
Preparing the list
- 1
Identify the obligations
Federal coverage, state law, the primacy agency and wastewater permit requirements, the insurance policy, and the contracts. Counsel confirms.
- 2
Record the contacts
Names, numbers, portals, and account credentials for each, including the after-hours numbers.
- 3
Write the thresholds and clocks
What triggers each report and how long the utility has, in the plan.
- 4
Draft the templates
The initial report, the supplemental report, the public notice, and the board briefing.
- 5
Assign the reporter
Who files each report, and who approves it; the incident lead is not the person filing everything.
- 6
Verify annually
The rules, the contacts, and the portals change; the annual exercise includes filing a practice report where the agency allows it.
Frequently asked questions
- Does a phishing email that was caught count as an incident to report?
- Not under most mandatory rules, which apply to substantial incidents that affect operations or data. It is worth a voluntary report to the sector information sharing center if it targeted the utility specifically, because others may be targeted the same way. The plan defines the threshold so that the decision is not made under pressure.
- Will reporting make the incident public?
- Reports to the federal agency under the incident reporting rule are protected from public disclosure by the law; state rules vary. Public notification is a separate obligation that arises only from consequences to water quality or service, and it is coordinated with the regulator. Reporting to a regulator is not a press release.
- We paid a ransom. Is that reportable?
- Under the federal rule, a ransom payment by a covered entity is reportable within 24 hours, and some states have their own requirements. Payment decisions involve counsel, law enforcement, and the insurer before the fact, and the reporting is part of that decision.
- Who is the primacy agency?
- The state agency that administers the drinking water program, in most states the environmental or health department, or the federal environmental agency in states that do not have primacy. Its emergency contact number is on the plan, and it is called for any event that affects treatment, monitoring, or service, cyber or otherwise.
Related topics
- OT Incident Response PlanThe plan for the day the control system is not trusted: who decides, the triggers, the first hour, isolating without stopping treatment, running by hand, preserving evidence, who to notify and when, recovery from backups, and the exercise that makes it real.
- AWIA RequirementsWhat the 2018 water infrastructure act requires of community water systems: a risk and resilience assessment and an emergency response plan, certified on a schedule by size and repeated every five years, with cybersecurity named in both, and who is covered.
- CISA ResourcesWhat the federal cybersecurity agency provides to utilities without charge: the performance goals, regional advisors, external vulnerability scanning, control system advisories, the exploited catalog, a self-assessment tool, exercises, and incident reporting.
- EPA GuidanceWhat the federal environmental agency provides to water and wastewater utilities on cybersecurity and what it expects: the free assessment, the checklist aligned with federal goals, joint incident response guidance, the enforcement position, and how to use it.
- Recovery and RestorationBringing a control system back after a compromise without reintroducing it: controllers verified against baselines first, servers rebuilt from clean media and project exports, every credential changed, hardening, staged reconnection, and end-to-end tests.
- Water and Wastewater Utility Threat LandscapeWhat has actually happened at water utilities, what those incidents had in common, and the small number of controls that would have prevented most of them.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.