The short answer
EPA Guidance
The federal environmental agency runs a water sector cybersecurity program that offers utilities a free cybersecurity assessment and technical assistance, a checklist of practices aligned with the federal cross-sector performance goals, guidance on procurement and on incident response, and joint publications with the federal cybersecurity agency and the federal investigative agency, including an incident response guide for the water sector and a short list of top actions for securing water systems. It also enforces: after attempting to require cybersecurity evaluation in sanitary surveys and withdrawing that approach, the agency issued an enforcement alert stating that most systems it inspected had gaps such as default passwords and single shared logins, and that it would use its authority under the drinking water law to require corrective action. The practical use of the guidance is to take the free assessment, work the checklist in priority order, adopt the incident response guide, and document the result in the risk and resilience assessment.
Key points
- Free assessment and technical assistance for utilities that ask; a checklist that says what good looks like.
- Joint guidance with the cybersecurity and law enforcement agencies: an incident response guide for the sector and a top actions list.
- The enforcement position: basic gaps found in most inspected systems, and drinking water law authority to require fixes.
- The guidance maps to the federal performance goals, which is the same map the other agencies and the sector center use.
- Use it in order: assessment, top actions, checklist, incident response guide, documented in the risk and resilience assessment.
- The pages change; check the agency water cybersecurity site for the current documents.
What the agency offers
| Resource | What it is | How to use it |
|---|---|---|
| Cybersecurity assessment and technical assistance | A free evaluation of a utility cybersecurity posture by the agency or its contractors, with findings and a prioritized plan | Request it; it is the fastest start for a utility with no program |
| Water cybersecurity checklist | A list of practices for water utilities aligned with the federal cross-sector performance goals, with a self-assessment format | Work it in the order of the goals; use it as the annual review |
| Water sector incident response guide | Published jointly with the federal cybersecurity and investigative agencies: preparation, detection, response, recovery, and who to contact | Adopt it as the structure of the utility incident plan |
| Top cyber actions for securing water systems | A short joint list of the highest-value actions: reduce exposure, change default passwords, inventory, backups, incident planning, and others | The first quarter of the program |
| Procurement guidance | Cybersecurity requirements to include when buying control system equipment and services | Put it in the specification for the next project |
| Tabletop exercise materials | Scenarios and facilitation guides for utilities to exercise their plans | The annual exercise |
| Funding information | State revolving fund eligibility for cybersecurity improvements, and grant programs | Ask the state program about cybersecurity projects |
| Training and webinars | Recorded and live sessions for utility staff | Onboarding for the security owner and the operators |
The enforcement position
In 2023 the agency issued a memorandum directing states to include cybersecurity in sanitary surveys of public water systems, the periodic inspections the drinking water program already requires; after legal challenge the memorandum was withdrawn later that year. In 2024 the agency issued an enforcement alert reporting that more than two thirds of the systems it had inspected were in violation of basic requirements, with findings such as default passwords left in place, shared logins, and no cybersecurity assessment, and stating that it would increase inspections and take enforcement action under the drinking water law, including the emergency powers and the risk and resilience assessment requirements. The message to utilities is that the guidance is voluntary in name and expected in practice: the basic actions on the top actions list are what inspectors look for first.
Turning it into a program
- 1
Request the assessment
The free evaluation produces findings and a plan without cost; the utility supplies a day of staff time and access.
- 2
Do the top actions
Reduce internet exposure, change every default password, build the inventory, back up and take a copy offline, write the incident plan, train staff. Most are done in a quarter.
- 3
Work the checklist
The remaining practices in the order of the performance goals, as the plan for the next year or two.
- 4
Adopt the incident response guide
As the structure of the utility plan, with the contact list filled in and an exercise scheduled.
- 5
Specify security in procurement
Using the procurement guidance for the next project, so that new equipment arrives without default passwords and with the vendor obligations written down.
- 6
Document in the risk and resilience assessment
The findings and the plan become the cyber portion of the assessment and the emergency response plan the act requires.
Wastewater
The drinking water law and its assessment requirement do not reach wastewater-only utilities, but the agency guidance, the free assessment, the incident response guide, and the top actions apply to them and are offered to them. Wastewater utilities also face the clean water law consequences of an overflow or a bypass caused by a cyber incident, which are reported and enforced as any overflow would be. A combined utility runs one program for both.
Frequently asked questions
- Is the guidance mandatory?
- The guidance documents are voluntary; the risk and resilience assessment and emergency response plan requirements under the water infrastructure act are mandatory for covered systems; and the agency has stated that it will use its drinking water law authority against systems with basic gaps. In practice, the top actions are the expectation.
- How do we request the free assessment?
- Through the agency water sector cybersecurity program page, which has a request form and a contact, and through the state drinking water program, which can connect a utility to the assistance. The sector center and the federal cybersecurity agency regional advisors offer parallel help.
- Will the agency see our assessment results?
- The free assessment is technical assistance, and its purpose is to help the utility; the agency has said it is not an inspection. The utility keeps the results with its security documentation. Inspections under the drinking water law are a separate activity with their own rules.
- The pages have changed since this was written. Where do we look?
- The agency water sector cybersecurity page, the federal cybersecurity agency water and wastewater sector page, and the sector information sharing center. Between them they carry the current documents, and the sector center digest announces changes.
Related topics
- AWIA RequirementsWhat the 2018 water infrastructure act requires of community water systems: a risk and resilience assessment and an emergency response plan, certified on a schedule by size and repeated every five years, with cybersecurity named in both, and who is covered.
- CISA ResourcesWhat the federal cybersecurity agency provides to utilities without charge: the performance goals, regional advisors, external vulnerability scanning, control system advisories, the exploited catalog, a self-assessment tool, exercises, and incident reporting.
- Small Utility Cybersecurity PrioritiesWhat a utility with a few operators and no IT department should do first: the ten measures that remove most of the risk for the least money and time, in the order to do them, with what each one costs, what it prevents, and how to know it is done.
- Security Program BasicsWhat a control system security program is for a utility that has never had one: a named owner, an inventory, a risk assessment, a few policies, baseline controls, training, vendor rules, an exercised incident plan, and a first-year plan for a small staff.
- OT Incident Response PlanThe plan for the day the control system is not trusted: who decides, the triggers, the first hour, isolating without stopping treatment, running by hand, preserving evidence, who to notify and when, recovery from backups, and the exercise that makes it real.
- Reporting RequirementsWho a water or wastewater utility must tell about a cyber incident, how fast, and what to say: the federal critical infrastructure reporting rule, state laws, the drinking water regulator, public notification, law enforcement, the sector center, and insurers.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.