State develops cybersecurity regs for water, wastewater systems

ALBANY | Gov. Kathy Hochul has announced a key milestone to safeguard New York's water infrastructure by developing cybersecurity regulations for water and wastewater systems alongside a new cyber grant program and technical assistance to bolster the security and resilience of water and wastewater systems. Following a collaborative multi-agency development process directed by her 2025 State of the State, the New York State Department of Health (DOH) and New York State Department of Environmental Conservation (DEC) released proposed cyber regulations for water and wastewater systems for public comment. In coordination, the Department of Public Service (DPS) also released proposed cyber regulations across water-works corporations, other public utilities, and cable television companies for public comment. The Environmental Facilities Corporation (EFC) is also establishing a new cyber grant program and technical assistance for the water and wastewater systems sector. These threat-informed, risk-centric, and cost-balanced minimum standards and accompanying funding and technical assistance will strengthen the cybersecurity posture of water utilities and protect them from increasingly sophisticated and dangerous cyber attacks. "Cyber attacks on critical infrastructure can have devastating impacts on communities, and we must act now to defend our water and wastewater systems with the same urgency and rigor we bring to other critical sectors," Gov. Hochul said. "These new regulations and grant programs reflect our commitment to protecting public health and safety while helping under-resourced entities modernize for a digital age." The agencies worked together to closely align definitions and provisions within each agency's regulatory and operational requirements, worked to minimize duplicative or conflicting requirements, and streamlined processes. They also aligned regulations with guidance issued by the U.S. Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency for securing information technology and operational technology environments. Regulated water and wastewater systems will be required to evaluate risks, deploy cybersecurity controls, and implement network monitoring and logging for the largest systems. Regulated entities will also be required to develop and maintain response and recovery plans to support continuity of operations in the event of cyber attacks and to report cybersecurity incidents. Gov. Hochul secured another $500 million for clean water infrastructure in this year's budget, bringing the state's total investment to $6 billion since 2017. In addition to these investments, $2.5 million in the FY26 Budget funds a new cyber grant program, Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE), dedicated to the water and wastewater sector. This new grant program will provide competitive grants to support cybersecurity risk assessments and hardening efforts focused on and aligned with the new proposed regulatory requirements. The grant opportunities assist water systems by providing them with the needed resources to strengthen their cybersecurity posture, enhance resiliency, and ensure reliable delivery of clean water for New Yorkers. Gov. Hochul is again expanding the Community Assistance Teams to provide free, expert guidance and tools to help water systems implement cybersecurity best practices in a way that is cost-effective and sustainable. Communities can continue to request a one-on-one consultation with the Teams about their water infrastructure needs, now including cybersecurity. A new Cybersecurity Hub is now available on the EFC'S website to help communities immediately start fortifying their systems. The hub provides training opportunities, recommended actions, and additional resources. This hub will be regularly updated. Communities can continue to request consultations about their water infrastructure needs on the EFC's website. The public release by DOH, DEC, and PSC of the proposed regulations marks the latest step in strengthening the reliability and resilience of New York's water and wastewater systems. DEC will accept public comments until Sept. 3; DOH until Sept. 14; and PSC until Sept. 14. Once adopted, regulated entities will have until Jan. 1, 2027, to comply with DEC and DOH regulations focused on operational technology and until Jan. 1, 2026, to comply with PSC regulations focused on information technology. Sen. Chuck Schumer said, "We must do all we can to protect our vital water infrastructure assets, like dams and drinking water, from cyber attack. That is why I'm pleased that new cybersecurity regulations for New York's water and wastewater systems and a new grant program will help our communities meet federal standards and build a safer, more resilient New York."

Signup for our newsletter

State develops cybersecurity regs for water, wastewater systems

COMPANY

CUSTOMER SUPPORT

SUBMISSION FORMS

BEYOND THE NEWS