Water Sector Cybersecurity Framework

EPA guidelines for water and wastewater systems cybersecurity including risk assessments and incident response.

Analysis

Conduct Regular Cybersecurity Risk Assessments: Water and wastewater systems (WWS) must routinely assess their cyber risks, including identifying vulnerabilities in both operational technology (OT) and information technology (IT) systems. This is outlined in the EPA Cybersecurity Checklist for Drinking Water and Wastewater Systems and reinforced by the EPA Cybersecurity for the Water Sector.

Maintain an Updated Asset Inventory: WWS are required to keep a current inventory of all OT and IT assets, including third-party and legacy equipment, and review it at least quarterly. See the EPA Cybersecurity Checklist.

Assign Cybersecurity Responsibility: Each utility must designate a specific role or position responsible for cybersecurity planning, resourcing, and execution. This includes OT-specific cybersecurity responsibilities. Refer to the EPA Cybersecurity Checklist.

Patch Management: Utilities must identify and patch known vulnerabilities in a risk-informed and timely manner, prioritizing critical assets. See the EPA Cybersecurity Checklist.

Secure Remote Access and Human-Machine Interfaces (HMIs): Implement strong passwords, multifactor authentication (MFA), network segmentation (such as DMZs or bastion hosts), and allowlisting for remote access to HMIs. Details are provided in the CISA and EPA Fact Sheet and EPA Cybersecurity for the Water Sector.

Incident Response Planning: Develop and maintain an incident response plan to detect, respond to, and recover from cyber incidents. Guidance is available in the EPA Cybersecurity for the Water Sector.

Resource Constraints: Many utilities, especially smaller ones, lack sufficient staff and funding to implement comprehensive cybersecurity programs. This is highlighted in the EPA Guidance on Improving Cybersecurity.

Legacy Systems: Older equipment often lacks modern security features, making patching and segmentation difficult. The EPA Inspector General’s report found exploitable weaknesses in systems serving over 50,000 people.

Limited Cybersecurity Awareness: Utilities may not have dedicated cybersecurity staff or sufficient training, leading to gaps in risk identification and response. See the EPA Cybersecurity for the Water Sector.

Real Example: The EPA Inspector General’s report documented passive assessments revealing vulnerabilities that could disrupt service or cause data loss.

Follow the EPA Cybersecurity Checklist: Use the EPA Cybersecurity Checklist for Drinking Water and Wastewater Systems as a baseline for controls and practices.

Adopt the Top Cyber Actions: Implement the eight priority steps from the EPA, CISA, and FBI Top Cyber Actions for Securing Water Systems.

Segment Networks: Use DMZs and bastion hosts to separate OT from IT and external networks, as recommended in the CISA and EPA Fact Sheet.

Regular Training and Drills: Conduct ongoing cybersecurity training and incident response exercises. Guidance is available in the EPA Cybersecurity for the Water Sector.

Utilize Assessment Tools: Leverage the EPA Water Cybersecurity Assessment Tool and request technical assistance.

CISA and EPA Joint Guidance (December 2024): New fact sheet on securing HMIs and remote access, emphasizing network segmentation, MFA, and patch management. See the CISA and EPA Fact Sheet.

EPA Inspector General’s Report (November 2024): Identified significant cybersecurity weaknesses in large drinking water systems. Details in the Inspector General’s report summary.

Withdrawal of Proposed Rule (October 2024): EPA withdrew its proposed cybersecurity rule for public water systems due to legal and public concerns, but continues to issue guidance and voluntary best practices. See the EPA Withdrawal Announcement.

America’s Water Infrastructure Act (AWIA) Section 2013: Requires risk and resilience assessments, including cybersecurity, for community water systems. See the AWIA Section 2013 Overview.

NIST Cybersecurity Framework: Provides a voluntary framework for critical infrastructure cybersecurity, referenced in EPA guidance. See the NIST Cybersecurity Framework.

International Society of Automation/IEC 62443: Standards for securing industrial automation and control systems, referenced in EPA guidance. See the ISA/IEC 62443 Standards.

Interaction: EPA guidance aligns with and references these standards, encouraging utilities to use them as benchmarks for cybersecurity practices.

Increased Regulatory Scrutiny: Utilities face greater oversight and expectations for cyber risk management, as highlighted in the EPA Inspector General’s report.

Operational Disruption Risks: Cyber incidents can force facilities into manual operation or disrupt water treatment, as documented in the CISA and EPA Fact Sheet.

Sector-Wide Awareness and Investment: The sector is investing in cyber hygiene, training, and technology upgrades, as encouraged by the EPA Cybersecurity for the Water Sector.

2026-01-30 — Industry praised bipartisan extension of cyber liability protections and threat-sharing through Jan 30, 2026, enabling utilities to update assessments and ERPs; aligns with EPA's focus on reducing internet exposure and securing systems[3]. (source)
2026-01-05 — Article details escalating cybersecurity risks to water and wastewater systems from nation-state actors and criminals, highlighting vulnerabilities in OT/ICS and the need for enhanced defenses amid recent EPA guidance[6]. (source)
2025-12-31 — EPA set RRA/ERP recertification deadlines through June 2026 based on system size, emphasizing cyber risks in assessments, IT/OT segmentation, access hygiene, and training; utilities should prepare now for CIRCIA reporting starting 2026[4]. (source)
2025-10-23 — EPA released four cybersecurity tools for water utilities including incident response templates, emergency plans, vendor evaluation, and operational continuity guides to address rising threats and federal mandates[1]. (source)