EPA to Require Cybersecurity Evaluations of Public Water Systems

Oct. 12, 2023 UPDATE: The United States Environmental Protection Agency (EPA) announced it is withdrawing this cybersecurity rule. The rule removal comes after organizations such as the American Water Works Association (AWWA) and the National Rural Water Association (NRWA) joined states in a legal challenge on the rule on behalf of their respective members. 

You can read more here.

The EPA released a memorandum last week stressing the need for states to assess cybersecurity defenses for public water systems during their periodic checks. 

The initiative is in response to a series of surveys and reports that indicate many public water systems have not adopted basic cybersecurity best practices, leaving their critical infrastructure at risk to cyber attacks. The new memorandum will require states to survey cybersecurity best practices in addition to their regular sanitary surveys already required by the EPA.

"Cyberattacks against critical infrastructure facilities, including drinking water systems, are increasing, and public water systems are vulnerable. Cyberattacks have the potential to contaminate drinking water, which threatens public health," said EPA Assistant Administrator for Water Radhika Fox. 

The United States Federal Bureau of Investigation now ranks cybercrime as one of its most important law enforcement activities. In a statement from the United States Department of Energy, "In addition to the general problems associated with cybercrime, critical infrastructure related to energy production, manufacturing, water supply, and other systems have come under attack."

As more and more public water systems incorporate technology into their infrastructure to optimize their systems, that computer technology can make systems more susceptible to cyberthreats if not properly protected. As more infrastructure becomes capable of communication, control, and data acquisition, cybersecurity must become of utmost importance. 

According to the Department of Energy, the water sector is generally believed to be lagging behind most critical infrastructures in securing its control systems. In those vulnerabilities, the top five common security gaps among water utilities are:

• Network configurations
• Media protection
• Remote access
• Documented policies and procedures
• Trained staff

The EPA is providing technical assistance and resources to assist states as they work toward improving the cybersecurity of their public water systems, including the "Evaluating Cybersecurity During Public Water Sanitary Surveys" and other fact sheets available on their website.

"Americans deserve to have confidence in their water systems' resilience to cyber attackers. The EPA's new action requires water systems to implement adequate cybersecurity to provide that confidence," said Anne Neuberger, Deputy National Security Advisor for Cyber and Emerging Technologies.

Is your water system protected?

SitePro partners with public water systems of all sizes to help them securely manage their critical water infrastructure. Our award-winning software has been recognized by various government entities such as the Department of Defense, Homeland Security, Army, Navy and Air Force for its impact on national security.

Our subscription-based software ensures your network configurations and firewalls are always up-to-date with the latest technology and upgrades. Real-time data collection and analysis allows your operators to be alerted of any unusual changes to your operations, and our real-time remote control ability allows them to react promptly.

Users can easily be added and removed to your SitePro platform, so only authorized operators have access to your critical infrastructure. Our customer success team also ensures your water operators are properly trained in using the software, so you can monitor and control your water and wastewater operations with confidence.

Not to mention, the EPA even recommends freshwater and wastewater systems install physical safety measures to protect their systems. These are surveillance security systems can prevent physical damage from occurring if the system is compromised. (this includes pressure switches, tank levels, size of chemical reservoirs, valve gears, etc.) Keep your hardware protected as well as your software with SiteWatch- an intuitive camera security system that can synchronize directly with your automation, and give you a direct look at your operations from anywhere.

To learn more about our technology and how to leverage it to protect your water and wastewater systems, give us a call at 806-687-5326.