|
RCBJ-Audible (Listen For Free)
 |
New York Regulations Seek To Secure Water & Wastewater Infrastructure From Cyber Threats
By David Carlucci
Cybersecurity may not be the first thing that comes to mind when we think about clean water, but in today’s digital age, protecting our water systems from cyber threats is becoming a top priority. Recognizing the risks, New York State is rolling out new regulations aimed at securing water and wastewater infrastructure — and offering grant funding and technical help to support the transition.
So, how does this work?
New rules proposed by Governor Hochul’s administration will require most water and wastewater utilities across the state to follow basic cybersecurity practices. This includes evaluating risks, putting safeguards in place to protect data, monitoring networks for suspicious activity, and developing response plans in case of an incident.
The goal is to make sure the systems that deliver clean water—and treat our wastewater—are not vulnerable to cyberattacks that could disrupt operations or compromise public safety.
Who’s Affected?
Utilities that serve more than 3,300 people will be subject to the new requirements. Larger water providers, such as those serving more than 50,000 residents, will need to take additional steps. Even though the smallest systems may not fall under the rules immediately, all providers are being encouraged to adopt basic cybersecurity measures.
When Do the Rules Take Effect?
State agencies are currently accepting public comments through 2025 as they finalize the regulations. Compliance deadlines vary depending on which state agency oversees the system but generally fall in 2026 or 2027. Utilities will have time to prepare, but now is the time to begin planning.
What Financial Support Is Available?
To help systems prepare, the state has introduced a new grant program called SECURE — short for Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements. $2.5 million in funding is available statewide to help utilities pay for risk assessments, software updates, and other upgrades needed to meet cybersecurity requirements.
Applications will be competitive, so water providers will want to get a head start in gathering the information needed to apply.
What Other Help Can Communities Get?
The state’s Environmental Facilities Corporation has launched a Cybersecurity Assistance Hub, offering guidance, tools, and free one-on-one technical support. This can be especially helpful for smaller municipalities that do not have in-house IT staff.
Technical experts are available to help utilities assess their systems, set priorities, and create a game plan to meet state requirements — at no cost to the community.
Why It Matters?
While cyberattacks may seem like a remote threat, they are becoming more common across the country. Protecting water infrastructure is about maintaining reliable service, safeguarding public health, and staying ahead of evolving risks. New York’s approach combines clear guidance, funding support, and hands-on help to make sure no community is left behind.
These new cybersecurity rules are about making sure the systems we rely on every day are protected from modern threats. With funding and assistance available, water providers do not have to go it alone. Now’s a good time to plan and take advantage of the resources out there.
David Carlucci consults organizations on navigating government and securing funding. He served for ten years in the New York Senate.
