A new watchdog report published by the US government's Environmental Protection Agency says the EPA must develop a comprehensive plan of action to counter the increasing number and sophistication of cybersecurity threats facing the utilities. In the last few years, there have been many cyberattacks against water treatment plants, sewage plants, and other infrastructures across the globe. 

A report by the Government Accountability Office indicates that the entire water industry has found it difficult to deal with the problem through voluntary security initiatives and fought back against new mandates issued by the Environmental Protection Agency. EPA and other government agencies are called upon to do more to assess and identify the full extent of cyber risks that face the water and wastewater sectors, including developing a national strategy and conducting a cyber risk assessment. 

There have been several high-profile hacking incidents that have raised concerns regarding the ability of the country’s drinking water and wastewater treatment industries to maintain their security over the past few years, so the Biden administration has prioritized those industries.  The White House and the Environmental Protection Agency in March urged state officials to provide information on how well-prepared water utilities were dealing with cyber risks that were becoming more prevalent. 

There are still concerns expressed by EPA officials as to how the data will not be integrated into a comprehensive strategy to make this information effective.  When Harry Coker Jr., the National Cyber Director, delivered a speech in May in Washington, D.C., he stated that he planned to increase technical assistance for public water systems by the EPA and that the Department of Agriculture would invest in programs for rural water utilities as part of the water safety reforms.  

A GAO report, released last week, stated that the EPA was working on plans to strengthen federal assistance to the water industry based on the findings of the GAO report. An auditing program for water utilities by the Environmental Protection Agency (EPA) was launched in 2023 to increase their cyber resilience, but the program has now been revoked because a state challenge was filed.  

The Environmental Protection Agency remains committed to providing cybersecurity technical assistance to the water sector, and we will continue to work together with our federal partners to find all the ways we can to better protect the nation's drinking water and wastewater systems, the agency said in a press release.