Sign in Subscribe
Governors

Governor Hochul Announces Nation-Leading Cybersecurity Minimum Standards for Water and Wastewater Systems

Strategic Insights

— 2 min read

As part of her ongoing efforts to safeguard New York's critical infrastructure against increasingly sophisticated cyber threats, Governor Kathy Hochul has announced the development of nation-leading cybersecurity regulations for water and wastewater systems, alongside a new cyber grant program and technical assistance to bolster the security and resilience of these systems. The proposed regulations and grant program aim to strengthen the cybersecurity posture of water utilities and protect them from potential disruptions and threats to public health and safety.

Key Takeaways:

  • The proposed regulations for water and wastewater systems will require regulated entities to evaluate risks, deploy cybersecurity controls, and implement network monitoring and logging for the largest systems.
  • The regulations will also require regulated entities to develop and maintain response and recovery plans to support continuity of operations in the event of cyber attacks and to report cybersecurity incidents.
  • A new cyber grant program, Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE), will provide competitive grants to support cybersecurity risk assessments and hardening efforts focused on and aligned with the new proposed regulatory requirements.
  • The grant opportunities will assist water systems by providing them with the needed resources to strengthen their cybersecurity posture, enhance resiliency, and ensure reliable delivery of clean water for New Yorkers.
  • Governor Hochul is expanding the Community Assistance Teams to provide free, expert guidance and tools to help water systems implement cybersecurity best practices in a way that is cost-effective and sustainable.
  • A new Cybersecurity Hub is now available on the Environmental Facilities Corporation's (EFC) website to help communities immediately start fortifying their systems.
  • The public release of the proposed regulations marks the latest step in strengthening the reliability and resilience of New York's water and wastewater systems.
  • Regulated entities will have until January 1, 2027 to comply with Department of Environmental Conservation (DEC) and New York State Department of Health (DOH) regulations focused on operational technology and until January 1, 2026 to comply with Public Service Commission (PSC) regulations focused on information technology.

Statistics:

  • $500 million in clean water infrastructure funding was secured by Governor Hochul in this year's budget, bringing the state's total investment to $6 billion since 2017.
  • $2.5 million in the FY26 Budget funds the new cyber grant program, Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE).
  • 100 water utilities and wastewater systems will be required to undergo regular cybersecurity risk assessments and implement hardening efforts focused on and aligned with the new proposed regulatory requirements.
  • 90% of New York's water and wastewater systems are expected to benefit from the proposed regulations and grant program.
  • 50% of New York's water and wastewater systems are expected to have completed cybersecurity risk assessments and implemented hardening efforts within the first two years of the program.

Sources:

  • Office of the Governor of New York
  • New York State Department of Health (DOH)
  • New York State Department of Environmental Conservation (DEC)
  • New York State Public Service Commission (PSC)
  • New York State Environmental Facilities Corporation (EFC)
  • New York State Chief Cyber Officer Colin Ahern
  • New York State Environmental Facilities Corporation President and CEO Maureen A. Coleman
  • New York State Department of Environmental Conservation Commissioner Amanda Lefton
  • New York State Public Service Commission Chair Rory M. Christian
  • New York State Division of Homeland Security and Emergency Services Commissioner Jackie Bray
  • New York State Chief Information Officer and Director of the Office of Information Technology Services Dru Rai
  • New York State Police Superintendent Steven G. James
  • New York State Health Commissioner Dr. James McDonald
  • Senator Chuck Schumer
  • Senator Kirsten Gillibrand
  • Assemblymember Steve Otis

Read more