By Tom Leithauser State utility regulators next week plan to consider a resolution calling on Congress to take steps to shore up the cyber defenses of water utilities.
In September 2026, CISA announced that it will scale back the free assessments it offers to critical infrastructure organizations, like water and wastewater utilities,” it says.
Congress should also “authorize the U.S. Environmental Protection Agency (EPA) to create an independent, non-governmental Water Risk and Resilience Organization (WRRO) comprised of sector experts to develop minimum cybersecurity requirements for water and wastewater utilities,” according to the resolution.
It notes that “the absence of uniform cybersecurity standards for water utilities leaves too many systems vulnerable, as evidenced by recent cybersecurity attacks on multiple water utilities in at least 12 states” (CPR, Oct. 20).
Water and wastewater utilities “are squarely in the sights of domestic and international threat actors seeking to disrupt essential services or engage in criminal activities through cybersecurity attacks,” but many of those utilities “lack even basic cybersecurity protections,” the resolution warns.