EPA, FBI, CISA, NSA Issue Joint Cybersecurity Advisory to Water System Regarding Iranian-Affiliated Cyber Attacks Advisory contains information to promote resilience, ensure safety of Americans drinking water WASHINGTON – U.S. Environmental Protection Agency (EPA), the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) issued a joint advisory warning to U.S. organizations, including those in the water sector, for an urgent and ongoing Iranian-affiliated cybersecurity threat. U.S. organizations are experiencing exploitation and, in some cases, disruption of commonly used operational technology at drinking water and wastewater systems that are diligently working to ensure that Americans can rely on clean and safe water. “Cybersecurity threats are a serious concern for our nation’s water infrastructure, including the communities, businesses, hospitals, and other critical infrastructure sectors that rely on these critical lifeline services,” said EPA Assistant Administrator for Water Jess Kramer. “Water systems are encouraged to stay informed and work to adopt cybersecurity best practices.” “Cyberattacks on drinking water and wastewater systems directly threaten public health and community resilience. A single breach can disrupt treatment or introduce contaminants, damage equipment, and erode public trust, said EPA Assistant Administrator for Enforcement and Compliance Assurance Jeffrey A. Hall. “EPA enforcement safeguards our nation’s critical infrastructure, including water systems, by ensuring compliance with applicable safety, maintenance, resilience, and security requirements and by rapidly correcting vulnerabilities. We also work with our law enforcement partners to disrupt attacks and to hold those responsible accountable. Our national security depends on water systems not only taking security seriously but also immediately reporting any incidents and working with our investigators to address them while protecting the public.” The joint cybersecurity advisory includes information to help water systems identify specific vulnerabilities that are being exploited and take concrete steps to strengthen cyber resilience. It also