New York Implements Stricter Cybersecurity Regulations for Water Utilities

News Summary

New York has announced new cybersecurity regulations for water and wastewater utilities to enhance public service security. Governor Kathy Hochul revealed a $2.5 million grant initiative to help utilities comply with these regulations, which include annual vulnerability analyses and incident response plans. The task force, comprised of health, environmental, and public service representatives, emphasized the need for formal cybersecurity programs amid rising cyberattack incidents. With 9% of public drinking water systems showing vulnerabilities, these initiatives aim to strengthen New York’s infrastructure against evolving cyber threats.

New York has announced the implementation of stricter cybersecurity regulations for water and wastewater utilities, a response to increasing vulnerability within essential public services. Governor Kathy Hochul unveiled the new standards as part of a broader initiative to protect public drinking water systems. The regulations are slated to be phased in over the next few months and will apply to utilities that serve populations exceeding 3,300 individuals.

To aid utilities in complying with these new requirements, the state has introduced a $2.5 million grant initiative known as the Cyber Resilience Grant Program for Water Systems. The program aims to offset costs associated with implementing enhanced cybersecurity measures.

The proposed regulations were shaped by a dedicated task force comprising representatives from the state’s health, environmental conservation, and public service departments. They have identified several key requirements that will be mandatory for utilities to implement, including:

• Annual cybersecurity vulnerability analyses.
• Establishment of formal cybersecurity programs.
• Creation of incident response plans.
• Compliance with new incident reporting protocols.
• Training for staff on cybersecurity hygiene.

Utilities that serve larger populations of over 50,000 people will face additional responsibilities, such as designating specific personnel to oversee cybersecurity programs and consistently monitoring network activities. These regulations come in light of a worrying trend, as a report from the Environmental Protection Agency’s Office of Inspector General revealed that 9% of public drinking water systems exhibited critical or high cybersecurity vulnerabilities.

Colin Ahern, New York’s chief cyber officer, has pointed out that the state previously lacked formal requirements regarding incident response plans and timely vulnerability identification for utilities. The implementation of these new regulations is seen as a critical step toward bolstering the cybersecurity framework of infrastructure that is essential for public health.

New York has been proactive in investing in its clean water infrastructure, allocating $6 billion since 2017. That investment is now coupled with heightened awareness of cybersecurity threats, particularly against vulnerable water systems. Recent months have seen a rise in cyberattacks targeting water utilities, including incidents involving Russian hacking groups as well as breaches noted at the American Water Works Company in New Jersey.

The task force has taken guidance from performance goals established by the Cybersecurity and Infrastructure Security Agency (CISA) when formulating the state’s new cybersecurity regulations. This collaborative effort underscores the need for a comprehensive approach to protect critical infrastructure from evolving threats.

Ahern has further indicated that there is a pressing need for the federal government, especially CISA, to improve its effectiveness in safeguarding critical infrastructure from cyber threats. The attention on federal leadership in this area is reflected in recent Senate discussions regarding the selection of a candidate for CISA’s director, emphasizing a national focus on bolstering cybersecurity measures.

As New York moves forward with these regulations, the focus remains on ensuring the safety and reliability of drinking water while mitigating the risks associated with cybersecurity vulnerabilities. The comprehensive approach taken by the state reflects an enhanced commitment to protecting essential services against the backdrop of an increasingly complex cyber landscape.

Deeper Dive: News & Info About This Topic

• StateScoop: New York Water Utility Cyber Regulations 2025
• GovTech: N.Y. Secures Water Systems with Cyber Grants, Regulations
• CBS6 Albany: Governor Hochul Unveils Cybersecurity Measures for Water Systems
• Google Search: New York water cybersecurity regulations
• Encyclopedia Britannica: Cybersecurity