On March 3, 2023, the U.S. Environmental Protection Agency (EPA) issued a memorandum to help improve the cybersecurity posture guarding the nation’s water filtration systems. The guidelines, developed with input from industry experts and various government agencies, provide recommendations for utilities to improve their security and reduce the risk of cyber-attacks. These guidelines indicate that the EPA will aggressively enforce stringent cybersecurity standards in the future.
EPA will require states to survey the digital networks governing drinking water filtration operations. This follows a slew of cyber-attacks targeting critical infrastructure in the U.S.
Cyber-attacks on critical infrastructure, particularly water systems, have become more and more frequent in recent years, and the pandemic has only increased the risk. Last year, a cyber-attack on a Florida water treatment plant raised national concerns about the vulnerability of the nation’s infrastructure.
The new guidelines recommend that water systems create a cybersecurity plan that includes a risk assessment, contingency plans, incident response procedures, and employee training. The guidelines also encourage water systems to work with government agencies, such as the Department of Homeland Security and the Federal Bureau of Investigation, to stay up to date on the latest threats and best practices.
“As cyber threats to critical infrastructure continue to increase, it is critical that we take action to protect our drinking water and wastewater systems,” said EPA Administrator Michael S. Regan. “These new guidelines will help ensure that our public water systems are more resilient and better equipped to defend against cyber-attacks.”
The EPA is encouraging all public water systems to review and implement the new guidelines as soon as possible. By taking proactive steps to improve cybersecurity resilience, public water systems can help protect the health and safety of their communities.
