Download PDF

The United States Environmental Protection Agency (“EPA”) issued a memorandum on October 11th titled:

Withdrawal of Cybersecurity Memorandum of March 3, 2023 (“Withdrawal Memorandum”)

The Withdrawal Memorandum was transmitted from EPA Assistant Administrator for Water, Radhika Fox, to the State Drinking Water Administrators and Water Division Directions.

The Withdrawal Memorandum rescinds an interpretive memorandum issued by EPA on March 3, 2023, titled:

Addressing Public Water System Cybersecurity in Sanitary Surveys of an Alternate Process (“Memorandum”)

The EPA Memorandum expressed concern that some public water systems (“PWS”) had failed to adopt basic security best practices. It further purported to clarify that states must:

. . . evaluate the cybersecurity of operational technology used by a PWS when conducting PWS sanitary surveys or through other state programs.

The Memorandum provided what EPA characterized as “various approaches” to include cybersecurity in PWS sanitary surveys or other state programs.

The Arkansas, Missouri, and Iowa state Attorney Generals filed on April 17th a Petition for Review (“Petition”) in the United States Court of Appeals for the Eighth Circuit challenging the Memorandum. Their Petition argued that the Memorandum was in fact a rule that was promulgated without the required public notice procedures. Trade associations such as the American Water Works Association and National Rural Water Association also filed petitions challenging the Memorandum.

The Eighth Circuit subsequently granted a stay of the EPA Memorandum.

EPA states in the October 11th Withdrawal Memorandum that due to the litigation it has chosen to rescind the Memorandum. As a result of this action, the federal agency further states that the Memorandum’s rescission means that this interpretation is now withdrawn from its public water system supervision program.

A copy of the Withdrawal Memorandum can be downloaded here.