New York Approves Cybersecurity Rules for Water and Wastewater Systems
Summary
New York’s new rules require community water systems serving more than 3,300 people to adopt cybersecurity measures, with added requirements for larger systems. The state is offering grants and technical assistance to support compliance.
Key points
- The regulations apply to community water systems serving more than 3,300 people, with additional requirements for systems serving more than 50,000.
- Requirements include cybersecurity training for certified operators, incident response and tested recovery plans, reporting, and a designated cyber lead for larger utilities.
- New York established a $2.5 million grant program and offers free technical assistance, including up to $50,000 for assessments and $100,000 for upgrades.
- Officials cited escalating nation-state threats, including China’s Volt Typhoon campaign, as a reason for state action.
- New York worked with the EPA and CISA to align the rules with federal guidance and avoid duplicative requirements.
Article Details
- Event Type
- New York approved cybersecurity regulations for community water and wastewater systems.
- Impact
- Systems serving more than 3,300 people must meet the new requirements by year’s end; systems serving more than 50,000 people face additional requirements. Measures include operator cybersecurity training, incident response and tested recovery plans, reporting, and a designated cyber lead for larger utilities. New York is providing a $2.5 million grant program, free technical assistance, and up to $50,000 for assessments and $100,000 for upgrades.
People
Barbara Van EppsExecutive director of the New York Conference of Mayors; she noted the importance of financial support to help local-government-run water and wastewater systems strengthen cyber defenses.James McDonaldCommissioner at the New York State Department of Health; he discussed the importance of safeguarding digitized drinking-water infrastructure and preparing public water systems to respond to potential incidents.Michaela LeeActing chief cyber officer for New York; she described the state’s rationale for acting amid intensifying cyber threats and referenced Volt Typhoon as a threat affecting New York water systems.
Threat Actors
Countries
ChinaThe state is providing a $2.5 million grant program plus up to $50,000 for assessments and $100,000 for upgrades and is acting in response to escalating nation-state threats such as China’s Volt Typhoon.United StatesFederal cyber investigators continue to find Chinese state hackers breaking into critical infrastructure across the U.S.