EPA takes action against cyber threats with enforcement measures

TLDR:

• EPA issued an enforcement alert on cybersecurity threats to community drinking water systems
• Mandatory steps have been outlined to comply with the Safe Drinking Water Act

The U.S. Environmental Protection Agency (EPA) has issued an enforcement alert highlighting urgent cybersecurity threats and vulnerabilities to community drinking water systems. The alert emphasizes the need to comply with the Safe Drinking Water Act and take immediate action to protect against cyberattacks. Recent EPA inspections revealed that many water systems are not fully compliant with requirements, posing critical cybersecurity vulnerabilities. The agency is ramping up inspections and enforcement activities, urging system operators to take steps to secure water systems, such as reducing exposure to the internet, changing default passwords, and conducting regular cybersecurity assessments. EPA is working closely with state and federal partners to develop strategies to mitigate cybersecurity risks and offering technical assistance to the water sector. The agency is committed to ensuring the cybersecurity of water and wastewater systems nationwide and is encouraging collaboration between federal and state entities to address cyber threats effectively.

Additionally, EPA Administrator Michael S. Regan and National Security Advisor Jake Sullivan have called on governors to develop comprehensive strategies to enhance cyber-resilience in their states’ water systems. The National Security Council is urging states to prepare action plans to address cybersecurity vulnerabilities by late June. EPA is establishing a Task Force with coordinating councils to implement near-term actions and strategies to reduce the risk of cyberattacks on water and wastewater systems. The agency is providing cybersecurity technical assistance, guidance, tools, resources, and training to help water systems safeguard against cyber threats. EPA’s Cybersecurity Evaluation program will continue to conduct assessments for small water systems to ensure cybersecurity readiness. For more information on EPA’s efforts to protect drinking water and combat cyber threats, visit the agency’s website.