technician working at desk with dual monitor opened up to a wastewater cybersecurity project

Wastewater Cybersecurity Resources

Notice of Proposed Rule Making, Proposed Amendments to 6 NYCRR Parts 616, 650, and 750 – Wastewater Cybersecurity Rules

DEC published a Notice of Proposed Rule Making with the New York State Department of State on June 25, 2025 to amend 6 NYCRR Parts 616, 650, and 750. The proposed rule making would add cybersecurity regulations for wastewater treatment facilities.

Copies of the documents for the proposed rule making, along with the Express Terms (text of proposed rule), are available on DEC's website. 

The public comment period for the proposed rule making ended on September 3, 2025.

Cybersecurity is a critical part of safeguarding our essential infrastructure, yet the vast amount of information available can be overwhelming. These resources streamline and highlight key sector-specific guidance, tools, and trainings to help regulated wastewater facilities enhance their cyber resilience. Here you will find information tailored to sector needs, links to relevant federal and state resources, and updates on training opportunities to build your cybersecurity awareness and capabilities.

Free Cybersecurity Assessments and Services

According to the EPA, less than 25% of water and wastewater operators surveyed perform annual cybersecurity risk assessments. Did you know that free resources are available to help utilities become more cyber aware and resilient? 

Utilities are strongly encouraged to take advantage of free cybersecurity assessments offered by agencies like NY DHSES, EPA, CISA, and other partners. These assessments offer valuable insights into vulnerabilities, help identify other areas or improvements, and offer actionable recommendations  to strengthen your facility’s defenses—all at no cost to the utility. 

New York Division of Homeland Security and Emergency Services (DHSES), Cyber Incident Response Team (CIRT) offers several programs aimed at helping organizations improve their cybersecurity.  These programs are outlined below and are available at no cost to local governments, non-Executive State agencies, and public authorities. See Cybersecurity Services | Division of Homeland Security and Emergency Services. 

These free programs include:

ResourceDescription
Cybersecurity Risk AssessmentsThis program provides actionable recommendations to improve cybersecurity posture.  The final report from the assessment team consolidates vast amounts of threat and vulnerability information into a handful of action-oriented, prioritized findings for information technology (IT), business, and leadership teams to remediate.  The final report is protected pursuant to the federal Department of Homeland Security’s Protected Critical Infrastructure Information (PCII) program.
Phishing AssessmentsCIRT will provide a simulated phishing attack for eligible organizations to help them assess the effectiveness of their email security training.  At the conclusion of a phishing engagement, targeted training with various learning modules, including modules that educate users on how to spot phishing messages can be provided.  CIRT will then deliver a report showing how many users were deceived by the phishing emails, to what extent they interacted with the suspect emails, and how many completed the training.
Tabletop ExercisesCIRT will facilitate a three-hour tabletop exercise that will walk the organization through a mock incident and test its cyber incident response plans and preparations.  These exercises are customized by CIRT staff to reflect the organization's unique structure and resources and can help drive improvements in existing plans and procedures.  The scenarios used in these exercises are based on real world incidents that have impacted government entities in New York State.

United States Environmental Protection Agency (EPA) offers Technical Assistance and Cybersecurity Evaluation programs.
ResourceDescription
Cybersecurity Technical Assistance Program for the Water SectorPrimacy agencies, drinking water and wastewater systems, circuit riders, and technical assistance providers can submit a question and/or a request for consultation regarding cybersecurity.
EPA’s Water Sector Cybersecurity Evaluation ProgramThe EPA will conduct a free cybersecurity assessment for Water/Wastewater Systems (W/WSs) to identify gaps or vulnerabilities in information technology (IT) and operational technology (OT) using the EPA Cybersecurity Checklist. More information is available in this brochure.
EPA Cybersecurity Training and Tabletop ExercisesLearn about cybersecurity basics for water systems, how to conduct a cyber risk assessment, find out about upcoming cybersecurity training for drinking water and wastewater systems and request training. In addition, EPA’s Tabletop Exercise Tool (TTX) provides users with the resources to plan, conduct and evaluate tabletop exercises. Tabletop exercises practice, test and help improve emergency response plans and procedures. Use this tool to develop customized, scenario-driven tabletop exercises for your utility

Cybersecurity Infrastructure and Security Agency (CISA) offers no-cost, in-house cybersecurity services designed to help individuals and organizations build and maintain a robust and resilient cyber framework.
ResourceDescription
CISA Cyber Vulnerability Scanning for Water and Wastewater UtilitiesCISA can help your drinking water and wastewater system identify and address vulnerabilities with a no cost vulnerability scanning service subscription. CISA, the Water Sector Coordinating Council, and the Association of State Drinking Water Administrators encourage drinking water and wastewater utilities to use this service.
CISA's Cyber Hygiene services Help secure internet-facing systems from weak configurations and known vulnerabilities.
CISA's Critical Infrastructure Cybersecurity Shared Services Program

This provides free scalable commercial cybersecurity shared services that detect cybersecurity threats and mitigate vulnerabilities to critical infrastructure organizations, including those in the water and wastewater sector. Services include:

  • Protective DNS – a customizable network traffic filter that disallows known-malicious websites or servers from being accessed on a customer’s environment
  • SCuBA – guidance to support cloud information through effective and manageable security configurations
  • Malcolm – a threat detection and network traffic analysis toolset that provides a centralized logging, monitoring and investigation platform
  • Logging Made Easy – a log management toolset that alerts administrators of potentially harmful activity on their systems

 

Additional Cybersecurity Resources

In addition to the free cybersecurity assessments and services detailed above, there are numerous additional resources that may be helpful for wastewater utilities, including cybersecurity training resources for wastewater operators.

ResourceDescription
Incident Response Guide: Water and Wastewater SectorJointly published in January 2024 by the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Environmental Protection Agency, (EPA), the Incident Response Guide (IRG) provides WWS Sector owners and operators information about the federal roles, resources, and responsibilities for each stage of the cyber incident response (IR) lifecycle. Sector owners and operators can use this information to augment their respective IR plans and procedures. Familiarity with this information will better prepare WWS utilities to respond to—and recover from—a cyber incident.
Develop or Update an Emergency Response Plan | Spanish Version (PDF)An emergency response plan (ERP) describes strategies, resources, plans, and procedures utilities can use to prepare for and respond to an incident, natural or man-made. A template (MS Word) is available, along with instructions for using the template to build out an ERP.
Cybersecurity Incident Action ChecklistFor on-the-go convenience, the actions in this EPA checklist are divided up into three “rip & run” sections and provide a list of activities that water and wastewater utilities can take to prepare for, respond to and recover from a cyber incident.
EPA Water Utility Communication During Emergency ResponseThis webpage from the EPA provides support resources on public messaging during emergencies.
EPA Incident Action Plan ChecklistThis EPA webpage provides a multitude of EPA checklists intended to help utilities prepare for, respond to, and recover from specific emergencies such as wildfires, power outages, floods, and cybersecurity incidents.

Physical security is a critical pillar in the protection of Operational Technology (OT) cybersecurity, as a compromised physical site can allow an attacker to bypass all digital defenses. If unauthorized personnel gain direct access to OT devices, they can introduce malware, steal sensitive data, or even sabotage critical industrial processes. The below resources highlight key sector-specific guidance and tools  to help regulated wastewater facilities enhance their physical resilience.  

ResourceDescription
Cybersecurity and Infrastructure Security Agency (CISA) Unmanned Aircraft System (UAS) Detection Technology Guidance for Critical InfrastructureThis guidance addresses aerial threats posed by Unmanned Aircraft Systems (UAS) e.g. Drones. Malicious actors may use UAS for activities such as smuggling, surveillance, theft, harassment, and cyber or physical attacks. It includes key steps to assist when considering UAS detection technology.
Cybersecurity and Infrastructure Security Agency (CISA) Cybersecurity and Physical Security ConvergenceThis publication highlights the importance of having a threat management strategy that reflects in-depth understanding of the cascading impacts to interconnected cyber-physical infrastructure.
Cybersecurity and Infrastructure Security Agency (CISA) Security Planning WorkbookThis resource can assist critical infrastructure owners and operators with the development of a foundational security plan.
Cybersecurity and Infrastructure Security Agency (CISA) Suspicious Activity and Items Resource WebpageThis webpage provides resources, trainings, and tools to assist on learning how to recognize unusual behaviors and suspicious items typically associated with Improvised Explosive Device (IED) threats.

ResourceDescription
WaterISAC’s Cybersecurity Fundamentals for Water and Wastewater Utilities: Small Systems Guidance CompendiumThe 12 Cybersecurity Fundamentals for Water and Wastewater Utilities was completed in December 2024 and published under a single cover in May 2025. This special edition compendium specifically incorporates the Small Systems Guidance from the 12 Cybersecurity Fundamentals for Water and Wastewater Utilities
Small System Risk and Resilience Assessment Checklist | Spanish Version (PDF)A risk and resilience assessment (RRA) can help  utilities systematically assess threats from malevolent acts and natural hazards that could threaten water or wastewater service. This guidance is intended for small water or wastewater systems serving fewer than 50,000 people. For larger water or wastewater systems, EPA recommends the Vulnerability Self-Assessment Tool (VSAT) Web 3.0 or an alternate risk assessment method. 

EPA Cybersecurity Procurement Evaluation ChecklistThe Cybersecurity Procurement Evaluation Checklist helps water and wastewater utilities assess the cybersecurity practices of vendors, manufacturers, and service providers. It includes a checklist specifically for Integrators and Managed Service Providers (MSPs) designed for companies that manage and deliver IT services and products to utilities. 
DHS Cyber Security Procurement Language for Control SystemsThis document provides information and specific examples of procurement language text to assist the control systems community, both owners and integrators, in establishing sufficient control systems security controls within contract relationships to ensure an acceptable level of risk.
CISA’s Secure By Design Pledge This page lists progress reports from companies who have taken CISA’s Secure by Design Pledge. By taking the pledge, companies have committed to making a good-faith effort towards seven key goals related to Secure by Design. Secure by Design is a component of the EPA Cybersecurity Procurement Evaluation Checklist listed above.

Cybersecurity and Infrastructure Security Agency (CISA) Public Safety Communications and Cyber Resiliency ToolkitThis Public Safety Communications and Cyber Resiliency Toolkit to assist public safety agencies and others responsible for communications networks in evaluating current resiliency capabilities, identifying ways to improve resiliency, and developing plans for mitigating the effects of potential resiliency threats.
EPA Telecommunications During Power OutagesThis EPA guide provides information to help water utilities diversify their telecommunications plans and equipment and help ensure they can continue to communicate with employees, response partners, and customers during a prolonged power outage.
EPA Position Navigation and Timing Risks for Water and Wastewater UtilitiesThis user-friendly fact sheet from the EPA provides a high-level description of the Water Sector’s use of Positioning, Navigation, and Timing Services as well as their risks and potential mitigation considerations.
Top 8 Cyber Actions for Securing Water and Wastewater Systems | Spanish Version (PDF)This fact sheet highlights the top cyber actions Water and Wastewater Systems Sector entities (referred to as “water systems”) can take today to reduce cyber risk and improve resilience to cyberattacks and provides free services, resources, and tools to support these actions, which can be taken concurrently
NY WARNNYWARN is a statewide Water/Wastewater Agency Response Network (WARN) designed to provide utility to utility response during an emergency. The NYWARN program is a mutual aid network that provides its member utilities with emergency planning and response and recovery information before, during and after an emergency. 
Vulnerability Self-Assessment Tool: Conduct a Drinking Water or Wastewater Utility Risk Assessment | US EPA

VSAT Web 3.0 is a user-friendly tool  that can help drinking water and wastewater utilities of all sizes to conduct a risk and resilience assessment. With VSAT Web, a utility can:

  • Identify the highest risks to mission-critical operations and
  • Find the most cost-effective measures to reduce those risks    
12 Cybersecurity Fundamentals for Water and Wastewater Utilities Water ISAC publishes its "12 Cybersecurity Fundamentals for Water and Wastewater Utilities" on a quarterly basis, releasing three fundamentals per quarter, meaning the full set is released throughout the year. This process ensures that the “12 Fundamentals” remains relevant and manageable, allowing water and wastewater utilities to easily digest and implement new security practices without being overwhelmed by a large single update.
AWWA Water Sector Cybersecurity Risk Management ToolThe AWWA Water Sector Cybersecurity Risk Management Tool is designed to support utilities in developing their cybersecurity risk management strategy while also facilitating compliance with the cybersecurity provisions in §2013 of America’s Water Infrastructure Act (AWIA) of 2018. The risk and resilience assessment must consider malevolent and natural hazards that may impact critical assets, including assets that may be vulnerable to cyber threats.
Principles for the Secure Integration of Artificial Intelligence in Operational TechnologyThis guidance aims to help critical infrastructure owners and operators integrate artificial intelligence (AI) into operational technology (OT) systems securely, balancing the benefits of AI—such as increased efficiency, enhanced decision-making, and cost savings—with the unique risks it poses to the safety, security, and reliability of OT environments.
Guidance on Secure Connectivity Principles for Operational Technology (OT) (CISA and the UK National Cyber Security Centre, in collaboration with other federal and international partners)This guidance provides owners and operators with eight principles to use a framework to design, secure, and manage connectivity into OT environments.
Dragos's Community Defense Program

Dragos's Community Defense Program provides *qualified US-based water, electric, and natural gas providers with free access to their OT cybersecurity technology to help improve security postures and reduce OT risk.

The Community Defense Program access includes:

  • Access to the Dragos Platform
  • Membership into OT-CERT
  • Dragos Academy
  • Neighborhood keeper's Collective Defense/CDP Threat Hunting

*Qualification Summary:

  • The utility must be US based water, electric, and/or natural gas utility
  • Must not be owned by a parent company that exceeds $100 Million US in revenue.
  • In the case of a municipality owned wastewater facility, the qualifying determination would be off the municipality's annual revenue.

Provider/CourseDescription
Recommended: Basic Cybersecurity Measures for Water and Wastewater Systems

In this course, participants will learn about water sector threats, basic cybersecurity measures, incident response, system resilience, and valuable resources, with the goal of fostering a culture of cybersecurity within their organizations.

Regardless of the size of the system, this course empowers everyone, from field workers to office staff, to contribute to maintaining a reliable and resilient water system.

This course was developed with MassDEP funding through a partnership with UMass. The course content was created by Andrew Hildick-Smith and is hosted by wateroperator.org.

2025 RTC Number: 25347-25 (1 contact hour)

2026 RTC Number: 26193-26 (1 contact hour)
 

EPA Cybersecurity Trainings

This page includes upcoming cybersecurity trainings as well as recorded trainings. Approved EPA trainings include:

  • Cybersecurity 101 Webinar: Recorded training. To receive the credit, operators must complete the post-training quiz and email it to [email protected]; operators will receive a certificate of completion within 3-5 business days. Retain this certificate for submission with your 5-year renewal application.
    2025 RTC Number: 25274-25 (0.5 contact hours)
    2026 RTC Number: 26194-26 (0.5 contact hours)
  • National Water and Wastewater Sector Cybersecurity Drill: multiple dates were offered in 2025; 2026 training dates are TBD.
    2025 RTC Number: 25362-25 (2 contact hours)
    2026 RTC Number: TBD
  • Cybersecurity 102: multiple dates were offered in 2025; 2026 training dates are TBD.
    2025 RTC Number:  25343-25 (1.5 contact hours)
    2026 RTC Number: 26195-26 (1.5 contact hours)
  • Cybersecurity 103: multiple dates were offered in 2025; 2026 training dates are TBD.
    2025 RTC Number: 25344-25 (1.5 contact hours)
    2026 RTC Number: 26196-26 (1.5 contact hours)
  • Water Cybersecurity Assessment Tool (WCAT): multiple dates were offered in 2025; 2026 training dates are TBD.
    2025 RTC Number: 25345-25 (2.5 contact hours)
    2026 RTC Number: 26197-26 (2.5 contact hours)
  • Cyber Refresher: multiple dates were offered n 2025; 2026 training dates are TBD.
    2025 RTC Number: 25346-25 (1 contact hour)
    2026 RTC Number: 26198-26 (1 contact hour)
American Water Works Association (AWWA) TrainingAWWA offers an online course entitled Cybersecurity in the Water Sector (EL264). This course is designed to provide water sector cybersecurity risk management training to the water sector. This course is also designed to teach participants how to use the AWWA Water Sector Cybersecurity Risk Management Tool (the Tool). This course is pre-approved for 2 Renewal Training Contact (RTC) hour for wastewater operators in New York.  Other risk and emergency planning courses offered by AWWA are also pre-approved. Pre-approved courses do not require an RTC number.
Tabletop Exercises (TTX)If your utility is planning to participate in a cybersecurity Tabletop Exercise (for example, through NY DHSES or EPA) please contact [email protected] for information on how to obtain RTC credits for certified wastewater operators who participate in the training.
Cyber Readiness Institute (CRI)

CRI offers the free course, Cyber Readiness Program, a self-paced video course designed to assist in improving cybersecurity risk management and response and recovery from a cybersecurity incident.

For wastewater utilities, there is an option to be paired with and receive support from a CRI Certified Cyber Coach to assist in completing the Cyber Readiness Program and utilizing a supplemental playbook.

The Cyber Readiness Program is pre-approved for 4 Renewal Training Contact (RTC) hours for wastewater operators in New York. Pre-approved courses do not require an RTC number.

EUCI - Cybersecurity Fundamentals for Water and Wastewater Utilities

This online course provides practical, actionable guidance for water and wastewater utility professionals, equipping participants with the knowledge to protect operations, reduce risk, and build a resilient cybersecurity culture. This course will teach foundational security measures, sector-specific best practices, and lessons from real-world incidents to safeguard public health and critical services.

Date: March 18-19, 2026

RTC Number: 26068-26 (9.25 contact hours)

AgencyRoleContact

New York Division of Homeland Security and Emergency Resources (DHSES) - State

 

DHSES oversees the Cyber Incident Response Team (CIRT). The CIRT provides both cyber incident response and proactive cybersecurity services, such as cybersecurity risk assessments and training, at no cost to eligible entities, including local governments, non-Executive state agencies, and public authorities.  

Cyber Incident Response Team | Division of Homeland Security and Emergency Services

 

 

 

Environmental Protection Agency (EPA) - FederalEPA is the Sector Risk Management Agency (SRMA) for the Waster and Wastewater Systems (WWS) Sector. As such, it leads the Federal effort to promote security and resilience, both physical and cyber, in water and wastewater systems and serves as a day-to-day Federal interface for coordination of sector-specific activities.Water and Wastewater Systems Sector Cybersecurity | US EPA
Cybersecurity Infrastructure and Security Agency (CISA) -- FederalPart of the Department of Homeland Security (DHS), CISA is the operational lead for federal cybersecurity and the national coordinator for critical infrastructure security and resilience.Water and Wastewater Systems | Cybersecurity and Infrastructure Security Agency CISA
Federal Bureau of Investigation (FBI) – Federal The FBI is the lead federal agency for investigating cyber attacks and intrusions. The rapid-response Cyber Action Team can deploy across the country within hours to respond to major incidents.

https://www.fbi.gov/investigate/cyber;  https://www.ic3.gov/  

 

Water Information Sharing and Analysis Center (WaterISAC) – National NonprofitProvides cybersecurity alerts best practices, and resources tailored to the water and wastewater sector; provides information sharing.WaterISAC
National Rural Water Association (NRWA) – National NonprofitThe National Rural Water Association (NRWA), in collaboration with the White House Office of the National Cyber Director (ONCD) and the United States Department of Agriculture (USDA), announced the Cybersecurity Circuit Rider Program Study in November 2024. The pilot program is being administered in Oregon and Vermont, but the plan is to eventually provide cybersecurity training for the Water Circuit Riders in all 50 states and Puerto Rico. 

nrwa.org/issues/cybersecurity/

 

Contact for this Page

DOW, Bureau of Water Permits, Wastewater Cybersecurity
625 Broadway, 4th Floor
Albany, NY 12233

This Page Covers
New York State
Icon