The EPA Is Seeking Funding to Improve the Cybersecurity of America’s Water Systems

Environmental Protection Agency Administrator Michael Regan told Congress that the agency was "laser focused" on the growing threat of cyberattacks targeting municipal water and wastewater systems and was requesting over $4 billion to upgrade nationwide water infrastructure. 

Regan said the budget request includes $50 million for a new grant program supporting resiliency and sustainability efforts across public water systems, as well as $25 million for another grant program meant to support water systems as they establish and build necessary cyber capabilities. The budget request also includes $35 million to provide water and wastewater systems with technical assistance.

"What I can say is we are not in the business of abdicating our responsibility to anyone else," Regan told an environmental subcommittee of the House Committee on Energy and Commerce, adding: "We take cybersecurity in the water space very seriously."

The lack of training, technical expertise and resources to support modern cybersecurity capabilities at water systems nationwide—particularly in underserved communities and parts of the country with smaller water systems—were highlighted last year when cybercriminals gained remote access to a water treatment facility in Florida and attempted to poison the water supply. 

The White House emphasized the importance of securing water systems earlier this year when it tasked the EPA and the Cybersecurity and Infrastructure Security Agency with improving water sector cybersecurity as part of a series of 100-day initiatives to enhance industrial control systems in critical infrastructure industries. The Water and Wastewater Sector Action Plan establishes a task force of water and wastewater leaders, expands information sharing and implements pilot projects with the goal of creating innovative cyber solutions for the entire sector. 

Homeland Security Secretary Alejandro Mayorkas said CISA and EPA will "provide guidance, technology, and direct support as they improve their cybersecurity resilience" for the water sector when announcing the initiative earlier this year.

The administration is also working with the EPA on drafting legislation to support increased regulation and oversight of water systems.

Regan, who previously served as the environmental regulator in North Carolina, said he was acutely aware of the significant vulnerabilities that can be found within water systems. 

"Most states don't really have a good understanding of the cyber protective measures that are in place and how vulnerable they are," Regan said. "This is a priority for us, and we're laser-focused on it."