EPA to require states to review, report cybersecurity threats to public water systems

Cybersecurity public water threat overview:

• Who: The U.S. Environmental Protection Agency (EPA) has released a memo stressing the need for states to audit the cybersecurity risk to their drinking water systems.
• Why: The memo comes as the White House called for increased cybersecurity across all critical infrastructure. 
• Where: The cybersecurity public water threat memo applies to the United States.

The U.S. Environmental Protection Agency (EPA) has released a memo stressing the need for states to immediately audit the cybersecurity threat to their public water systems in order to protect residents’ drinking water. 

The memo was released March 3, a day after President Joe Biden’s administration released a plan calling for boosted security standards for critical infrastructure.

According to the EPA memo, while some public water systems had taken important steps to improve their cybersecurity, a recent survey — and reports of cyberattacks — showed many had not adopted basic cybersecurity best practices and are at risk of cyberattacks.

Cyberattacks could come from individuals, criminal collectives or sophisticated state or state-sponsored actors, the memo said. 

“Cyber-attacks against critical infrastructure facilities, including drinking water systems, are increasing, and public water systems are vulnerable,” EPA Assistant Administrator for Water Radhika Fox said in the memo.

“Cyber-attacks have the potential to contaminate drinking water, which threatens public health.” 

EPA calls for security audit of all drinking water systems

The memo said EPA was taking action to protect public water systems by now requiring states to audit the cybersecurity practices of their local water systems.

“Americans deserve to have confidence in their water systems’ resilience to cyber attackers,” Deputy National Security Advisor for Cyber and Emerging Technologies Anne Neuberger said in the memo. 

“The EPA’s new action requires water systems to implement adequate cybersecurity to provide that confidence … The EPA’s action is another step in the [Biden] Administration’s relentless focus on improving the cybersecurity of critical infrastructure by setting minimum cybersecurity measures for owners and operators of the water … and other critical services Americans rely on.”

The EPA said states must include cybersecurity when they conduct periodic audits of water systems.

The announcement came a day after the debut of a new federal cybersecurity strategy that calls for holding critical infrastructure operators responsible for following a minimum set of security standards.

The EPA also recently made public its plans to reduce toxic perfluoroalkyl and polyfluoroalkyl substances (PFAS) in the nation’s waterways, focusing on runoff from industrial sources. 

What do you think of the call to strengthen the cybersecurity around drinking systems? Let us know in the comments! 

Read About More Class Action Lawsuits & Class Action Settlements:

• Supreme Court to consider constitutionality of Consumer Financial Protection Bureau
• Benton Harbor residents claim genocide convention should prevent contaminated water case dismissal
• U.S. Marshals reports ‘major’ data breach that compromised sensitive information
• Class actions keep coming after East Palestine train derailment