On Aug. 5, the American Water Works Association submitted a letter to Congressional leaders urging strong federal support for water utilities following cyber attacks on multiple water systems in recent weeks.
“Recent cybersecurity attacks on water utilities across multiple states underscore the need to further support drinking water and wastewater utilities as critical infrastructure,” AWWA CEO David LaFrance wrote in the letter to U.S. House and Senate leadership. “Water utilities are often out of sight and out of mind – historically under-resourced compared to other critical infrastructure sectors – despite their central role in daily life, the economy, and public health.”
Cyber attacks underscore risk for water sector as PLC device advisory issued
The letter encouraged federal funding for critical cybersecurity needs, expansion of eligibility under existing programs to include cybersecurity training for utilities of all sizes, information-sharing among key agencies, and a collaborative process, with input from water sector and cybersecurity experts, in developing sensible regulation that accounts for the variability in size and complexity of all water systems.
AWWA expressed support for cybersecurity measures included in the Senate’s Water Resources Development Act of 2026 (S. 4949), including:
- Reauthorization of the Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability Program.
- Cybersecurity training as an eligible use of funds in:
- the Drinking Water Infrastructure Resilience and Sustainability Program and,
- the Innovative Water Infrastructure Workforce Development Program.
- A program to design, construct, or maintain digital infrastructure technology, including through cybersecurity risk mitigation training and technical assistance, for rural water systems and systems in areas experiencing critical water supply needs.
- A program to encourage participation in the communications and intelligence sharing organization WaterISAC.
AWWA also asked Congress to consider additional measures, including:
- Water Risk and Resilience Organization Establishment Act (H.R. 2594), which establishes an independent, nongovernmental organization to develop minimum cybersecurity requirements for the water sector with oversight by EPA.
- State and Local Cybersecurity Grant Program Reauthorization Act (S. 3251), which reauthorizes the SLCGP to help state and local governments address cybersecurity risks.
- Cybersecurity for Rural Systems Act (H.R. 2109/S. 1018), which expands the U.S. Department of Agriculture’s successful Circuit Rider Program to include cybersecurity.
- Protecting America from Cyber Threats Act (S. 2983), which reauthorizes the Cybersecurity Information Sharing Act of 2015 for an additional 10 years.
Recent events have placed renewed emphasis on the importance of water utilities as critical infrastructure.
“We respectfully urge Congress to provide the support utilities have long needed for continued cybersecurity investment in their systems,” LaFrance added in the letter. “AWWA is ready and eager to continue serving as a partner and resource on water system cybersecurity.”
The complete letter from AWWA can be found here.
Recent CISA Recommendations
The Cybersecurity and Infrastructure Security Agency (CISA) said it is currently observing a significant increase in cyber threat actors targeting PLC devices in the water and wastewater sector. The agency said threat actors targeting exposed PLCs have modified passwords to lock out operators and have disconnected the PLCs by changing their IP addresses.
CISA is urging critical infrastructure owners, operators and integrators to remove publicly exposed programmable logic controllers (PLC) devices and other operational technology (OT) from the internet as soon as possible.
The Association of Metropolitan Water Agencies (AMWA) also said it strongly encourages members to review the recent CISA advisory and follow mitigation recommendations, notable removing PLC devices from the public internet.
AMWA also pointed members to the Water Information Sharing and Analysis Center (WaterISAC), which has also provided a number of alerts and resources to its members recently outlining the latest developments and recommended response actions.
Source/s: AWWA, CISA, AMWA
Leave a Reply