In a hearing in early April, the American Water Works Association (AWWA) testified on the issue of cybersecurity before the House Committee on Homeland Security, asserting a new approach is needed that “sets minimum cybersecurity standards for all types of water systems.”
The hearing was titled “Mobilizing our Cyber Defenses: Securing Critical Infrastructure Against Russian Cyber Threats” and included experts from multiple sectors, including water. AWWA Federal Relations Manager Kevin Morley testified on behalf of AWWA, which represents 50,000 water professionals across the United States and beyond.
AWWA’s testimony comes amid the ongoing war in Ukraine that has increased concerns about a potential Russian retaliation to U.S. sanctions that may come in the form of a cyberattack.
High Tech, High Stakes: How Vulnerable to Cyberattacks Is U.S. Water Infrastructure?
“The current threat situation illustrates both the necessity and strength of continuous two-way engagement and the value of partnership that is necessary to jointly manage cyber threats facing our nation,” Morley said.
Morley said the water sector could model a regulatory approach that is similar to the electric sector, with a tiered risk- and performance-based set of requirements. Federal oversight and approval of requirements would be provided by the EPA, given its existing statutory role in the water sector.
“AWWA stands ready to work with Congress, the sector and federal partners to implement a strategy that supports sustainable cybersecurity protection that recognizes the variability of water systems across the nation,” he said.
The testimony commended the U.S. Cybersecurity and Infrastructure Security Agency (CISA) for its recent work to alert organizations such as AWWA to Russian cyber threat activities so that information could be shared immediately with water utilities. Morley expressed support for CISA’s ongoing “Shields Up” campaign, while also stressing the need for advisories to provide concise and actionable information. He also highlighted a broad suite of AWWA cybersecurity resources that were developed in collaboration with federal partners.
“AWWA’s utility members represent water systems large and small, municipal and investor-owned, urban and rural. We protect public health and the environment and enhance the quality of life. In the modern era of water utility operations, our mission also includes managing cybersecurity risks that may threaten the essential lifeline function that water professionals provide,” Morley said.