Cybersecurity Policy Report, Cyber Attacks Against Water Systems on Agenda for State Utility Regulators, (Nov 6, 2026)
State utility regulators next week plan to consider a resolution calling on Congress to take steps to shore up the cyber defenses of water utilities.
The resolution being presented to the National Association of Regulatory Utility Commissioners (NARUC) at its annual meeting would ask Congress to “remedy the funding shortfall” facing the Cybersecurity and Infrastructure Security Agency “to allow the agency to successfully fulfill its responsibilities and provide essential cybersecurity support to the nation’s water and wastewater utilities.”
“CISA is underfunded and understaffed, having lost roughly one-third of its workforce since 2025. In September 2026, CISA announced that it will scale back the free assessments it offers to critical infrastructure organizations, like water and wastewater utilities,” it says.
The resolution says it’s “essential to ensure CISA has sufficient resources and to enhance the Water Information Sharing and Analysis Center (WaterISAC) to directly support drinking water and wastewater companies by providing, promoting, and sharing voluntary operational, physical and cybersecurity-based information and best practices with the sector.”
Along with increasing funding for CISA, Congress should “clarify by statute that water utilities must share cyber-attack information with each other and the government and that such information is not subject to the Freedom of Information Act and public records inspection requests and that such information shall not be made public,” it says.
Congress should also “authorize the U.S. Environmental Protection Agency (EPA) to create an independent, non-governmental Water Risk and Resilience Organization (WRRO) comprised of sector experts to develop minimum cybersecurity requirements for water and wastewater utilities,” according to the resolution.
It notes that “the absence of uniform cybersecurity standards for water utilities leaves too many systems vulnerable, as evidenced by recent cybersecurity attacks on multiple water utilities in at least 12 states” (CPR, Oct. 20).
Water and wastewater utilities “are squarely in the sights of domestic and international threat actors seeking to disrupt essential services or engage in criminal activities through cybersecurity attacks,” but many of those utilities “lack even basic cybersecurity protections,” the resolution warns.
The resolution, sponsored by New Jersey Board of Public Utilities Commissioner Michael Bange, will be considered during NARUC’s annual meeting being held Sunday through Wednesday in San Juan, Puerto Rico.
MainStory: TopStory FederalLegislation StateLegislation DataSecurity