Cybersecurity Policy Report, Cyber Coalition Seeks Robust Federal Response After Water System Hacks, (Aug 3, 2026)
Cyber attacks on water utilities should prompt action by the federal government and Congress to shore up the cyber defenses of critical infrastructure, according to Tatyana Bolton, executive director of the Operational Technology Cybersecurity Coalition.
Federal agencies warned last week that water utilities in seven states had been hit by hackers who exploited operational technology (OT). The hackers, suspected of working for the Iranian government, modified the OT systems and in some cases locked utilities out of their own networks (CPR, July 31).
The incidents should be seen as a “reckoning of the consequences of ignoring the importance of investing in our nation’s cybersecurity for our critical infrastructure,” Ms. Bolton said in a statement.
“The worst impact, for now, appears to be in Minnesota where alleged Iranian-affiliated state actors targeted over 30 water systems. We must view this through a clear lens: an adversary has directly impacted a core American necessity,” she said.
The federal government’s advisories about cyber attacks on critical infrastructure are appreciated, she said, but “we must move from simple bulletins to action.”
She recommended that the Cybersecurity and Infrastructure Security Agency issue a binding operational directive (BOD) that would require federal agencies to secure their OT.
“The Federal Civilian Executive Branch (FCEB) relies on more than 8,000 managed-owned and leased facilities, as well as thousands of agency-managed laboratories, hospitals, research campuses, warehouses, ports of entry, and other specialized facilities. The OT that supports these environments, including HVAC, power management, access control, building automation, and water systems, is essential to maintaining federal mission continuity,” Ms. Bolton noted.
“CISA should issue a BOD focused on OT security that places fundamental cybersecurity controls across these systems,” she said. “To be sure, an OT BOD only applies to FCEB entities, and the water utilities in Minnesota would not have been required to implement the requirements detailed in the BOD. However, BODs send strong and important demand signals to the private sector while ensuring the US government takes every step to secure its own networks.”
In addition, Ms. Bolton called on Congress to reauthorize the State and Local Cybersecurity Grant Program (SLCGP), an expiring program that offered state and local governments $1 billion in cybersecurity grants over four years (CPR, June 24).
“State and local governments and local critical infrastructure entities like Minnesota’s are the first line of defense against malicious cyber actors. And by not extending this grant program, Congress is leaving small towns to protect themselves from nation state actors like Iran,” she warned.
Ms. Bolton also advocated for the reauthorization of the Cybersecurity Information Sharing Act of 2015 (CISA 2015), which enables private-sector entities to share cyber threat information with each other and the federal government without fear of legal repercussions.
The information-sharing law enables CISA “to receive technical evidence and specific cybersecurity information from private sector partners,” she noted. “This information allows the U.S. government to identify widespread, large scale cyber campaigns and trends across sectors.”
“These are the core, fundamental steps we must take to secure our critical infrastructure,” Ms. Bolton added. “Despite years of guidance, increasing convergence between IT and OT, and repeated warnings that Chinese and Iranian actors have pre-positioned themselves inside critical infrastructure, the US government has not done enough to take action. To date, we have been lucky that a more catastrophic incident hasn’t occurred. We can no longer rely on luck.”
News: FederalLegislation DataSecurity