Cybersecurity Policy Report, State Utility Regulators Ask Congress for Help Defending Water Systems From Hackers, (Nov 12, 2026)
A resolution calling on Congress to take steps to shore up the cyber defenses of water utilities was adopted yesterday by the board of the National Association of Regulatory Utility Commissioners (NARUC).
The resolution was adopted at NARUC’s annual meeting and was largely unchanged from the version introduced by New Jersey Board of Public Utilities Commissioner Michael Bange (CPR, Nov. 6).
It asks Congress to “remedy the funding shortfall” facing the Cybersecurity and Infrastructure Security Agency “to allow the agency to successfully fulfill its responsibilities and provide essential cybersecurity support to the nation’s water and wastewater utilities.”
“CISA is underfunded and understaffed, having lost roughly one-third of its workforce since 2025; [i]n September 2026, CISA announced that it will scale back the free assessments it offers to critical infrastructure organizations, such as water and wastewater utilities,” it says.
The resolution says it’s “essential to ensure CISA has sufficient resources and to enhance the Water Information Sharing and Analysis Center (WaterISAC) to directly support drinking water and wastewater companies by providing, promoting, and sharing voluntary operational, physical, and cybersecurity-based information and best practices with the sector.”
Along with increasing funding for CISA, Congress should “clarify by statute that water utilities must share cyber-attack information with each other and the government and that such information is not subject to the Freedom of Information Act and public records inspection requests and that such information shall not be made public,” it says.
Congress should also “authorize the U.S. Environmental Protection Agency to create an independent, non-governmental Water Risk and Resilience Organization comprised of sector experts to develop minimum cybersecurity requirements for water and wastewater utilities,” according to the resolution.
It notes that “absence of uniform cybersecurity standards for water utilities leaves too many systems vulnerable, as evidenced by recent cybersecurity attacks on multiple water utilities in at least 12 states in July and August 2026” (CPR, Oct. 20).
Water and wastewater utilities “are squarely in the sights of domestic and international threat actors seeking to disrupt essential services or engage in criminal activities through cybersecurity attacks,” the resolution warns, but many of those utilities “lack even basic cybersecurity protections.”
MainStory: TopStory FederalLegislation StateLegislation DataSecurity