Water systems short on cyber expertise, state and local officials tell EPA

National security officials met with state and local government leaders from across the country last Thursday to discuss methods to meet the rising threat of attacks by foreign governments and criminal entities against the nation’s water infrastructure.

“Cybersecurity is not the sole responsibility of one single water system, one single state, or the federal government,” Janet McCabe, deputy administrator for the Environmental Protection Agency, said in a press release about the meetings. “Instead cybersecurity is a collective responsibility. EPA has an important role, and it’s critical that we work together with our state partners to help set a course toward cyber-resilience that will deliver essential protections across the country.”

According to the release, officials from several states outlined actions they’re taking to protect their water systems. Some states shared challenges with finding appropriate technical expertise to manage cybersecurity vulnerabilities. In return, the EPA and the Cybersecurity and Infrastructure Security Agency shared information regarding resources available to states to help assess and address cyber vulnerabilities with their water systems.

“The nation’s water systems face cyber threats from criminals and countries alike,” Anne Neuberger, deputy national security advisor for cyber and emerging technologies, said in the release. “We must lock our digital doors to meet the threat. The Biden-Harris Administration has issued cybersecurity best practices and made available free tools and services to help companies operating critical infrastructure act quickly.”

At the meeting, Neuberger asked states to share by May 20 cybersecurity plans that include information about how they are working with drinking water and wastewater systems to determine vulnerabilities.

The EPA also provided information about its work to establish a Water Sector Cybersecurity Task Force that could identify strategies to reduce the risk of cyberattacks against water systems.