Key Takeaways
- Governor Kathy Hochul announced over $9 million in grants through the Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) program to protect 153 local water and sewer systems across New York State.
- The funding supports cybersecurity assessments, implementation of new state‑mandated minimum standards, and no‑cost technical assistance from the Environmental Facilities Corporation (EFC).
- Recent cyberattacks on water utilities nationwide have underscored the growing threat to public health, prompting the state to act proactively.
- Grants range from $36,400 to $50,000 per project, enabling municipalities of varying sizes to conduct vulnerability scans, upgrade defenses, and develop incident‑response plans.
- The initiative aims to safeguard essential drinking‑water and wastewater services for millions of New Yorkers while strengthening overall infrastructure resilience.
Overview of the SECURE Grant Program
The Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant program was created by New York State to address the rising cybersecurity risks facing critical utility infrastructure. Administered by the New York State Division of Homeland Security and Emergency Services in partnership with the Environmental Facilities Corporation, SECURE provides direct financial assistance to municipalities, counties, and special districts that operate drinking‑water treatment plants, wastewater facilities, and related distribution networks. The program’s core objectives are to fund comprehensive cybersecurity risk assessments, support the implementation of remediation measures identified in those assessments, and ensure compliance with the state’s newly established minimum cybersecurity standards for water and sewer systems. By targeting both assessment and remediation phases, SECURE helps communities move from awareness to actionable protection.
Governor Hochul’s Statement and Rationale
During the announcement, Governor Kathy Hochul emphasized the urgency of defending New York’s water infrastructure against increasingly sophisticated cyber threats. She noted that malicious actors have already disrupted water services in several states, posing risks to public health, safety, and economic stability. The governor stressed that the SECURE grants are a direct response to those incidents, providing local governments with the resources needed to bolster defenses, safeguard essential services, and maintain the delivery of safe, reliable water to residents. Hochul’s remarks highlighted a proactive stance: rather than waiting for an attack to occur, the state is investing now to reduce vulnerability and enhance resilience across the entire water sector.
How the Grants Will Be Used
The $9 million allocation will be distributed among 153 individual projects, each receiving a grant amount tailored to the scope of work required. Funds are primarily earmarked for conducting detailed cybersecurity assessments that identify weaknesses in network architecture, software patching practices, access controls, and incident‑response capabilities. Following the assessment phase, grantees will use the remaining funds to implement recommended improvements—such as deploying firewalls, upgrading intrusion detection systems, enforcing multi‑factor authentication, and developing cybersecurity policies and training programs for staff. By covering both evaluation and remediation, the program ensures that communities not only discover vulnerabilities but also take concrete steps to mitigate them.
Technical Assistance from the Environmental Facilities Corporation
In addition to direct funding, the Environmental Facilities Corporation (EFC) will provide no‑cost technical assistance to grant recipients. EFC’s support includes guidance on conducting assessments in accordance with state standards, interpreting results, prioritizing remediation actions, and navigating procurement processes for cybersecurity tools and services. The corporation also offers training workshops and webinars designed to build internal expertise among water‑system operators and municipal IT staff. This combined approach of financial aid and expert guidance aims to lower barriers for smaller municipalities that may lack dedicated cybersecurity personnel, ensuring that all participants can achieve a baseline level of security regardless of size or budget.
Examples of Funded Projects
The announcement included a snapshot of several awarded projects to illustrate the program’s reach. The Village of Mount Kisco received $50,000 for a cybersecurity assessment of its water system. The Village of Sleepy Hollow was granted $50,000 for a similar evaluation of its drinking‑water infrastructure. Westchester County’s Peekskill Water Resource Recovery Facility obtained $50,000 to assess cybersecurity risks at its wastewater treatment plant. The City of Yonkers secured $50,000 for a cybersecurity assessment grant targeting its drinking‑water distribution network (DW211). Finally, the Town of Yorktown received $36,400 for a cybersecurity assessment of its Yorktown Heights Wastewater Treatment Plant. These examples demonstrate that funding is allocated to both drinking‑water and sewer facilities, as well as to communities ranging from small villages to larger cities and counties.
Impact on Public Health and Safety
Protecting water and wastewater systems from cyber intrusions is directly linked to safeguarding public health. A successful cyberattack could manipulate treatment processes, alter chemical dosing, or disrupt service delivery, potentially leading to contaminated drinking water or untreated sewage releases. By strengthening cybersecurity defenses, the SECURE grants help prevent such scenarios, ensuring that the water supplied to millions of New Yorkers remains safe and that wastewater treatment continues to meet environmental standards. Moreover, enhanced resilience reduces the likelihood of service interruptions that could affect hospitals, schools, businesses, and households, thereby supporting broader community stability and economic continuity.
Broader Context of Cyber Threats to Water Infrastructure
Recent years have seen a notable increase in cyber threats targeting critical infrastructure, with water systems emerging as a particular focus due to their essential role and often limited cybersecurity resources. Incidents such as the 2021 Oldsmar, Florida water treatment plant breach—where an attacker attempted to raise sodium hydroxide levels to dangerous levels—have highlighted the potential consequences of inadequate defenses. Recognizing these trends, New York State’s proactive stance through the SECURE program aligns with federal initiatives like the Environmental Protection Agency’s Water Sector Cybersecurity Plan and the Cybersecurity and Infrastructure Security Agency’s (CISA) guidance for water utilities. The state’s investment reflects a growing acknowledgment that cybersecurity is as vital to water safety as traditional engineering and operational practices.
Next Steps and Implementation Timeline
Grant recipients are expected to begin their cybersecurity assessments within the next three months, with most projects slated for completion within six to twelve months, depending on the complexity of the systems involved. EFC will monitor progress through regular reporting requirements and provide ongoing technical support throughout the assessment and remediation phases. Upon completion, municipalities will submit final reports detailing identified vulnerabilities, actions taken, and any remaining gaps, which will inform future funding rounds and policy refinements. The state plans to evaluate the overall effectiveness of the SECURE program after the first year, potentially adjusting grant sizes, eligibility criteria, or assistance offerings based on lessons learned.
Conclusion and Call to Action
Governor Hochul’s announcement of more than $9 million in SECURE grants marks a significant step forward in fortifying New York’s water and sewer infrastructure against cyber threats. By combining direct financial assistance with expert technical support from the Environmental Facilities Corporation, the program empowers local governments to conduct essential assessments, implement robust defenses, and comply with newly established state cybersecurity standards. The initiative not only protects the immediate health and safety of residents but also contributes to the long‑term resilience of a vital public service. As cyber risks continue to evolve, sustained investment and collaboration between state agencies, utilities, and cybersecurity professionals will be essential to keep New York’s water flowing safely and reliably.