Key Takeaways
- The U.S. water sector comprises roughly 170,000 locally owned and operated facilities, making centralized federal mandates difficult.
- Growing reliance on remote‑controlled valves, sensors, and treatment‑plant software creates numerous cyber‑access points that bad actors can exploit.
- GAO has repeatedly warned about cyber‑risk to water infrastructure and recommends that the EPA conduct a sector‑wide risk assessment and adopt a risk‑informed cybersecurity strategy.
- Resource constraints—aging equipment, limited budgets, and a shortage of skilled cybersecurity workers—hamper efforts to modernize and protect these systems.
- Workforce development must start early, with educational outreach to attract talent to water‑sector cybersecurity roles.
- While the EPA can encourage best practices, it lacks authority to compel action; stronger federal mandates or coordinated whole‑of‑government approaches may be needed.
- Short‑term mitigation steps such as basic cyber hygiene (password updates, multi‑factor authentication, incident‑response planning, staff training) can reduce vulnerability even before larger upgrades occur.
Overview of the Water Sector’s Cybersecurity Landscape
The water and wastewater infrastructure in the United States is highly decentralized, with about 170,000 owner‑operators ranging from small municipal utilities to private companies. This fragmentation means that no single federal agency can directly dictate security practices across the board. Instead, the Environmental Protection Agency (EPA) serves as the sector’s lead agency, offering guidance and incentives rather than enforceable mandates. The sheer number of entities creates a patchwork of preparedness levels, leaving many facilities exposed to cyber threats that could disrupt the delivery of safe drinking water.
Increasing Dependence on Connected Technology
Over the past decade, water utilities have increasingly adopted remote‑monitoring and control systems—such as SCADA (Supervisory Control and Data Acquisition) platforms, automated valves, and sensor networks—to improve operational efficiency. While these technologies enable real‑time adjustments and cost savings, they also expand the attack surface. Each networked device becomes a potential entry point for hackers seeking to manipulate treatment processes, shut off supply, or hold data for ransom. The convergence of operational technology (OT) with traditional IT networks further blurs defensive boundaries, complicating threat detection and response.
Nature of the Cyber Threat to Water Systems
Cyber threats to water facilities range from financially motivated ransomware attacks to sophisticated nation‑state operations aimed at causing public harm. A malicious actor who gains access to control valves or chemical dosing systems could alter water quality, trigger service outages, or damage critical equipment. Because water is a commodity most people take for granted, the impact of a successful intrusion can be immediate and severe, undermining public trust and posing health risks. GAO’s reports emphasize that even low‑skill attackers can cause significant disruption if basic defenses are absent.
GAO’s Recommendations and EPA’s Response
In its latest report, GAO urged the EPA to undertake a comprehensive risk assessment of the water sector and to develop a risk‑informed cybersecurity strategy that aligns with federal guidelines. The EPA has completed the risk assessment, which GAO viewed as a positive step, and has begun drafting a strategy. However, GAO notes that the effectiveness of these measures hinges on clear federal leadership, adequate resources, and the ability to compel owner‑operators to adopt recommended protections—areas where current authority remains limited.
Federal Role and Implementation Challenges
Although the Biden administration released a national cybersecurity strategy in spring 2024, details on how it will be operationalized for the water sector remain unclear. Moreover, the administration’s broader inclination to shift responsibility for infrastructure security to states and localities introduces uncertainty about funding, coordination, and enforcement. GAO warns that without a defined federal role—particularly regarding authority to mandate upgrades or provide consistent guidance—efforts to close cybersecurity gaps may remain fragmented and insufficient.
Resource Constraints: Aging Infrastructure and Funding Gaps
Much of the nation’s water infrastructure is decades old, with pumps, valves, and treatment equipment nearing end‑of‑life. Legacy hardware often lacks the capacity to support modern cybersecurity controls, creating a dual challenge: utilities must invest in both physical upgrades and digital defenses. Funding these improvements relies heavily on local tax revenues and water rates, forcing officials to balance affordability for residents with the need for robust security investments. GAO highlights that this tension frequently results in deferred maintenance and postponed cybersecurity projects.
Workforce Shortages and Talent Development
A nationwide shortage of qualified cybersecurity professionals exacerbates the water sector’s vulnerabilities. Utilities struggle to attract and retain staff with the specialized OT/IT knowledge required to defend complex control systems. GAO recommends that the federal government, in partnership with educational institutions and industry, launch early‑outreach programs to inspire students to pursue careers in water‑sector cybersecurity. Developing a skilled pipeline is essential for long‑term resilience, especially as threats evolve in sophistication.
EPA’s Authority and the Need for a Whole‑of‑Government Approach
The EPA currently operates as a sector risk management agency without statutory power to compel owner‑operators to adopt specific cybersecurity measures. GAO’s report suggests that the EPA should evaluate its existing authorities and, if found inadequate, seek legislative action to obtain the necessary enforcement tools. A coordinated, whole‑of‑government strategy—leveraging agencies such as CISA, DHS, and the Department of Energy—could harmonize standards, share threat intelligence, and provide technical assistance across the disparate water‑utility landscape.
Parallels with Other Critical Infrastructures
Challenges faced by the water sector mirror those in energy, transportation, and communications: diffuse ownership, reliance on legacy systems, and difficulty enforcing uniform security practices. Lessons learned from securing the electric grid—such as the use of information‑sharing hubs, mandatory reporting of incidents, and incentive‑based modernization programs—can be adapted to water utilities. Recognizing these commonalities enables policymakers to develop cross‑sector solutions that address systemic weaknesses rather than treating each industry in isolation.
Potential Legislative and CISA Roles
Congress could pass legislation granting the EPA or another federal agency explicit authority to enforce cybersecurity standards for water facilities. Similarly, the Cybersecurity and Infrastructure Security Agency (CISA) has historically deployed regional advisors who work directly with municipalities to improve readiness. However, recent budget proposals signal a possible >50 % cut to CISA’s local‑engagement program, raising concerns about the future availability of this hands‑on support. Stakeholders urge policymakers to preserve and expand such initiatives, as they have proven effective in translating federal guidance into actionable local steps.
Immediate Actions for Water‑Utility Operators
While long‑term upgrades and policy changes unfold, utility operators can adopt basic cyber hygiene to reduce risk. Recommended steps include regularly updating passwords, enabling multi‑factor authentication, maintaining an up‑to‑date inventory of all networked devices, developing and testing incident‑response plans, and conducting routine staff training on phishing and social‑engineering tactics. These low‑cost measures can thwart opportunistic attacks and buy time for more substantial investments in technology and workforce development. By combining short‑term defenses with strategic planning, the water sector can move toward a resilient future where safe, reliable water delivery remains protected from cyber threats.