Key Takeaways
- New York has awarded more than $9 million through the Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant program to 153 local government projects.
- Funding supports cyber risk assessments, security improvements, and compliance with state‑mandated cybersecurity standards for drinking‑water and wastewater systems.
- The Environmental Facilities Corporation (EFC) administers the grants and provides no‑cost technical assistance, including assessments, training, and one‑on‑one consultations.
- New York’s new cybersecurity regulations require community water systems serving >3,300 people to conduct vulnerability analyses, establish cybersecurity programs, develop incident‑response plans, provide training, and report incidents; systems serving >50,000 people must also implement network monitoring and designate an executive responsible for cybersecurity.
- Estimated annual compliance costs range from $150,000 for mid‑size utilities to $5 million for the largest systems, depending on program complexity.
- A complete list of grant recipients and additional resources are available on the EFC Cybersecurity Hub, which also offers training materials and technical support.
Overview of SECURE Grant Funding
New York State announced the allocation of over $9 million to bolster cybersecurity protections for local drinking‑water and wastewater systems. The funds are distributed through the Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant program, which will support 153 separate projects across municipalities. By targeting essential water infrastructure, the initiative aims to reduce the likelihood of disruptive cyber incidents that could compromise public health or essential services. The scale of the investment reflects the state’s recognition of growing cyber threats to critical utilities and its commitment to proactive defense.
Purpose and Allowed Uses of Grants
The SECURE grants are earmarked for three core activities: conducting cybersecurity risk assessments, implementing technical and procedural improvements, and achieving compliance with the state’s newly established cybersecurity standards for water and wastewater systems. Recipients may use the funds to purchase security hardware, deploy monitoring tools, develop policies, or engage third‑party experts. By focusing on assessment first, the program helps utilities identify vulnerabilities before investing in remediation, ensuring that spending is directed where it will have the greatest impact.
Administration by Environmental Facilities Corporation
The Environmental Facilities Corporation (EFC) is the state agency tasked with administering the SECURE grant program. EFC manages the application review, fund disbursement, and oversight of project milestones. In addition to financial support, EFC serves as a central point of contact for participating municipalities, offering guidance on eligibility criteria, reporting requirements, and best practices for grant utilization. This centralized administration streamlines the process for local governments that may lack dedicated grant‑management staff.
Technical Assistance and Support
Beyond direct funding, EFC provides no‑cost technical assistance to grant recipients. This includes help with conducting comprehensive cybersecurity assessments, interpreting assessment results, and designing effective improvement plans. EFC also offers training workshops, webinars, and one‑on‑one consultations tailored to the specific needs of water and wastewater utilities. By coupling financial resources with expert support, the state aims to build lasting internal capacity rather than relying on one‑time fixes.
Background on New Cybersecurity Standards for Water Systems
The SECURE awards follow New York’s recent effort to establish minimum cybersecurity standards for public water systems. Recognizing that water treatment and distribution increasingly rely on networked industrial control systems (ICS), the state moved to codify baseline security practices. These standards are designed to protect essential services from cyber threats that could disrupt water supply, affect treatment processes, or jeopardize public health. The regulatory framework aligns with federal guidance while addressing state‑specific risks and resource realities.
Federal Warnings and Recent Water Sector Incidents
The timing of New York’s grant announcement coincides with heightened warnings from federal agencies. The Cybersecurity and Infrastructure Security Agency (CISA) and its partners have issued multiple advisories highlighting that Internet‑connected ICS, including those used by water utilities, remain attractive targets for malicious actors. In recent days, several water‑related cyber incidents have been reported, though specific threat actors and locations have not been publicly disclosed. These developments underscore the urgency of strengthening defenses before attackers can exploit vulnerabilities in critical infrastructure.
Specific Requirements of New York State Cybersecurity Regulations
Under the state’s cybersecurity rules, community water systems serving more than 3,300 people must:
- Perform a cybersecurity vulnerability analysis;
- Establish a formal cybersecurity program;
- Develop and maintain an incident‑response plan;
- Provide cybersecurity training for personnel; and
- Report any cybersecurity incidents to the state.
Systems serving more than 50,000 people face additional obligations, including implementing continuous network monitoring and appointing an executive officer with explicit responsibility for cybersecurity oversight. These tiered requirements reflect the principle that larger, more complex systems present a greater attack surface and thus require more robust safeguards.
Cost Implications for Utilities
State officials estimate that achieving compliance could entail significant ongoing expenses. For utilities serving between 3,300 and 50,000 people, annual costs may reach as high as $150,000, covering assessments, policy development, training, and basic technical controls. For the largest systems—those serving over 50,000 residents—annual expenditures could climb to $5 million or more, depending on the sophistication of the cybersecurity program, the need for advanced monitoring tools, and staffing requirements. The SECURE grants are intended to offset a portion of these costs, particularly for smaller municipalities that might otherwise struggle to afford necessary upgrades.
Access to Grant Recipient List and Additional Resources
A complete list of the 153 SECURE grant recipients is publicly available through the Environmental Facilities Corporation’s Cybersecurity Hub. The Hub also serves as a repository for training materials, technical guides, and best‑practice documents related to water‑system cybersecurity. Municipalities can schedule one‑on‑one consultations with EFC cybersecurity specialists to tailor improvements to their unique environments. By centralizing these resources, the state encourages knowledge sharing and facilitates continuous improvement across the water sector.
Conclusion and Outlook
New York’s $9 million SECURE grant initiative represents a strategic investment in the resilience of essential water infrastructure against an evolving cyber threat landscape. By coupling financial assistance with expert technical support and clear regulatory expectations, the state aims to elevate cybersecurity maturity across hundreds of local utilities. As federal warnings persist and incidents continue to surface, the proactive measures funded through SECURE—risk assessments, program development, incident planning, and ongoing monitoring—will be critical safeguards. Continued state‑federal collaboration, regular updates to standards, and sustained funding will be necessary to keep pace with adversaries targeting the nation’s water supplies.