The U.S. Environmental Protection Agency (EPA) today announced it is withdrawing its March 2023 Cybersecurity Rule. The American Water Works Association (AWWA) and National Rural Water Association (NRWA) are pleased with the decision and have renewed their call for a collaborative approach to cybersecurity measures in the water sector.
AWWA and NRWA joined the States of Missouri, Arkansas, and Iowa in a legal challenge to the rule on behalf of their memberships. They pointed out that the rule was not consistent with the process Congress put in place to address cybersecurity concerns for water systems under the Safe Drinking Water Act or the American Water Infrastructure Act and was not issued with proper public engagement required by the Administrative Procedures Act.
In addition to concerns about the legal process and legality of the rule, the water associations expressed concerns that the rule would create additional cybersecurity vulnerabilities for utilities, as sanitary surveys required in the rule have public notification requirements. Finally, the rule would have required cybersecurity reviews by state regulatory agencies that lack expertise and resources for cybersecurity oversight. The U.S. Court of Appeals for the Eighth Circuit granted a stay on July 12, two months before EPA withdrew the rule.
"AWWA is pleased that EPA has decided to withdraw its cybersecurity rule," said AWWA CEO David LaFrance. "We also recognize that cyber threats in the water sector are real and growing, and we cannot let our guard down for even a moment. Strong oversight of cybersecurity in the water sector remains critical. We urge U.S. Congress and EPA to support a co-regulatory model that would engage utilities in developing cybersecurity requirements with oversight from EPA."