EPA released a legal opinion that cyber security resiliency falls under their existing authority under the Safe Drinking Water Act. The memorandum conveys EPA’s interpretation that states must include cybersecurity when conducting sanitary surveys for the nation's 143,219 public water systems. The memorandum also highlights different approaches for states to fulfill this responsibility.
NRWA and its 50 State Affiliates have always been committed to ensuring small and rural utilities have the support and resources they need to serve their communities. In this respect, cyber resiliency is just as vital as updated and working infrastructure. Rural Water is committed to assisting these small and rural systems in ensuring that their cybersecurity is sufficient to meet this evolving threat.
However, EPA’s approach to addressing this issue through the sanitary survey program may not prove to be as effective as many would like. NRWA will continue collaborating with EPA and key stakeholders to foster better results to mitigate cyber threats facing the water sector, especially for small and rural water utilities.
EPA is not proposing a new rule for this action as this is a legal interpretation of existing authority. The memorandum is effective immediately. NRWA and all other water associations, plus the National Conference of Mayors, League of Cities, and the National Association of Counties have expressed concerns to EPA. Rural Water members are advised to contact their state primacy agencies for more information on the rollout of this mandate.
To view more information on this announcement from EPA please click here. To submit comments please email wicrd-outreach@epa.gov.