After cyberattacks linked to Iran targeted water systems in at least seven states, federal and state lawmakers are proposing new funding and oversight to strengthen utility cybersecurity and protect critical infrastructure from future threats.
Water utilities across the United States are working to recover from a series of cyberattacks that targeted operational technology in at least seven states, with hackers linked to the Iranian regime identified as the source. The attacks, which affected water and wastewater systems in Michigan, Georgia, and other states, prompted the Cybersecurity and Infrastructure Security Agency (CISA) to urge utilities to immediately disconnect vulnerable systems from the internet.
In response, lawmakers at both the federal and state levels have introduced new proposals to help utilities strengthen their cybersecurity defenses. Many local water systems, especially smaller ones, face significant financial and technical challenges in upgrading their technology and protecting against sophisticated threats.
Federal Legislation Targets Cybersecurity Gaps
U.S. Senators Adam Schiff of California and Amy Klobuchar of Minnesota recently introduced legislation aimed at providing additional funding and oversight for water and wastewater utilities. The proposed bill would allocate an extra $300 million annually to the Drinking Water and Clean Water State Revolving Funds, specifically for cybersecurity improvements. It would also require large utilities to include cybersecurity risk assessments in their existing risk and resilience planning, and extend federal cyber incident reporting requirements to state and locally owned water systems that were previously exempt.
Under the proposal, smaller utilities and those with limited resources would receive greater flexibility and be prioritized for federal funding. The Environmental Protection Agency (EPA) would be directed to assess water infrastructure cybersecurity and identify vulnerabilities, with the goal of helping municipal water systems defend against future cyber threats.
Support and Warnings from Experts
In addition to legislative efforts, new resources are being made available to help smaller utilities. The Water Watch Center, launched this month by the National Rural Water Association and DEF CON Franklin, will provide direct cyber mitigation support to utilities serving fewer than 10,000 people-a group that includes most community water systems in the country.
However, cybersecurity experts warn that these steps may not be enough. James Turgal, a former FBI agent and current executive at cybersecurity firm Optiv, cautioned that if such attacks are not addressed, similar threats could spread to other sectors like healthcare, transportation, and energy, with potentially more severe consequences. Turgal called for Congress to establish mandatory baseline cybersecurity requirements for the water sector and to either create an independent oversight authority or strengthen EPA oversight to ensure consistent security standards nationwide.
Calls for Broader Action and Local Response
Other experts, including Tatyana Bolton of the Operational Technology Cyber Coalition, have urged Congress to reauthorize and fund the State and Local Cybersecurity Grant Program. Mike Searight, a former chief information officer in Waco, Texas, emphasized the need for better asset management and recommended that operational technology not be connected to the internet. He also pointed to state-level initiatives like the Texas Cyber Command as models for supporting smaller communities with limited resources.
State and local governments are not alone in facing these challenges. According to a recent report on South Dakota's SecureSD program, local governments nationwide are struggling to fund ongoing cybersecurity needs as federal and state support fluctuates.
Ongoing Threats and Recommended Defenses
Federal agencies, including the FBI, National Security Agency, and CISA, have issued warnings about active cyber threats targeting programmable logic controllers (PLCs) in water, energy, and manufacturing sectors. Attackers are increasingly using artificial intelligence to speed up the discovery and exploitation of vulnerabilities, often disguising malicious scripts as legitimate monitoring tools.
Cybersecurity professionals recommend a series of basic but critical defenses: applying software patches, keeping sensitive systems off the public internet, using strong access controls, monitoring key infrastructure, and avoiding default authentication settings. Experts note that many attacks exploit known weaknesses that could be addressed with routine maintenance and vigilance.
As cyber threats continue to evolve, water utilities and government agencies are under pressure to adapt quickly, secure critical infrastructure, and ensure the safety of essential public services.
Water utilities are typically overseen by local or regional authorities, with federal agencies like the EPA providing regulatory guidance and funding. The Drinking Water and Clean Water State Revolving Funds are key sources of financial support for infrastructure improvements, including cybersecurity upgrades. Legislative proposals and new support centers reflect a growing recognition of the need for coordinated action to protect essential services from increasingly sophisticated cyber threats.
