Supporting Water Infrastructure Security and Resilience

Governor Kathy Hochul today announced a key milestone to safeguard New York’s water infrastructure by developing nation-leading cybersecurity regulations for water and wastewater systems alongside a new cyber grant program and technical assistance to bolster the security and resilience of water and wastewater systems. Following a collaborative multi-agency development process directed by her 2025 State of the State, the New York State Department of Health (DOH) and New York State Department of Environmental Conservation (DEC) released proposed cyber regulations for water and wastewater systems for public comment. In coordination, the Department of Public Service (DPS) also released proposed cyber regulations across water-works corporations, other public utilities, and cable television companies for public comment. The Environmental Facilities Corporation (EFC) is also establishing a new cyber grant program and technical assistance for the water and wastewater systems sector. These threat-informed, risk-centric, and cost-balanced minimum standards and accompanying funding and technical assistance will strengthen the cybersecurity posture of water utilities and protect them from increasingly sophisticated and dangerous cyber attacks.

“Cyber attacks on critical infrastructure can have devastating impacts on communities, and we must act now to defend our water and wastewater systems with the same urgency and rigor we bring to other critical sectors,” Governor Hochul said. “These new regulations and grant programs reflect our commitment to protecting public health and safety while helping under-resourced entities modernize for a digital age.”

The agencies worked together to closely align definitions and provisions within each agency’s regulatory and operational requirements, worked to minimize duplicative or conflicting requirements, and streamlined processes. They also aligned regulations with guidance issued by the U.S. Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency for securing information technology and operational technology environments.

Regulated water and wastewater systems will be required to evaluate risks, deploy cybersecurity controls, and implement network monitoring and logging for the largest systems. Regulated entities will also be required to develop and maintain response and recovery plans to support continuity of operations in the event of cyber attacks and to report cybersecurity incidents.

Governor Hochul secured another $500 million for clean water infrastructure in this year's budget, bringing the state's total investment to $6 billion since 2017. In addition to these investments, $2.5 million in the FY26 Budget funds a new cyber grant program, Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE), dedicated to the water and wastewater sector. This new grant program will provide competitive grants to support cybersecurity risk assessments and hardening efforts focused on and aligned with the new proposed regulatory requirements. The grant opportunities assist water systems by providing them with the needed resources to strengthen their cybersecurity posture, enhance resiliency, and ensure reliable delivery of clean water for New Yorkers.

Governor Hochul is again expanding the Community Assistance Teams to provide free, expert guidance and tools to help water systems implement cybersecurity best practices in a way that is cost-effective and sustainable. Communities can continue to request a one-on-one consultation with the Teams about their water infrastructure needs, now including cybersecurity. A new Cybersecurity Hub is now available on the EFC’S website to help communities immediately start fortifying their systems. The hub provides training opportunities, recommended actions, and additional resources. This hub will be regularly updated. Communities can continue to request consultations about their water infrastructure needs on the EFC’s website.

The public release by DOH, DEC, and PSC of the proposed regulations marks the latest step in strengthening the reliability and resilience of New York’s water and wastewater systems. DEC will accept public comments until September 3, 2025; DOH until September 14, 2025; and PSC until September 14, 2025. Once adopted, regulated entities will have until January 1, 2027 to comply with DEC and DOH regulations focused on operational technology and until January 1, 2026 to comply with PSC regulations focused on information technology.

New York State Chief Cyber Officer Colin Ahern said, “As cyber threats to infrastructure continue to rise, these regulations will help water and wastewater system operators better defend against attacks that could disrupt service, threaten public health, or damage trust. We look forward to reviewing public feedback received by all three agencies before finalizing the regulations to support increased resilience and reliability for New York’s water and wastewater systems.”

New York State Environmental Facilities Corporation President and CEO Maureen A. Coleman said, “In today’s digital world, we must defend our water and wastewater utilities from cyber attacks that cost money, time, and valuable resources – and can potentially halt water services and threaten public health and the environment. That’s why we’re helping local water systems strengthen their cybersecurity while keeping costs down for communities and ratepayers. Governor Hochul’s initiative reflects New York’s leadership in both cybersecurity and environmental protection, and I’m proud that we are taking swift action to protect our communities.”

New York State Department of Environmental Conservation Commissioner Amanda Lefton said, “Thanks to Governor Hochul’s leadership, DEC is proactively enhancing cybersecurity across our wastewater systems to safeguard our environment, public health, and our nation leading investments in this critical infrastructure. DEC is committed to partnering with state agencies and local governments to protect the communities that rely on these essential services every day from cybersecurity threats.”

New York State Public Service Commission Chair Rory M. Christian said, “Cybersecurity threats to critical infrastructure are growing in number, intensity, and sophistication. One area of concern is Information Technology (IT). IT systems are utilized across all entities regulated by the Commission and a breach of IT cybersecurity can result in the dissemination of private customer data as well as substantial financial losses to companies. Protection of ratepayers and consumers from cybercriminals is a key reason to pursue stringent IT security for all regulated entities that interact with the public, including gas, electric, telecom, steam, and water providers.”

New York State Division of Homeland Security and Emergency Services Commissioner Jackie Bray said, “As we move further into the digital age, it’s essential we remain laser-focused on strengthening the cyber security of critical infrastructure. Thanks to the leadership of Governor Hochul, the release of these new regulations and grants not only help ensure the security and resilience of water systems in New York, but are charting a path for the rest of the nation to follow.”

New York State Chief Information Officer and Director of the Office of Information Technology Services Dru Rai said, “If we are committed to having the strongest and most robust cybersecurity protections possible, it will take all of us working together in pursuit of that goal. Thanks to Governor Hochul’s exemplary leadership and establishment of the Joint Security Operations Center, New York is already doing more than ever before to defend state agencies and local governments from a wide array of dangerous cyber threats. However, it is critical that we also provide the resources necessary to fully safeguard New York’s water infrastructure and protect the health and safety of our residents in the communities in which they live. I applaud today’s announcement and thank our partners in government for their good work.”

New York State Police Superintendent Steven G. James said, “Cyber attacks and the need to continuously implement cyber security measures continues to increase across several entities. The new regulations and grant program are imperative for the evaluation of cyber security threats against our water infrastructure and provide the necessary resources to address them head-on. I thank Governor Hochul for her support and collaborative approach to identify, confront, and contain the cyber threats we face in New York State.”

New York State Health Commissioner Dr. James McDonald said, “Protecting public health starts with ensuring the safety and reliability of the systems that deliver clean water to New Yorkers. These first-in-the-nation cybersecurity regulations, along with new funding to strengthen and modernize our infrastructure, reflect Governor Hochul’s commitment to preparing for evolving threats and ensuring our water systems can recover quickly and continue serving communities safely.”

The new grant program and proposed regulations for the water and wastewater systems sector is the latest step taken by Governor Hochul to strengthen cyber defenses statewide and ensure the resiliency of New York’s critical infrastructure. Under Governor Hochul's leadership, New York has led the nation in developing smart and effective cybersecurity policy — including establishing nation-leading financial sector regulations, signing landmark legislation to protect New York's energy grid from cyber threats, strengthening cybersecurity across New York’s municipalities, implementing first-in-the-nation hospital cybersecurity minimum standards, and issuing the first-ever Statewide Cybersecurity Strategy.

Senator Chuck Schumer said, “We must do all we can to protect our vital water infrastructure assets, like dams and drinking water, from cyber attack. That is why I’m pleased that new cybersecurity regulations for New York’s water and wastewater systems and a new grant program will help our communities meet federal standards and build a safer, more resilient New York. When it comes to fighting off cyberattacks, we must work arm-in-arm with state and local governments to prevent future hacks. I’m grateful for Governor Hochul’s partnership in identifying where we are vulnerable and ramping up our joint security efforts.”

Senator Kirsten Gillibrand said, “Protecting our nation’s water systems against cyber attacks is a vital component of our national security, but the sector has long struggled to implement necessary cybersecurity protections. I am grateful that these new regulations and grants will drive necessary change in this sector and help defend our state from crippling attacks targeting essential services. I remain committed to ensuring New York is ready to defend itself against cyber threats and will continue to fight to deliver the resources our state needs to protect our critical infrastructure.”

Assemblymember Steve Otis said, “Increasing cybersecurity protection for our critical infrastructure has been a major priority of Governor Hochul and the Legislature. Through the Governor’s release of the NYS Cybersecurity Strategy in 2023 and the passage of legislation and budgetary support, we are improving our defenses against the always evolving threats. The release of draft regulations for water and wastewater operators is the vital next step to protect the health, safety, and security of all New Yorkers. As a longtime supporter of New York’s nation-leading water infrastructure funding and as an advocate for robust cybersecurity protections, I am very appreciative of the Governor’s efforts here and the great work of New York’s environmental, health, and cybersecurity agencies.”

These initiatives underline the Governor’s commitment to build a safer and more resilient New York, including online. Over the last three years, Governor Hochul has made foundational investments in New York’s cybersecurity by establishing the NYS Joint Security Operations Center (JSOC), standing up the statewide cybersecurity shared services program for counties and municipalities, and expanding the state’s law enforcement cyber capabilities by growing the Computer Crimes Unit, Cyber Analysis Unit, and Internet Crimes Against Children Center at the New York State Police.