Nation-Leading Cybersecurity Minimum Standards Will Defend the State's Critical Infrastructure Against Increasingly Dangerous and Damaging Cyber Attacks
New Cyber Grant Program and Technical Assistance To Bolster the Security and Resilience of Water and Wastewater Systems
Initiatives Add to Governor Hochul’s Foundational Investments in New York’s Cybersecurity While Highlighting the State’s Commitment To Building a Safer and More Resilient New York
Governor Kathy Hochul announced a key milestone to safeguard New York’s water infrastructure by developing nation-leading cybersecurity regulations for water and wastewater systems alongside a new cyber grant program and technical assistance to bolster the security and resilience of water and wastewater systems. Following a collaborative multi-agency development process directed by her 2025 State of the State, the New York State Department of Health (DOH) and New York State Department of Environmental Conservation (DEC) released proposed cyber regulations for water and wastewater systems for public comment. In coordination, the Department of Public Service (DPS) also released proposed cyber regulations across water-works corporations, other public utilities, and cable television companies for public comment. The Environmental Facilities Corporation (EFC) is also establishing a new cyber grant program and technical assistance for the water and wastewater systems sector. These threat-informed, risk-centric, and cost-balanced minimum standards and accompanying funding and technical assistance will strengthen the cybersecurity posture of water utilities and protect them from increasingly sophisticated and dangerous cyber attacks.
“Cyber attacks on critical infrastructure can have devastating impacts on communities, and we must act now to defend our water and wastewater systems with the same urgency and rigor we bring to other critical sectors,” Governor Hochul said. “These new regulations and grant programs reflect our commitment to protecting public health and safety while helping under-resourced entities modernize for a digital age.”
The agencies worked together to closely align definitions and provisions within each agency’s regulatory and operational requirements, worked to minimize duplicative or conflicting requirements, and streamlined processes. They also aligned regulations with guidance issued by the U.S. Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency for securing information technology and operational technology environments.
Regulated water and wastewater systems will be required to evaluate risks, deploy cybersecurity controls, and implement network monitoring and logging for the largest systems. Regulated entities will also be required to develop and maintain response and recovery plans to support continuity of operations in the event of cyber attacks and to report cybersecurity incidents.
Governor Hochul secured another $500 million for clean water infrastructure in this year's budget, bringing the state's total investment to $6 billion since 2017. In addition to these investments, $2.5 million in the FY26 Budget funds a new cyber grant program, Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE), dedicated to the water and wastewater sector. This new grant program will provide competitive grants to support cybersecurity risk assessments and hardening efforts focused on and aligned with the new proposed regulatory requirements. The grant opportunities assist water systems by providing them with the needed resources to strengthen their cybersecurity posture, enhance resiliency, and ensure reliable delivery of clean water for New Yorkers.
Governor Hochul is again expanding the Community Assistance Teams to provide free, expert guidance and tools to help water systems implement cybersecurity best practices in a way that is cost-effective and sustainable. Communities can continue to request a one-on-one consultation with the Teams about their water infrastructure needs, now including cybersecurity. A new Cybersecurity Hub is now available on the EFC’S website to help communities immediately start fortifying their systems. The hub provides training opportunities, recommended actions, and additional resources. This hub will be regularly updated. Communities can continue to request consultations about their water infrastructure needs on the EFC’s website.
The public release by DOH, DEC, and PSC of the proposed regulations marks the latest step in strengthening the reliability and resilience of New York’s water and wastewater systems. DEC will accept public comments until September 3, 2025; DOH until September 14, 2025; and PSC until September 14, 2025. Once adopted, regulated entities will have until January 1, 2027 to comply with DEC and DOH regulations focused on operational technology and until January 1, 2026 to comply with PSC regulations focused on information technology.
These initiatives underline the Governor’s commitment to build a safer and more resilient New York, including online. Over the last three years, Governor Hochul has made foundational investments in New York’s cybersecurity by establishing the NYS Joint Security Operations Center (JSOC), standing up the statewide cybersecurity shared services program for counties and municipalities, and expanding the state’s law enforcement cyber capabilities by growing the Computer Crimes Unit, Cyber Analysis Unit, and Internet Crimes Against Children Center at the New York State Police.
No comments:
Post a Comment