In late January 2022, the EPA announced the Industrial Control Systems Cybersecurity Initiative —Water and Wastewater Section Action Plan to help protect the country’s water systems from cyberattacks. The Action Plan, which is part of President Biden’s Industrial Control Systems Initiative, is intended to spur short-term activities that will safeguard water resources by enhancing the cybersecurity measures currently in place. More specifically, the Action Plan will facilitate the use of technologies that will improve the federal government’s ability to detect cyberthreats, prevent those threats from materializing, and, if necessary, minimize the damage caused by a cyberattack.
According to a statement from EPA Administrator Michael S. Regan, “EPA is committed to working with our federal partners and using our authorities to support the water sector in detecting, responding to, and recovering from cyber-incidents.” The Action Plan is also designed to guard against cyberattacks by facilitating information sharing across the federal government.
Specific elements of the EPA’s Action Plan include:
- Establishing a task force of water sector leaders;
- Implementing pilot projects to demonstrate and accelerate adoption of incident monitoring;
- Improving information sharing and data analysis; and
- Providing technical support to water systems.
Similar measures have already been implemented for large sections of the country’s electrical grid and critical natural gas pipelines. While we wait for the EPA Action Plan to be implemented fully, water resources can—and should—begin evaluating their own cybersecurity practices and policies. Using the pending EPA Action Plan as a guide, water resources can either adapt existing procedures or develop and implement new policies to protect their data and be better prepared in the event of a cyberattack. As recent events affecting our nation’s infrastructure have shown, cybersecurity must be a top priority as we continue in 2022.
Nixon Peabody’s Cybersecurity & Privacy Team can assist in the audit of existing policies and the creation of comprehensive cybersecurity programs that align with the EPA Action Plan’s safeguards. We will continue to monitor developments that may affect water resources.