New York has awarded more than $9 million to help local governments strengthen cybersecurity protections for drinking water and wastewater systems, the state has announced.
The state said 153 local government projects will receive funding through its Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant program. Gov. Kathy Hochul’s office noted that the grants will help communities assess cyber risks, implement cybersecurity improvements and comply with minimum cybersecurity standards for drinking water and sewer systems.
The state’s Environmental Facilities Corporation is administering the grants, and it will also provide no-cost technical assistance to help the local governments conduct cybersecurity assessments and implement improvements, officials said in the announcement.
This week’s grants come after New York worked to establish new cybersecurity standards for public water systems. State officials have said the requirements are intended to protect increasingly connected water infrastructure from cyber threats that could disrupt essential services or affect public health.
The announcement also comes as federal agencies continue warning of increased cyber threats to critical infrastructure. In recent months, the federal government’s Cybersecurity and Infrastructure Security Agency and its partners have issued multiple advisories warning that Internet-connected industrial control systems, including those used by water utilities, remain attractive targets for malicious actors. And there were multiple water-related incidents reported in the recent days, with the threat actors and most of the locations so far unnamed.
New York last year advanced cybersecurity regulations for community water systems, documented in the state register. The rules require community water systems serving more than 3,300 people to conduct cybersecurity vulnerability analyses, set up cybersecurity programs, develop incident response plans, provide cybersecurity training and report cybersecurity incidents to the state. Systems serving more than 50,000 people would face additional requirements, including network monitoring and naming an executive responsible for cybersecurity. Compliance costs could reach as much as $150,000 annually for systems serving between 3,300 and 50,000 people, while costs for the largest water systems could reach as much as $5 million annually, depending on the size and complexity of their cybersecurity programs.
A complete list of state grant recipients is available through the Environmental Facilities Corporation’s Cybersecurity Hub, which also offers training, technical resources and one-on-one consultations for water and wastewater systems.