New York State this week opened for public feedback proposed regulations focusing on the cybersecurity of water and wastewater systems.
Released by the New York State Department of Health (DOH) and New York State Department of Environmental Conservation (DEC), the documents propose minimum standards for improving water infrastructure’s resilience against sophisticated cyberattacks.
Additionally, the Department of Public Service (DPS) released proposed cyber regulations covering water-works corporations, cable television companies, and other public utilities.
The proposed rules are accompanied by a new grant program established by the Environmental Facilities Corporation (EFC) alongside technical assistance for water and wastewater utilities.
DOH, DEC, and EFC worked together to align definitions and provisions within their requirements, and to ensure that the regulations are aligned with CISA and Environmental Protection Agency guidance on securing IT and OT environments.
Per the proposed rules, water and wastewater utilities will be required to implement cybersecurity controls, to ensure they have efficient network monitoring and logging, and to evaluate risks within their environments.
They will also have to implement and maintain incident response plans to ensure they can continue operations in the event of a cyberattack, and to report incidents, while certified wastewater operators will be required to undergo mandatory cybersecurity training.
Copies of the proposed documents were published on DEC’s website. Interested parties are required to submit comments by September 3, 2025. DOH and PSC will accept feedback until September 14, 2025.
“Once adopted, regulated entities will have until January 1, 2027 to comply with DEC and DOH regulations focused on operational technology and until January 1, 2026 to comply with PSC regulations focused on information technology,” New York State says.
“These resources streamline and highlight key sector-specific guidance, tools, and training to help regulated wastewater facilities enhance their cyber resilience,” DEC notes.
Water and wastewater facilities are also encouraged to take advantage of the various federal and state resources and training opportunities, including free cybersecurity assessments, that are available for them.
The water sector has often been targeted by threat actors in recent years and the US government has been taking steps to help facilities boost their cyberattack preparedness and resilience.
“Cyberattacks on critical infrastructure can have devastating impacts on communities, and we must act now to defend our water and wastewater systems with the same urgency and rigor we bring to other critical sectors. These new regulations and grant programs reflect our commitment to protecting public health and safety while helping under-resourced entities modernize for a digital age,” Governor Kathy Hochul said.
Learn More at SecurityWeek’s ICS Cybersecurity Conference
The leading global conference series for Operations, Control Systems and OT/IT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.
October 27-30, 2025 | Atlanta
www.icscybersecurityconference.com
Related: EU Unveils AI Code of Practice to Help Businesses Comply With Bloc’s Rules
Related: Encryption Backdoors: The Security Practitioners’ View
Related: The ZTNA Blind Spot: Why Unmanaged Devices Threaten Your Hybrid Workforce
Related: New UK Framework Pressures Vendors on SBOMs, Patching and Default MFA
