After years of warnings that the nation’s water systems are vulnerable to cyberattacks, the federal government is stepping in with new resources to shore up their defenses.
The U.S. Environmental Protection Agency on Monday announced nearly $12 million in grants to help protect 10 midsize and large drinking water systems from cybersecurity threats and improve resiliency against extreme weather, while a new White House initiative will connect Texas’s water utilities with cybersecurity companies that have agreed to provide cyber defense resources at no cost.
EPA Assistant Administrator for the Office of Water Jess Kramer said in a Monday statement that cyberattacks, wildfires, flooding and other hazards “represent a significant risk to water system operators.” The EPA Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability Grant Program “complements the agency’s technical assistance work and partnership with federal agencies, states, and the water sector to address cyberattacks and natural hazards,” she said.
Cities and public utilities chosen to receive the EPA funding through a notice of funding opportunity include Anderson, California; Bay City, Texas; Bloomington, Indiana; Coffeyville, Kansas; Hemet, California; Lake City, and Orange City, Florida; San Diego; the California-American Water Company in Sacramento, California; and Denver Water in Colorado.
“This funding will help strengthen critical infrastructure, improve national security, and support long-term resilience so residents can continue to count on safe drinking water,” EPA Region 7 Administrator Jim Macy, who oversees Coffeyville, among other areas, said in a statement. Coffeyville was hit with severe flooding earlier this summer.
The Association of State Drinking Water Administrators noted on its website that the funding comes “as cybersecurity attacks increase in number and visibility, making it a timely investment in the nation’s infrastructure.”
State and local governments face a fundamental cybersecurity challenge because “critical infrastructure is increasingly interconnected, but the resources available to defend it are not equally distributed,” Bobby Suber, senior manager, solutions architecture for state, local government and higher education at Elastic, an AI search company that applies its technology to cybersecurity, said in an email.
“Many smaller water utilities, municipalities, hospitals, and other community organizations operate essential services without the cybersecurity staff, technology, or 24x7 monitoring capabilities available to larger agencies,” he said. “That's why efforts like this are important. The answer can't simply be asking every local organization to build its own [security operations center], hire more analysts, and purchase another set of security tools. That model doesn't scale.”
In 2023, the EPA began requiring states to assess public water systems’ cybersecurity practices as part of its periodic audits. And while the agency has provided technical assistance and other resources to states and local water utilities to help implement cybersecurity protections, the U.S. Government Accountability Office found in 2024 that it urgently needed a strategy to address the risks.
Last month, the American Water Works Association sent congressional leaders a letter urging Congress “to provide the support utilities have long needed for continued cybersecurity investment in their systems.”
In San Antonio on Monday, White House National Cyber Director Sean Cairncross and Texas Gov. Greg Abbott unveiled Project Watershed 250, a program that Abbott said will secure that state’s water systems “from the onslaught of cyber-attacks.” The Office of the National Cyber Director, a division of the White House, is partnering on the initiative with the Texas Cyber Command. TCC was created by the state legislature last year to defend state and local governments from cyberattacks and work with federal partners to protect critical infrastructure.
Project Watershed 250 will “make Texas water systems harder targets for China, Iran, and other hostile foreign adversaries,” Abbott’s office said in a Monday news release.
