vvEPA

FACT SHEET

Increasing Cybersecurity Resilience at Public Water Systems

Cyber-attacks against public water utilities are increasing. These attacks have the potential to disable or
contaminate the delivery of drinking water to consumers and other essential facilities like hospitals. While
some public water systems (PWSs) have taken important steps to improve their cybersecurity, many PWSs
have failed to adopt basic cybersecurity best practices and consequently are at risk of a cyber-attack.

What is EPA doing?

The U.S. Environmental Protection Agency (EPA) is using existing authority to protect our nation's drinking
water from cyberthreats. EPA is issuing a memo that interprets existing regulations to require state oversight
of cybersecurity practices at PWSs. Through this memo, EPA is clarifying that states must evaluate the
cybersecurity of operational technology used by a PWS when conducting periodic audits of PWSs, called
sanitary surveys, or through other state programs. EPA is also providing extensive guidance, training, and
technical assistance to help states and PWSs increase resilience to cybersecurity incidents.

What does this mean?

As a part of an existing required practice called a sanitary survey, states must employ one of the flexible
options available to evaluate the effectiveness of the cybersecurity of a PWS to produce and distribute safe
drinking water and determine if addressing significant deficiencies that will protect drinking water are
required.

How does this impact the general public?

Drinking water systems will be more protected from cyber-attacks, ensuring the public has safe drinking
water.

Background: What is a sanitary survey?

A sanitary survey is a periodic audit of a public water system's capability to supply safe drinking water. The
definition of sanitary survey is "an onsite review of the water source, facilities, equipment, operation, and
maintenance of a PWS for the purpose of evaluating the adequacy of such source, facilities, equipment,
operation, and maintenance for producing and distributing safe drinking water."1

What is the goal of a sanitary survey?

The goal of a sanitary survey is to provide a review of a public water system to assess their capability to supply
safe drinking water and determine follow up actions for any problems found.

For more information: www.epa.Qov/waterriskassessment/epa-cybersecuritv-best-practices-water-sector

1 40 CFR§ 141.2

Office of Water (4608T)

EPA-810-F-23-004

2023


-------