vvEPA FACT SHEET Increasing Cybersecurity Resilience at Public Water Systems Cyber-attacks against public water utilities are increasing. These attacks have the potential to disable or contaminate the delivery of drinking water to consumers and other essential facilities like hospitals. While some public water systems (PWSs) have taken important steps to improve their cybersecurity, many PWSs have failed to adopt basic cybersecurity best practices and consequently are at risk of a cyber-attack. What is EPA doing? The U.S. Environmental Protection Agency (EPA) is using existing authority to protect our nation's drinking water from cyberthreats. EPA is issuing a memo that interprets existing regulations to require state oversight of cybersecurity practices at PWSs. Through this memo, EPA is clarifying that states must evaluate the cybersecurity of operational technology used by a PWS when conducting periodic audits of PWSs, called sanitary surveys, or through other state programs. EPA is also providing extensive guidance, training, and technical assistance to help states and PWSs increase resilience to cybersecurity incidents. What does this mean? As a part of an existing required practice called a sanitary survey, states must employ one of the flexible options available to evaluate the effectiveness of the cybersecurity of a PWS to produce and distribute safe drinking water and determine if addressing significant deficiencies that will protect drinking water are required. How does this impact the general public? Drinking water systems will be more protected from cyber-attacks, ensuring the public has safe drinking water. Background: What is a sanitary survey? A sanitary survey is a periodic audit of a public water system's capability to supply safe drinking water. The definition of sanitary survey is "an onsite review of the water source, facilities, equipment, operation, and maintenance of a PWS for the purpose of evaluating the adequacy of such source, facilities, equipment, operation, and maintenance for producing and distributing safe drinking water."1 What is the goal of a sanitary survey? The goal of a sanitary survey is to provide a review of a public water system to assess their capability to supply safe drinking water and determine follow up actions for any problems found. For more information: www.epa.Qov/waterriskassessment/epa-cybersecuritv-best-practices-water-sector 1 40 CFR§ 141.2 Office of Water (4608T) EPA-810-F-23-004 2023 ------- |