On March 3, 2023, the United States Environmental Protection Agency ("EPA") published a memorandum requiring states to evaluate the cybersecurity of operational technology used by public water systems ("PWSs") "when conducting PWS sanitary surveys or through other state programs." EPA's memorandum "interprets the regulatory requirements relating to the conduct of sanitary surveys to require that when a PWS uses operational technology ("OT"), such as an industrial control system ("ICS"), as part of the equipment or operation of any required component of a sanitary survey, then the sanitary survey of that PWS must include an evaluation of the adequacy of the cybersecurity of that operational technology for producing and distributing safe drinking water." Specifically, "EPA's interpretation clarifies that the regulatory requirement to review the ‘equipment' and ‘operation' of a PWS necessarily encompasses a review of the cybersecurity practices and controls needed to maintain the integrity and continued functioning of operational technology of the PWS that could impact the supply or safety of the water provided to customers."
EPA specifies that during sanitary surveys of PWSs, states must:
Significant Deficiencies. In terms of cybersecurity, EPA states that "significant deficiencies should include the absence of a practice or control, or the presence of a vulnerability, that has a high risk of being exploited, either directly or indirectly, to compromise an operational technology used in the treatment or distribution of drinking water.
Approaches to Include the Assessment of Cybersecurity as Part of PWS Sanitary Surveys. EPA's memorandum provides different approaches that states could employ to evaluate cybersecurity at PWSs, including:
EPA Technical Assistance. To support implementation, EPA's memorandum references various resources for PWSs and states, such as:
Looking Ahead. EPA's memorandum requiring states to address the cybersecurity of PWSs follows quickly after the White House's release of its new National Cybersecurity Strategy, which calls for the need to use minimum cybersecurity requirements, as opposed to voluntary measures, in critical sectors to enhance national security and public safety. EPA's focus on cybersecurity accords with the Strategy's shift towards a more regulatory-focused cybersecurity approach.