New York State Steps Up Cybersecurity Measures with $9 Million Grant Program for Water Systems
A significant step has been taken by New York Governor Kathy Hochul to bolster the cybersecurity defenses of 153 drinking water and wastewater systems across the state. The governor announced a grant program worth over $9 million, aimed at helping local utilities comply with minimum cybersecurity standards introduced in March this year.
The funding will be used to conduct cybersecurity assessments and implement security improvements at participating facilities. Recipients will also have access to no-cost technical assistance from the New York State Environmental Facilities Corporation (EFC). This comprehensive approach is designed to help prevent potential cyber threats, which could compromise public health and safety.
The initiative comes in response to a growing concern about the vulnerability of water infrastructure systems to cyberattacks. In recent weeks, a coordinated campaign targeting operational technology systems at water and wastewater facilities across the United States has raised alarm bells. The attacks, attributed to an Iranian threat actor, have affected over 30 community water systems in Minnesota, among other states.
While no New York utility has been publicly linked to these attacks, Governor Hochul emphasized that “these threats are real and escalating.” To mitigate this risk, the governor’s office highlighted the importance of implementing robust cybersecurity measures, including mandatory training for certified operators, incident reporting requirements, and designating a cybersecurity lead at larger drinking water systems.
The $9 million grant program is part of New York State’s ongoing efforts to enhance its water infrastructure. In addition to this initiative, the state has allocated a five-year, $3.8 billion clean water infrastructure investment in its fiscal year 2027 budget. This injection of funds will bring the total water infrastructure grants provided by the state since 2017 to over $10 billion.
The recent cyberattacks on water systems have served as a stark reminder of the need for vigilance and proactive measures to prevent potential threats. As a result, the US Cybersecurity and Infrastructure Security Agency (CISA) has urged operators to remove publicly exposed programmable logic controllers and other operational technology from the internet, change default passwords, and restrict connections to trusted IP addresses.
For water system operators and cybersecurity professionals alike, this development serves as a timely reminder of the importance of staying ahead of emerging threats. By prioritizing cybersecurity and investing in robust measures to protect critical infrastructure, we can mitigate potential risks and ensure public safety.
As a practical takeaway for readers, it’s essential to note that while this grant program is specific to New York State, the principles and recommendations outlined by CISA are universally applicable. Water system operators nationwide should take heed of these warnings and implement necessary cybersecurity measures to safeguard their facilities against potential threats.
Source: SecurityWeek — 2026-08-04