EPA Unveils New Cybersecurity Planning Tools for Water Systems

The agency’s latest tools will help public water systems nationwide strengthen cyber resilience, prevent disruptions, and protect access to safe drinking water.

• By Stasia DeMarco
• October 24, 2025

The EPA has released new and updated planning tools designed to help public water systems prevent and respond to cybersecurity incidents. The tools are intended to strengthen water infrastructure resilience and support utilities in risk assessment and emergency planning.

“Strengthening cybersecurity for the U.S. water sector is critically important because cyber resilience and water security are key to national security,” said Jess Kramer, EPA assistant administrator for water. “Water systems across the country are facing cyberattacks that threaten the ability to provide safe water. Guarding against cyberattacks is central to this mission.”

New and Updated Tools for Utilities

EPA developed several resources to address vulnerabilities and help utilities safeguard drinking water and wastewater operations:

• Emergency Response Plan (ERP) Guide for Wastewater Utilities: Updated to outline strategies and resources for responding to natural or man-made incidents that threaten health, property, or the environment.
• Template for Developing an Incident Response Plan: A new tool to help utilities create a Cybersecurity Incident Response Plan (CIRP).
• Incident Action Checklists: Two new checklists designed to help utilities prepare for, respond to, and recover from events such as wildfires, power outages, floods, and cyber incidents.
• Cybersecurity Procurement Checklist: A guide to help utilities incorporate cybersecurity into the procurement process and evaluate vendor cybersecurity practices.

Protecting Critical Infrastructure

EPA emphasized that cybersecurity for water systems is both a public-health and national-security issue. The agency continues to work with the Cybersecurity and Infrastructure Security Agency (CISA), state programs, and water associations to reduce cyber risks and implement best management practices.

In August, EPA announced more than $9 million in grants for midsize and large water systems to protect against cyber threats and improve resiliency for extreme weather events. The agency also published a report outlining ten recommendations to strengthen the water sector’s defenses.

Cyberattacks on water utilities have increased sharply in recent years, threatening drinking-water safety and wastewater treatment operations. EPA and its partners say ensuring the cybersecurity of these critical systems is essential to protecting communities, supporting industry, and maintaining reliable access to clean water.