A new cyber grant program and new cybersecurity regulations for water and wastewater systems, announced Tuesday, aim to support water system resilience and protect public health in the state of New York.
New York state is investing in the cyber resilience of its water and wastewater systems with new regulations and a grant program, which will work together to boost the security posture of critical infrastructure.
The new regulations follow multi-agency coordination in which the state departments of Health (DOH) and Environmental Conservation (DEC) unveiled proposed regulations related to water and wastewater systems for public comment. The state Department of Public Service also released regulations addressing waterworks corporations, other public utilities and cable television companies for public comment.
“As cyber threats to infrastructure continue to rise, these regulations will help water and wastewater system operators better defend against attacks that could disrupt service, threaten public health, or damage trust,” Colin Ahern, the state’s chief cyber officer, said in a statement. Public feedback will be reviewed by the three agencies before regulations are finalized, he said.
DEC will accept public comment until Sept. 3; DOH and the Public Service Commission (PSC) will accept public comment until Sept. 14.
Entities will have until Jan. 1, 2027, to comply with DEC and DOH adopted regulations, and until Jan. 1, 2026, to meet PSC’s adopted regulations.
In addition to the new regulations, the New York Environmental Facilities Corporation is establishing a cyber grant program to secure water and wastewater systems.
The DEC, DOH and the Department of Public Service worked with one another to align on the program’s definitions and provisions. One goal was to reduce duplicative or conflicting requirements for more efficient processes. The agencies also worked to ensure the new regulations are in parallel with guidance issued by the U.S. Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency.
The Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements program, funded by $2.5 million in the fiscal year 2026 budget, will offer competitive grants to support cybersecurity risk assessments, which can help protect critical infrastructure. The grant funding will also support efforts to align with the new regulatory requirements when adopted.
Cyber attacks on critical infrastructure can have “devastating impacts,” Gov. Kathy Hochul said in a statement: “These new regulations and grant program reflect our commitment to protecting public health and safety while helping under-resourced entities modernize for a digital age.”
