State utility regulators are preparing to take a formal position on one of the more exposed corners of American critical infrastructure: the cybersecurity of drinking water and wastewater systems.
A resolution set for consideration at the annual meeting of the National Association of Regulatory Utility Commissioners (NARUC) would call on Congress to fix funding gaps at the federal government's main cyber defense agency and to establish clearer rules for how water utilities protect themselves and share threat information, according to a report by VitalLaw.com.
A Push to Restore Federal Cyber Support
At the center of the resolution is the Cybersecurity and Infrastructure Security Agency, or CISA, which provides security guidance and support to operators of critical infrastructure. The measure asks Congress to address the agency's funding shortfall so it can continue serving water and wastewater utilities.
The resolution describes CISA as both underfunded and understaffed, noting that the agency has lost roughly a third of its workforce since 2025. It also points to a September 2026 announcement in which CISA said it would cut back on the free assessments it offers to critical infrastructure organizations, including water utilities.
Strengthening Information Sharing Across the Sector
Beyond CISA, the resolution calls for bolstering the Water Information Sharing and Analysis Center, known as WaterISAC. The group helps drinking water and wastewater operators exchange voluntary operational, physical and cybersecurity information and best practices.
The resolution also asks Congress to make information sharing a legal requirement. Under the proposal, water utilities would be obligated by statute to share details of cyberattacks with one another and with the government.
To encourage candor, that information would be shielded from Freedom of Information Act requests and public records inspections, and would not be released publicly. Confidentiality protections of this kind are often seen as a way to reduce the reputational and legal concerns that can make organizations reluctant to report incidents.
A New Body to Set Minimum Security Standards
Another major element would authorize the U.S. Environmental Protection Agency to create an independent, non-governmental Water Risk and Resilience Organization, or WRRO. The organization would be made up of sector experts tasked with developing minimum cybersecurity requirements for water and wastewater utilities.
The resolution argues that the lack of uniform standards leaves many systems exposed, citing recent cyberattacks affecting water utilities in at least 12 states. The proposed structure resembles approaches used elsewhere in the utility world, where industry-led bodies develop reliability and security rules under federal oversight.
A Sector Under Pressure From Threat Actors
The resolution frames water systems as attractive targets for both domestic and international attackers seeking to disrupt essential services or pursue criminal gain. It warns that many of these utilities "lack even basic cybersecurity protections."
Water systems in the United States range from large metropolitan operators to small local utilities with limited budgets and technical staff, which can make consistent security practices difficult to achieve without outside support or common requirements.
Who Is Behind the Proposal and When It Will Be Heard
The measure is sponsored by Michael Bange, a commissioner with the New Jersey Board of Public Utilities. It will be taken up during NARUC's annual meeting, which runs Sunday through Wednesday in San Juan, Puerto Rico.
NARUC represents the state commissions that regulate utilities, so a resolution from the group would signal broad concern among state-level regulators, though it would not by itself change federal law.
What the Resolution Signals for Infrastructure Security
The proposal reflects growing worry that reduced federal capacity could leave smaller utilities without the help they rely on. If adopted, it would add the voice of state regulators to calls for Congress to act.
For security vendors, utility operators and policymakers, the debate highlights a potential shift from voluntary guidance toward mandatory baseline standards and required incident reporting in the water sector. How Congress responds could shape the market for water cybersecurity services and the obligations utilities face in the years ahead.
Source: VitalLaw.com
