—·
A GAO review reported cybersecurity gaps at 70% of water systems EPA inspected. The finding points to a practical infrastructure challenge: protecting essential services while making oversight and upgrades workable.
A forensic look at how known-exploited vulnerabilities, ransomware operations, and “secure-by-design” guidance translate into measurable enterprise controls and defensible governance.
Connected device compromises demand more than patches. This editorial maps advisory escalation to vendor accountability, hospital controls, and FDA-aligned evidence.
A defender-focused audit grounded in NIST CSF 2.0, CISA’s KEV catalog, and ransomware guidance, with measurable controls and evaluation steps.
When you turn on a tap, you rarely think about the computers helping keep water systems running. Yet GAO’s 2024 review found cybersecurity weaknesses in about 70% of the water systems EPA inspected. That finding applies to the inspected systems, not the country as a whole; without evidence that the group is representative, the percentage cannot tell us how many utilities nationwide have weaknesses. (GAO)
The policy significance lies less in extrapolating that percentage than in what it says about oversight. EPA inspections identified weaknesses, while GAO’s report also examined the agency’s role in addressing cybersecurity across the sector. The central questions are how risks are identified, what happens after a weakness is found and whether anyone checks that corrective work is complete. (GAO)
Water and wastewater facilities use digital tools to monitor and operate physical equipment, including pumps and treatment processes. Often called operational technology, or OT, these are the computers and controls that help run machinery rather than office software. A cyber incident affecting them could threaten operations, though the outcome would depend on a facility’s systems and safeguards. (NIST)
That dependence makes preparedness a practical infrastructure question. If a digital control or information operators rely on becomes unavailable, staff need to know how to recognize the problem, maintain essential processes where possible and escalate the incident. These are questions about operational readiness, not proof that every cybersecurity weakness will cause a service interruption. The available sources establish the need for attention; they do not establish a uniform outcome across utilities. (GAO; NIST)
The evidence points to a focused question: how can public agencies and utilities turn broad cybersecurity advice into practical, measurable work? The answer should distinguish three stages often blurred in public discussion: guidance issued, corrective action taken and risk reduction verified. A recommendation is a starting point; an inspection finding is evidence of a weakness. Neither, on its own, shows that the weakness has been fixed.
Water systems vary in size, equipment, staffing and capacity to pay for improvements. A small utility and a large regional provider may face different practical barriers, even when asked to follow the same general guidance. GAO’s review makes federal oversight part of the issue: authorities need a clearer picture of risk and whether systems are acting on it. (GAO)
EPA’s water-sector cybersecurity page gathers guidance and resources for utilities. Its recommendations offer a starting point, but a webpage cannot show whether a particular facility has completed a review, corrected a weakness or practiced responding to an incident. That gap between advice and verified work is central to the policy problem. (EPA)
For residents, the useful question is not whether a utility has published a cybersecurity plan, but whether it can explain how risks are assessed, who is responsible for addressing them and how service would be managed if a digital control were unavailable. Those questions do not require residents to judge technical systems. They make public reporting about essential infrastructure more concrete.
A real incident in Aliquippa, Pennsylvania, illustrates how a digital intrusion can touch physical water infrastructure. In November 2023, a cyberattack targeted equipment at a water facility operated by the Municipal Water Authority of Aliquippa. CBS News reported that the attack did not disrupt water service, while the affected equipment was taken out of operation. (CBS News)
The significance is not that every intrusion will have the same result. A system’s ability to continue service can depend on the facility’s response, including whether operators can keep processes running when a device is compromised or isolated. Aliquippa is a named example of an incident with a reported service outcome, not proof that other utilities face identical conditions. (CBS News)
EPA’s water-sector cybersecurity recommendations are intended to help utilities identify risks and strengthen their practices. The agency’s materials also describe federal actions to support water systems. But public sources do not provide a comparable, detailed outcome record for every utility that uses the guidance. Readers should distinguish recommendations and announcements from independently verified improvements at individual facilities. (EPA recommendations report; EPA announcement)
For water customers, the practical implication is straightforward: ask whether the utility has a response plan that accounts for equipment being unavailable, and whether staff rehearse that plan. The Aliquippa report shows that an incident can be contained without a reported service interruption, but it does not tell us how much time, cost or preparation that outcome required. (CBS News)
Guidance only becomes useful when it changes what a facility does--and when someone can tell whether that change happened. NIST’s publication on water and wastewater cybersecurity provides sector-specific guidance. CISA’s Cybersecurity Performance Goals offer voluntary practices intended to help critical-infrastructure organizations prioritize basic protections. CISA is the federal agency responsible for cybersecurity and infrastructure security. Neither source, by itself, verifies that an individual utility has adopted a measure, reduced its exposure or complied with the goals. (NIST; CISA)
A utility could make implementation visible by identifying the operational systems and processes whose loss would matter most, assessing relevant risks, assigning an owner and deadline to each priority corrective action, and testing whether staff can respond when equipment or digital information is unavailable. These are proposed reporting steps, not claims that the cited guidance requires a single standardized checklist. Their value is that they connect technical planning to management decisions and operational readiness.
The Water Sector Cybersecurity Task Force recommendations offer another bridge between general principles and utility practice. Their purpose is to set out actions for improving the sector’s cybersecurity. But a recommendation is not a completed upgrade, and the public document alone does not establish how many facilities have adopted each measure or what effect those steps have had. (EPA recommendations report)
EPA’s national cyber drill, listed for 2026, offers a different kind of test: an exercise in preparation rather than a report of a real attack. Drills can give participating organizations a chance to practise coordination and response. The EPA page’s existence confirms the planned exercise, but does not by itself verify who participated, what scenario was tested or what lessons were produced. (EPA 2026 National Cyber Drill)
Agencies should make the path from guidance to results visible. Utilities and regulators can report, in plain language, whether core risks have been assessed, whether response exercises occurred and whether identified problems have been addressed. Without that follow-through, residents cannot tell the difference between a useful recommendation and a safeguard that is actually in place.
Publishing another general recommendation will not solve the oversight problem. GAO’s review identifies areas where EPA needs to improve its cybersecurity efforts, making follow-up a key test of federal oversight: does an identified weakness lead to corrective action, and is there a way to establish whether that action was completed? The report makes EPA’s role part of the issue, but the evidence presented here does not support a claim that every utility faces the same risk or requires the same remedy. (GAO)
A separate EPA Office of Inspector General report adds an accountability layer by examining EPA’s cybersecurity work in the water sector. Published in 2025 and corrected through an errata document, the report concerns the agency’s work--not a facility-by-facility assessment of the entire water sector. Its relevance is that federal performance is also subject to review; its existence alone does not establish that a particular utility has resolved a particular weakness. (EPA Office of Inspector General)
The EPA OIG certificate dated May 2026 is another official oversight document. Because a certificate is not the same as a detailed public account of operational outcomes, it cannot stand in for evidence that water systems have resolved specific risks. Public discussion should keep the distinction clear between an agency action, an audit finding and a documented improvement. (EPA OIG certificate)
A useful public accountability framework would track the chain from finding to result without disclosing details that could expose a facility. Agencies could report, in aggregate, how many assessments were completed, how many priority deficiencies received an assigned corrective action and how many actions were verified as complete. These are proposed measures, not figures reported in the cited documents. They would let the public distinguish “guidance issued” from “work completed” while preserving sensitive operational information.
Cybersecurity spending competes with other demands on water infrastructure, from maintaining pipes to replacing aging equipment. The supplied sources do not quantify the cost of these competing needs or calculate the savings from particular cybersecurity investments. Any claim that a single security measure will prevent a service failure or reduce bills would go beyond the available evidence.
The evidence does support treating cybersecurity as part of operating and maintaining water infrastructure, rather than as an optional technology project. EPA’s guidance, NIST’s sector publication and CISA’s performance goals offer tools for planning; GAO and EPA’s inspector general provide oversight lenses; and the Aliquippa incident shows why response capability matters in practice. None, on its own, proves that a particular utility is fully protected. (EPA; NIST; CISA; GAO; CBS News)
For utilities, the next practical step is to use available guidance to identify their most consequential operational risks, assign responsibility for addressing them and practise a response that keeps essential service in view. For EPA, Congress and state regulators, the priority should be clearer follow-up and public reporting that separates recommendations issued from improvements verified. These actions would not eliminate risk, but they would make it easier to see where effort is needed and whether it is working.
Over the next two years, the value of EPA’s 2026 national cyber drill will depend on what follows the exercise: published lessons, clear assignments and measurable follow-up. EPA should make those outcomes accessible to water providers and the public, while protecting sensitive facility details. Demand follow-through, so a plan on paper becomes protection people can count on.