News and announcements

Today, the Cybersecurity and Infrastructure Security Agency (CISA), Environmental Protection Agency (EPA) and Federal Bureau of Investigation (FBI) published a fact sheet, Top Actions for Securing Water Systems, to aid water and wastewater systems sector stakeholders with reducing their cyber risk and improving resilience to cyberattacks. 

The fact sheet contains eight actions along with available resources and services to help organizations implement each action. Those actions are:

1. Use cyber hygiene services to reduce exposure of key assets to the public-facing internet.
2. Conduct a cybersecurity assessment on a regular basis to understand and prioritize existing vulnerabilities.
3. Require unique, strong, and complex passwords for all water systems, including connected infrastructure – DO NOT USE default passwords.
4. Create an inventory of software and hardware assets, which will help your security team understand what needs to be protected.
5. Develop and exercise cybersecurity incident response and recover plans so everyone understands roles, responsibilities and reporting requirements.
6. Regularly backup OT/IT systems so you can recover to a known and safe state in the event of a compromise.
7. Mitigate known vulnerabilities, especially known exploited vulnerabilities, and keep all systems up to date with patches and security updates.
8. At a minimum, conduct annual cybersecurity awareness training to help all employees understand the importance of cybersecurity and how to prevent and respond to cyberattacks.

Every WWS executive, leader and IT security professional should be familiar with the information in this fact sheet and ensure appropriate actions are taken. WWS organizations should also ask their software manufacturers and vendors how they are adopting Secure by Design principles and tactics within their products to mitigate cybersecurity threats.

For more information, please visit cisa.gov/water.