Today, U.S. Environmental Protection Agency (EPA) is highlighting progress protecting water systems from cyberattacks in 2025. EPA’s Office of Water (OW) proactively identified cybersecurity vulnerabilities at 277 water systems and worked to fix the issues with individualized solutions ranging from authentication protocols to enforcing strict access controls along with other technical updates and restrictions. Cyber weaknesses included critical system components, such as technologies that control drinking water and wastewater processes, that are attractive targets to potential threat actors. This work is critical to safeguarding public health and economic growth to advance the goals of the agency’s Powering the Great American Comeback initiative.
“Access to clean and safe water is foundational to healthy people and environmental protection, thriving businesses, domestic manufacturing, AI, and agricultural production. The threat of cyberattacks is a relatively new and growing concern that water systems must proactively address,” said EPA Assistant Administrator for Water Jess Kramer. “EPA is doing everything within its authority to help water systems tackle cybersecurity threats, including directly eliminating 350 vulnerabilities in 2025. Many cybersecurity solutions are free or low-cost practices that can make a real difference. We are committed to working with our partners in federal, state and local governments to ensure that all water systems are cybersecure.”
Strengthening cybersecurity for water systems is a public health and a national security priority, and EPA is working in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), states, and water associations to help reduce the risk of cyberattacks. EPA and its partners encourage water systems to implement basic cybersecurity best practices, including reducing exposure of operational technology assets to the public-facing internet, developing and maintaining an asset inventory, and implementing robust authentication protocols including strong passwords and multi-factor authentication. EPA supports water systems with implementing these controls by providing free cybersecurity assessments and technical assistance.
In August, the Trump EPA announced over $9 million in grant funding for midsize and large water systems to help protect drinking water from cybersecurity threats and improve resiliency for extreme weather events. The agency also published a report highlighting 10 recommendations to strengthen resiliency to cyberattacks in the water sector. EPA has developed several resources to support water system cybersecurity and released new online tools in October of 2025.
