New York’s New Water Systems And Public Utilities Cybersecurity Regulations

New York recently adopted significant cybersecurity regulations to safeguard critical infrastructure, covering both water systems (wastewater and drinking water) and public utilities. The new cybersecurity requirements are aimed at protecting such essential services from the ever-increasing threat of cyberattacks, which can disrupt services and impact public health. To combat this threat, the new regulations set minimum cybersecurity standards and provide grant funding and other resources to help covered entities come into compliance. Freedom of Information Law regulations were also updated to allow protection of confidential information related to cybersecurity incidents from public disclosure.

Wastewater

The New York State Department of Environmental Conservation (NYSDEC) updated wastewater discharge permit regulations to include cybersecurity obligations (6 NYCRR Parts 650 and 750). Key requirements include:

• Incident Reporting: As of March 2026, State Pollution Discharge Elimination System (SPDES) permit holders must report cybersecurity incidents within 24 hours of discovery. Additionally, a follow-up report must be submitted within 30 days.
• Response Planning: Publicly owned treatment works (POTWs) must establish, maintain and implement an Emergency Response Plan. Such plans are required to include a Cybersecurity Incident Response Plan within.
• Cybersecurity Controls: POTWs are required to establish, maintain and implement written rules and/or procedures for access control and authentication, including safeguards such as password security, multi-factor authentication and restrictions on default credentials.
• System Protection: POTWs must separate or secure connections between operational technology systems (i.e., equipment and machinery) and information technology systems (i.e., digital data and networks) through a written cybersecurity vulnerability management process and a written description of network structure.
• Monitoring: Network monitoring and logging is required for POTWs with design flow greater or equal to 10 million gpd.
• Compliance: Annual certifications and operator certification renewals are required.
   

Drinking Water

The New York State Department of Health (NYSDOH) adopted cybersecurity regulations for community water systems that serve more than 3,300 people (10 NYCRR Appendix 5-E). These community water systems are now required to implement:

• Response Planning: Review and update a Cybersecurity Vulnerability Analysis (CVA) at least annually and within 30 days of major water infrastructure changes, develop and establish compliance with a cybersecurity program informed by the CVA and create and maintain an incident response plan;
• Reporting: Report cybersecurity incidents to NYSDOH within 24 hours of discovery and report identified cybersecurity vulnerabilities to NYSDOH within 48 hours of identification;
• Mitigation: Begin or complete mitigation of such vulnerabilities within 120 days;
• Training: Verify that drinking water operators are trained in one-hour of basic level cybersecurity (with additional cybersecurity training for new certifications and renewal certifications).
   

In addition to the above requirements, community water systems serving more than 50,000 people must monitor and log the system’s network activity and designate a qualified individual to be responsible for the system’s cybersecurity program. The designated individual must certify that the water system has an active cybersecurity program every five years and submit an annual written report to the system’s governing body (i.e., the board, counsel, trustees, etc.) summarizing the cybersecurity program and any significant cybersecurity risks.

Covered community water systems are already obligated to comply with the incident reporting and training requirements, but have until Jan. 1, 2027, to become compliant with the additional requirements.

Public Utilities

The New York Public Service Commission (NYPSC) adopted information technology cybersecurity regulations for regulated public utilities companies, including electric, gas, steam and waterworks (with certain exceptions) (16 NYCRR Chapter XII). Key requirements include:

• Risk-Based Cybersecurity Programs: Regulated entities must conduct a risk assessment and tailor cybersecurity programs, which must perform specific core cybersecurity functions, to those risks.
• Governance: Public utilities companies must implement and maintain a cybersecurity policy (or policies), establish a written incident response plan and appoint a Chief Information Security Officer (CISO).
• Safeguards: Covered entities must implement access controls and authentication, limit user access privileges, encrypt sensitive nonpublic data, continuously monitor networks and conduct periodic testing.
• Risk Assessment: Public utilities companies must conduct a risk assessment of the organization’s information technology at least once every two years.
• Audits: Regulated entities must maintain audit trail records for at least three years, submit to audits by staff of the Department of Public Service’s Office of Resilience, Utility Security, Nuclear Affairs and Emergency Preparedness (the Department) upon request and cause third-party audits to be conducted on a yearly basis.
• Reporting: Covered entities must notify the Department within 72 hours of certain cybersecurity incidents.
• Certification of Compliance: A certification of compliance must be submitted to the Department yearly.
   

The regulations are effective as of June 1, 2027. However, a 180-day transitional period is provided for covered entities to come into compliance with the stated requirements.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.