Why U.S. Water Systems Remain Vulnerable

I became Wisconsin's CISO in 2023. That same year, the Environmental Protection Agency (EPA) made a rule requiring a cybersecurity review as part of the sanitary surveys each state already conducts on public water systems. States and water industry groups immediately sued, arguing the agency had exceeded its authority and mandatory audits would impose a heavy cost on small towns and private operators.

So, the EPA withdrew the rule, instead making cybersecurity assessments a "strong recommendation."

Next, we tried persuasion. Working with the CIO and CISO at the Wisconsin Department of Natural Resources, we asked facilities to let the state help them assess where they stood. We didn't want to punish anyone. We just wanted to give operators good documentation they could use to build a case for more funding and resources.

Most said no, even to "free" federally funded assessments via CISA. Wisconsin has more than 600 municipal water and wastewater facilities, and thousands more that are local or privately held. When I left the CISO role two years later, exactly two had registered for the voluntary assessments.

I didn't like it, but I understand the reasoning behind their refusal.

These operators are not ignorant or indifferent to these risks. What they told me, in so many words, is that a list of findings they had no staff or budget to fix was not actually assistance. In their mind, it was just more liability.

Once a vulnerability is documented; someone must answer for it. If the money to address it doesn't exist, then an assessment simply converts an invisible threat into a visible problem, while changing nothing on the ground.

Bottom line, who wants to highlight a problem when there's nobody willing to pay for the solution?

It's frustrating because I know this work can be done, because I've seen it happen. In preparation for the Republican National Convention in Milwaukee, local water and wastewater facilities were tested and controls were put in place. It took months, not years and it happened because there was federal attention, an immovable deadline and resources behind it.

Obviously, we can't create a national political convention in every county across our county.

However, we can do more to make remediation much more realistic as we move forward.

Here's three changes would matter more than any mandate.

• Fund remediation, not assessment.
  Grant programs that pay someone to identify problems, without paying to fix them, produce paperwork and little else. We directed $18.5 million in State and Local Cybersecurity Grant Program subawards in Wisconsin, and I saw clearly what that money can and cannot do. The matching funds and sustainability requirements discouraged many would be applicants. In fact, assessment dollars without remediation dollars are worse than nothing, because they teach operators that engaging with the process creates more exposure while relieving none of their pain.
• Share the workforce.
  Rural water systems already rely on circuit riders, technical staff who serve many utilities across a region rather than one. The model exists and the sector understands it, so why not fund cybersecurity circuit riders and let them work across jurisdictional lines. It may be the only realistic way to give a rural plant with two employees access to someone who knows how to secure a controller
• Ask for less.
  Four tangible actions can prevent most of what we're reading about in the headlines: Do not expose controllers the public internet and cellular services without validating prudent controls are in place, replace end of life equipment, remove and or change default credentials; harden configuration settings, keep offline copies of project files / control logic; and, test the manual fallback procedure so that it exists before anyone needs it. These are all fundable, achievable and verifiable.