Water and wastewater utilities
Ready for New York’s new water and wastewater cybersecurity rules
Already have an IT provider? Here's how we work together.
An example
Consider a village water system serving 5,000 people, run by two licensed operators. The plant’s control system can be reached remotely, so an operator can check alarms from home at night.
New York’s Department of Health has adopted cybersecurity rules for public water systems. Incident reporting already applies. For community systems serving more than 3,300 people, like this one, most of the other requirements apply from January 1, 2027. The village board asks the chief operator whether the system is ready. The operator knows the plant. The rule is new to everyone.
The Problem
New York has adopted two sets of cybersecurity rules: the Department of Health rules for drinking water and the Department of Environmental Conservation (DEC) rules for wastewater. Both require incident reporting now. The rest comes later: most drinking-water requirements apply from January 1, 2027, for community systems serving more than 3,300 people; wastewater treatment works must have their emergency response plan and cybersecurity controls in place by March 11, 2027, and file their first yearly certification with DEC by March 28, 2027.
Most utilities have small staffs focused on treatment, not on security programs. The control systems that run pumps and treatment are different from office computers, and changing them needs care. Grants are available through the New York State Environmental Facilities Corporation (EFC) SECURE program, but they need a clear assessment and plan to unlock.
The dates are fixed. The time to find the gaps is before them, not after.
What we do
A NIST CSF 2.0 assessment across all six functions, with current and target profiles.
A regulatory gap analysis that ties every finding to the provision of the DOH or DEC rule it affects.
A prioritized plan of fixes, with rough costs, that can feed an implementation grant application and the capital plan.
An executive summary written for the board and the funder.
An incident response plan that covers the reporting rules, and a tabletop exercise with operators and leadership.
Who does what
Security Medic
Leads the security program: assesses, writes the plan and the policies, specifies the controls that must be put in place, reports to leadership, and checks that the work was done.
Operators and your control-system integrator
Run and change the plant’s control systems (SCADA, PLCs and telemetry). Hands-on testing of those systems in the field is specialist work that we do not perform; when a scope needs it, the proposal names who does it.
Your IT staff or IT provider
Run the office network, email and accounts. We specify what must be in place and check the result.
The board or commissioners
Approve the plan and the budget, and sign off on what is reported to the state and to funders.
What must be met, and how it is met
An obligation is what the organization must meet: a law, a regulation, a contract or a grant condition. A standard is how it is met and checked. The NIST Cybersecurity Framework (CSF) 2.0 connects them, so one program and one body of proof serve every obligation.
Obligations that commonly apply
- NY Department of Health drinking-water cybersecurity rules (10 NYCRR Subpart 5-1, Appendix 5-E). For community water systems serving more than 3,300 people. Incident reporting applies now, and most requirements apply from January 1, 2027.
- NY DEC wastewater cybersecurity rules (6 NYCRR Parts 616, 650 and 750). For publicly owned treatment works and their operators. Adopted March 11, 2026. Now: cyber incidents are reported to DEC within 24 hours. From March 11, 2027: an emergency response plan and cybersecurity controls in place. By March 28, 2027, and each year after: a certification to DEC that the treatment works complies.
- NY General Municipal Law Article 19-c. Cyber incident reporting to DHSES within 72 hours, and ransom payment reporting within 24 hours, for municipalities and public authorities.
- EFC SECURE grant conditions. SECURE funds cybersecurity assessments for water and wastewater systems, followed by implementation grants for the fixes. Each grant comes with its own scope and reporting conditions.
Standards we use to meet them
- NIST CSF 2.0. The framework we use to assess the utility and to connect the DOH, DEC and grant requirements in one program.
- CISA Cross-Sector Cybersecurity Performance Goals (CPGs) 2.0. A free minimum baseline for utilities and other critical services, aligned to CSF 2.0.
- NIST SP 800-53 Rev. 5 with SP 800-53A. The detailed controls, and the methods to check them: examine, interview, test.
Which obligations apply depends on the organization; the free assessment and the first call sort that out.
Security Medic is independent. We assess against these laws, standards and frameworks as a reference. We do not certify, we are not legal counsel, and we are not affiliated with the agencies and bodies that publish them.
The first step is free
Before anything is bought, the organization should know where it stands. The free assessment shows that, at no cost and with no obligation.
- 1
Free 30-minute call (optional)
Talk through the rule, the grant or the deadline, and what the organization needs.
- 2
Free assessment
Answered online, in plain language. No technical knowledge is needed.
- 3
Gap report
Where the organization stands, the gaps that matter most, and the path to close them.
- 4
Free results review
We walk through the report together and answer questions.
If more work makes sense, it is scoped in writing against the named obligation: a scoped assessment, then audit preparation rounds where a formal review or deadline is coming. When the work has to go through procurement, the gap report helps write a scope that fits the need.
When to talk to us
The best time is before an RFP is written. By the time a solicitation is posted, the scope is set. Earlier, a free assessment can show what the organization actually needs, so the work that follows is the right work.
- When EFC announces SECURE awards, or before applying for one.
- Now, if the system has not yet measured itself against the new requirements.
- Before the capital plan and next year’s budget are set, so the fixes are funded.
- Before writing an RFP for a cybersecurity assessment, so it asks for what the utility actually needs.
How public bodies can work with us
Through an RFP
We respond to solicitations as the prime contractor or as a named subcontractor on another firm’s team.
Direct purchase
Where the organization’s procurement policy allows a direct purchase or quotes, we provide a written proposal for the scope.
Grant-funded work
When a grant pays for an assessment or plan, we scope the work to the grant’s conditions and reporting.
Procurement officers will find our company details and what to expect in a response in the bid kit.
Start with a free 30-minute call
Bring the rule, the grant or the deadline. We will talk through where the organization likely stands and what a first step would cover.
Book a free call