|
October is Cybersecurity Awareness Month, a global campaign created to emphasize the importance of protecting both public and private entities' data from breaches by bad actors. Because water and wastewater companies provide essential services that the community depends on year-round, a cyberattack on these systems isn't just a technical problem. It can affect public health, economic stability and even threaten national security.
Utility cybersecurity refers to the technologies, policies, and practices used by energy, water, and gas providers to protect their digital assets, IT networks, and operational technology control systems from cyberattacks. A strong cybersecurity program keeps utilities running smoothly, protects the integrity of control signals and safeguards customer and operational data. The infrastructures of utilities were once made up of physical assets, but the implementation of various digital systems that improve efficiency and customer engagement has also opened utilities to cybersecurity threats.
In 2024, U.S. utilities and power infrastructure faced a nearly 70% increase in cyberattacks compared to 2023. According to the U.S. Department of Justice, in July and August 2026, municipal water and wastewater systems in seven to twelve states were victimized, with small agencies being more commonly attacked (by federal classifications, Ventura's water system is considered very large-sized and the wastewater system is medium-sized). Attackers changed device passwords, altered IP addresses, disabled alarms, and temporarily blinded operators, forcing facilities to switch to manual operations. Fortunately, no water supplies have been reported to be permanently contaminated or rendered unsafe.
To protect the City's utility, Ventura Water has done two risk assessments including one by the Cybersecurity and Infrastructure Security Agency (CISA), a branch of the Department of Homeland Security. Additionally, we ensure that we meet the requirements listed in America's Water Infrastructure Act (AWIA) Section 2013, which mandates Risk and Resilience Assessments and prepared and updated Emergency Response Plans. Systems must be reviewed, updated and recertified by the EPA every five years. Ventura Water's cybersecurity system is scanned weekly by CISA to make sure we don't have any exposed vulnerabilities that need to be addressed as well as getting daily notifications for any new vulnerabilities that may be popping up. A utility's ability to revert to manual controls to quickly restore operations is vital in the immediate aftermath of an incident. Ventura Water staff are critical disaster workers—in the event of a loss of remote capabilities we can provide around-the-clock staffing to continue operations.
Sponsored in 2025, the Water Risk and Resilience Organization Establishment Act would create an independent organization to develop and enforce minimum cybersecurity standards to large and midsize water and wastewater utilities. The American Water Works Association sent a letter to the House and Senate in support of the bill, but opponents have expressed concern that it excludes smaller systems and overly relies on industry deference.
The Water Cyber Shield Act of 2026 (S.5368) introduced this August, would grant the EPA explicit authority to conduct cybersecurity assessments and inspections, and enforce corrective action for significant vulnerabilities in water and wastewater systems. It addresses a gap left after previous EPA cybersecurity guidelines faced legal challenges from states and industry groups regarding explicit statutory authority. This federal bill is in the initial stages of the legislative process and could be brought to the full Senate floor for a vote as soon as the end of the year.
| 
