Midsize and large public water systems across the U.S. are now eligible for a share of $9.5 million in federal grants aimed at protecting drinking water from cybersecurity threats and improving resilience to natural hazards.

On Aug. 5, 2025, the Environmental Protection Agency (EPA) announced it is accepting applications from public water systems that serve 10,000 or more people. The funding comes through the Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability program, with applications open until Oct. 6, 2025, according to the EPA.

This round of funding arrives amid growing concern over cyber threats targeting U.S. water and wastewater systems—part of broader efforts to disrupt critical infrastructure during geopolitical tensions or military conflict. The Water Information Sharing and Analysis Center (WaterISAC), a nonprofit that tracks security incidents in the water sector, says such threats are becoming increasingly common.

In 2024, WaterISAC received roughly 100 reports of cyber incidents from its members. But Jennifer Lyn Walker, the group’s Director of Infrastructure Cyber Defense, says the actual number of events is likely higher. “It’s not a matter of volume of attacks—it’s about what gets reported, disclosed, or even detected,” she explains.

Walker warns that utility size doesn’t matter to attackers. Threat groups range from individual criminals to state-sponsored actors such as China’s “Volt Typhoon”, which is expected to target U.S. critical infrastructure, including water systems, as early as 2027. “Known targeted sectors can’t be complacent, regardless of the volume of known attacks,” she said.

What the Grants Can Fund

EPA’s grant program supports a wide range of projects. For cybersecurity, eligible investments include:

• Multifactor authentication for staff and systems.
• Cybersecurity awareness training for employees.
• Protecting unsecured assets from internet exposure.
• Implementing threat monitoring and detection systems.
• Developing incident response plans.

If a utility already has these essentials in place, Walker suggests funds could go toward more advanced capabilities, such as proactive threat hunting or specialized monitoring tools.

The program also covers resilience projects beyond cybersecurity, such as:

• Improving water conservation and efficiency.
• Relocating or upgrading infrastructure damaged by natural hazards.
• Designing or building desalination facilities.
• Enhancing water supplies through watershed management and source water protection.
• Increasing energy efficiency or using renewable energy in water treatment and delivery.
• Forming regional partnerships to address documented water shortages.

To apply, utilities can visit Grants.gov and search for the program name.

In addition to funding, the EPA released Securing the Future of Water, Addressing Cyber Threats Today, a new guide produced by the Water Sector Cybersecurity Task Force. It offers 10 recommendations to strengthen cybersecurity in the sector, each with practical “priority actions” for utilities.

The recommendations and priority actions are:

• Enhanced collaboration and clear ownership – Assign clear responsibility, align plans and resources, and create a standing forum for coordination.

• Targeted communication for utility leaders – Develop a communication strategy, offer leadership-focused cybersecurity training, expand executive engagement, and integrate cybersecurity into leadership programs.

• Highlight basic, actionable practices – Promote a core set of practices: leadership commitment, staff training, blocking unauthorized access, and having incident response plans.

• Embed cybersecurity in utility culture – Provide ongoing webinars and resources, integrate cybersecurity into operator certification, and use consistent sector-wide messaging.

• Expand technical assistance – Offer more cybersecurity support, host virtual office hours, add CISA advisors, and start peer-to-peer mentoring.

• Secure dedicated financial resources – Include cybersecurity in budgets, ensure WaterISAC access, expand grant/loan eligibility, and fund state resilience coordinators.

• Address information gaps – Share attack summaries, maintain a best-practices hub, promote model policies, and provide real-world implementation examples.

• Engage vendors and consultants – Use model contracts, set clear cybersecurity principles, raise vendor awareness, and clarify expectations in agreements.

• Support state agency capacity – Partner with states on training, share successful program models, and equip field staff with cyber messaging.

• Increase partner resourcing and engagement – Leverage trusted partners for training and technical aid, engage major organizations, and grow the sector’s cybersecurity workforce.

The EPA says the combination of targeted funding and these recommendations can help utilities not just react to threats, but build lasting resilience against cyber and environmental challenges.