The U.S. Environmental Protection Agency (EPA) has released a new set of tools aimed at helping drinking water and wastewater utilities protect against cyberattacks. The resources are part of a growing federal effort to improve the resilience of critical infrastructure after a series of high-profile cyber incidents targeting water systems in recent years.

The release includes an updated Emergency Response Plan Guide for Wastewater Utilities, a Cybersecurity Incident Response Plan template, new Incident Action Checklists for events such as floods, power outages, and cybersecurity breaches, and a Cybersecurity Procurement Checklist to help utilities assess vendor and supplier risks before purchase.

EPA Assistant Administrator for Water Jess Kramer said the move underscores the connection between cybersecurity, water safety, and national security. In a statement, Kramer noted that cyberattacks threaten the ability of utilities to deliver safe drinking water and that “guarding against cyberattacks is central” to ensuring access to clean, reliable water across the country.

The new materials were developed with support from the Cybersecurity and Infrastructure Security Agency (CISA), state programs, and water sector associations. EPA says the goal is to give utilities of all sizes practical tools for planning, prevention, and emergency response.

The agency’s action builds on its Powering the Great American Comeback Initiative and follows the August announcement of more than $9 million in federal grant funding for midsize and large systems to strengthen cybersecurity and climate resilience.

Still, industry groups and local utilities have raised concerns that while the guidance is valuable, implementation remains a challenge, particularly for small and rural systems with limited staff or outdated technology. Groups like the American Water Works Association (AWWA) and the National Rural Water Association (NRWA) have long called for more funding, technical assistance, and workforce training to accompany federal mandates and recommendations.

Cyberattacks targeting water systems have been increasing, with incidents in several states underscoring the potential risks to public health and safety. A successful attack can disrupt service, damage equipment, or in some cases, alter chemical treatment processes.

EPA officials emphasize that the new resources are voluntary and meant to “meet utilities where they are,” offering flexible templates that can be adapted to systems of any size.