The Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation and Environmental Protection Agency recently published a guide to assist owners and operators in the water and wastewater systems sector with best practices for cyber incident response and information about federal roles, resources and responsibilities for each stage of the
response lifecycle.

Developed in collaboration with over 25 water/wastewater industry, nonprofit and state/local government partners, this resource covers the four stages of the incident response lifecycle:  

1. Preparation: Water/wastewater sector organizations should have an incident response plan in place, implement available services and resources to raise their cyber baseline and engage with the water/wastewater sector cyber community.  
2. Detection and analysis: Accurate and timely reporting and rapid collective analysis are essential to understand the full scope and impact of a cyber incident. The guidance provides information on validating an incident, reporting levels and available technical analysis and support.   
3. Containment, eradication and recovery: While water/wastewater sector utilities are conducting their incident response plan, federal partners are focusing on coordinated messaging and information sharing, along with remediation and mitigation assistance.  
4. Post-incident activities. Evidence retention, using collected incident data and lessons learned are the overarching elements for a proper analysis of both the incident and how responders handled it.  

“The water and wastewater systems sector is under constant threat from malicious cyber actors. This timely and actionable guidance reflects an outstanding partnership between industry, nonprofit and government partners that came together with EPA, FBI and CISA to support this essential sector. We encourage every water/wastewater sector entity to review this joint guide and implement its recommended actions,” says CISA executive assistant director for cybersecurity, Eric Goldstein. “In the new year, CISA will continue to focus on taking every action possible to support ‘target-rich, cyber-poor’ entities like water/wastewater sector utilities by providing actionable resources and encouraging all organizations to report cyber incidents. Our regional team members across the country will continue to engage with water/wastewater sector partners to provide access to CISA’s voluntary services, such as enrollment in our Vulnerability Scanning, and serve as a resource for continued improvement.”  

"The Water and Wastewater Systems Sector is a vital part of our critical infrastructure, and the FBI will continue to combat cyber actors who threaten it,” says assistant director Bryan Vorndran of the FBI’s cyber division. “A key part of our cyber strategy is building strong partnerships and sharing threat information with the owners and operators of critical infrastructure before they are hit with an attack.”   

Cyber threats to the water sector represent a real and urgent risk to safe drinking water and wastewater services that our nation relies on, according to EPA assistant administrator for water Radhika Fox. “The incident response guide assists utilities with approaches for collaboration with federal entities on lowering cyber risk in our nation’s drinking water and wastewater systems. EPA is committed to working with our federal, state and water sector partners to increase the sector’s resilience and improve cyber-resilience practices.” 

All utilities are encouraged to use this incident response guide to augment their incident response planning and collaboration with federal partners and the sector during and following a cyber incident. Familiarity with this guide will better prepare utilities to respond to, and recover from, a cyber incident.  

For more information and resources, utilities can visit CISA’s Water and Wastewater Systems Cybersecurity webpage.