In a sector where a compromised programmable logic controller can alter chemical dosing or overflow a storage tank, water utility cybersecurity has moved from an IT back-office concern to a matter of public safety. Senators Adam Schiff (D-Calif.) and Amy Klobuchar (D-Minn.) have introduced legislation directing the EPA to develop tiered cybersecurity standards for drinking water and wastewater systems, in consultation with CISA, NIST, and water sector stakeholders. The bill responds to a wave of attacks that have exposed internet-facing PLCs, SCADA HMIs, and remote terminal units across the operational technology stack.
Why Water Utility Cybersecurity Has Become an OT Priority
Water and wastewater systems were once isolated, electromechanical operations. Today they run on networked supervisory control and data acquisition (SCADA) platforms, PLCs, and remote terminal units that let operators monitor treatment and distribution from offsite locations, sometimes through third parties.
That connectivity has inverted the traditional security model. In operational technology, availability and safety outrank confidentiality, meaning a lockout of a PLC can be more damaging than a data breach. Threat actors have learned to exploit exactly that reality.
Analyst Insight
CISA's July 2026 alert on PLC targeting in the water and wastewater sector marks a turning point. Attackers are no longer just stealing data; they are changing IP addresses, resetting passwords, and physically disconnecting controllers. That is an availability attack on public infrastructure, and it resets the security calculus for every asset owner and integrator.
Recent incidents reshaping water utility cybersecurity
-
January 2024 — Muleshoe, Texas: A water tank overflowed after threat actors used default credentials to access control systems.
-
October 2024 — American Water: The largest regulated U.S. water utility shut down its billing systems following a cyberattack affecting millions of customers.
-
2024 — Waterfall/ICS Strive OT Cyber Threat Report: Documented seven new consequential attacks or near misses targeting water utilities.
What the Schiff-Klobuchar Legislation Proposes
The bill tasks the EPA with building a tiered framework, with graduated requirements scaled to system size and risk, rather than a one-size-fits-all mandate. That approach acknowledges the reality of roughly 52,000 U.S. drinking water systems, many serving communities under 50,000 people with limited staffing and budget.
CISA and NIST would shape the technical baseline while water sector stakeholders provide operational context. The proposal also channels additional federal funding to help utilities meet new obligations and shields the sensitive cybersecurity information utilities submit from public disclosure.
Market Trend
Tiered regulation mirrors the direction already set by CISA's asset inventory guidance, which classifies SCADA and emergency shutdown systems as high-criticality and groups PLCs and remote terminal units as medium-criticality. Utilities and integrators that map asset criticality now will be ahead of the compliance curve.
What Integrators and Asset Owners Should Watch
For system integrators and OEMs serving the water sector, the bill signals that cybersecurity will become a design requirement rather than a retrofit. PLC configurations, HMI exposure, and remote access paths will face closer scrutiny as standards take shape.
Early movers should align with CISA's foundational guidance: inventory OT assets, remove internet-facing PLCs and HMIs, and segment control networks from IT environments.
FAQ: What does this mean for PLC and SCADA security?
The legislation would require the EPA to establish tiered cybersecurity standards developed with CISA and NIST. In practice, that elevates baseline controls for PLCs, SCADA systems, and HMIs, including secure remote access, credential management, and asset inventory, across drinking water and wastewater utilities.
FAQ: Will utilities receive funding to comply?
Yes. The bill provides additional federal funding to help drinking water and wastewater utilities implement the new standards, alongside protections for sensitive cybersecurity information submitted to the EPA.
