New York Implements Cyber Regulations Amid Rising Threats to Water Facilities

On March 11, 2026, New York Governor Kathy Hochul announced new cybersecurity regulations for drinking water and wastewater facilities, following a previous announcement in summer 2025. These regulations, described as 'first-in-nation,' require facilities to meet stringent standards, including new reporting requirements after incidents, vulnerability management procedures, and operational technology protection. Larger treatment plants must monitor network activity and operators must undergo cybersecurity training every five years. A $2.5 million grant program, the SECURE grant program, will support facilities in risk assessments and cybersecurity upgrades. The regulations come in response to heightened cyber threats linked to military conflicts in the Middle East, particularly from Iranian state actors and hacktivist groups. The Center for Internet Security has warned of potential low-level cyber activity targeting critical infrastructure. A joint advisory from ten information sharing groups highlighted a 'highly volatile' threat environment for water treatment facilities.

Key Points: • New York's new cybersecurity regulations for water facilities are the first of their kind. • Facilities must implement strict controls, including complex passwords and multifactor authentication. • A $2.5 million grant program will assist in cybersecurity assessments and upgrades.