New York awards $9M to secure 153 water systems

Governor Kathy Hochul announced on Monday that New York will award more than $9 million through the Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) grant program to 153 drinking water and wastewater systems. Utilities may receive up to $50,000 for cybersecurity assessments and up to $100,000 for implementing security upgrades. Recipients will also receive no-cost technical assistance from the New York State Environmental Facilities Corporation (EFC).

Governor Kathy Hochul warned that ‘These threats are real and escalating.’

The grants are intended to help utilities meet minimum cybersecurity standards the state introduced in March. Those standards include mandatory cybersecurity training for certified operators, incident reporting rules, risk-based protections for critical operations and sensitive data, and a requirement that larger drinking water systems designate a cybersecurity lead.

The funding announcement follows a coordinated cyber campaign in late July that targeted operational technology at water and wastewater facilities. More than 30 community water systems in Minnesota experienced attempts to disrupt automated control functions on July 26 and 27; some municipalities reported temporary control disruptions and the city of Braham briefly took its water plant offline. Investigators later reported similar activity affecting systems in at least seven states, including Michigan, South Dakota and Georgia. Federal investigators have not formally attributed the incidents.

After the July incidents, the U.S. Cybersecurity and Infrastructure Security Agency advised operators to remove publicly exposed programmable logic controllers and other operational technology from the internet, change default passwords, channel remote access through secure gateways or virtual private networks, and restrict connections to trusted IP addresses. New York’s SECURE recipients will be encouraged to adopt those protections as part of their upgrades.

The $9 million in SECURE grants is separate from a five-year, $3.8 billion clean water infrastructure package included in the state’s fiscal year 2027 budget. State officials noted that larger investment brings New York’s total water infrastructure grants since 2017 to more than $10 billion, covering capital projects as well as cybersecurity and resiliency work.

The SECURE program is targeted at utilities that lack dedicated cybersecurity staff. By funding assessments first, the program aims to produce prioritized plans for upgrades that implementation awards and EFC technical assistance can support. Utilities receiving grants are expected to follow the state’s reporting and training requirements and to designate staff to oversee cybersecurity for their systems.