Environmental Protection Agency Abandons Audit Requirement for Water Utilities

The Environmental Protection Agency has scrapped a March memorandum requiring cybersecurity audits of water utilities using sanitary surveys, citing legal challenges by some states and industry groups.

Experts had questioned whether sanitary surveys were appropriate given that some auditors were not qualified to assess industrial system cybersecurity, FedScoop reported Thursday.

Arkansas, Iowa and Missouri blocked the implementation of such checks a month after the rule was issued.

The American Water Works Association and the National Rural Water Association, two groups involved in the lawsuit blocking the rule, are advocating for a co-regulatory model where the EPA would oversee standards developed with industry input.

An agency spokesperson reaffirmed that improving the water sector’s cybersecurity remains a major priority and called on all states to review their respective programs to address vulnerabilities.

One of the main objectives of the White House’s National Cybersecurity Strategy is to strengthen critical infrastructure protections.

Officials have said the water sector is the most vulnerable in terms of cyberattacks.