Industries · Water & wastewater
New York’s water cyber rules are already in force.
In March 2026 the Department of Health and the Department of Environmental Conservation each adopted cybersecurity rules — DOH for drinking water, DEC for wastewater. Incident reporting already applies. The first major compliance date is 1 January 2027. If your municipality runs a water plant, a sewer plant, or both, this page sets out what you now owe and when.
Every requirement below is taken from the adopted rule text, linked at the bottom of the page. No pitch, and nothing held back for the call.
The dates that matter
Current as of
Both rules were adopted on the same day, but they phase in on different schedules.
- 11 Mar 2026Both rules adopted. DOH incident reporting and operator training take effect immediately for drinking water systems.
- 26 Mar 2026DEC incident reporting takes effect for every SPDES permit holder.
- 1 Jan 2027DOH: the rest of Appendix 5-E applies — the vulnerability analysis, the cybersecurity program, and the incident response plan. DEC: new operator training applies to certifications expiring on or after this date.
- 11 Mar 2027DEC: emergency response plan and cybersecurity controls in place at every publicly owned treatment works.
- 28 Mar 2027DEC: first annual certification due, then every 28 March after.
Does this apply to us?
Almost certainly, if you run a sewer plant. The DEC rule has no size threshold for publicly owned plants, so towns too small for the drinking water rule are still covered on the wastewater side.
- DOH · over 3,300 served
- Community water systems serving more than 3,300 people must meet all of Appendix 5-E. Non-community systems are not covered.
- DOH · over 50,000 served
- Additional duties: a designated cybersecurity lead, monitoring and logging, and a signed certification of program compliance.
- DOH · every certified operator
- Cybersecurity training applies to all certified drinking water operators, whatever the size of the system.
- DEC · every SPDES permit
- Incident reporting applies to every SPDES permit holder, public or private, of any size.
- DEC · every POTW
- The emergency response plan, the cybersecurity controls, and the annual certification apply to every publicly owned treatment works, of any size.
- DEC · 10 MGD and up
- Logging applies to plants with a design flow of 10 million gallons a day or more.
The exemptions are narrower than they sound
DOH exempts a system only where operational technology has no physical or logical connection to IT or any outside network — and even then the incident response plan and incident reporting still apply. A remote-access tool your integrator uses, a cellular modem at a pump station, or a historian that copies data to the office network is a connection. And on the DEC side, contracting out operations does not contract out responsibility: the permittee stays accountable.
What do the rules actually require?
The two rules overlap heavily, and the same assessment and documentation can serve both. The obligations, in plain language:
Drinking water — DOH, 10 NYCRR Appendix 5-E
- Report a cybersecurity incident to DOH within 24 hours of determining it has created or may create a public health hazard.
- Complete a cybersecurity vulnerability analysis covering IT and operational technology, on the DOH-approved form, as part of your water supply emergency plan. Update it at least annually, and within 30 days of a major infrastructure change.
- Report vulnerabilities that affect compliance or may pose a risk to public health to DOH within 48 hours of identifying them.
- Run a cybersecurity program built on that analysis: multi-factor authentication for remote access to operational technology, least-privilege access, separate IT and operational accounts, no default passwords, an annual access review, a cyber asset inventory, and tightly limited remote access.
- Keep a written incident response plan inside the emergency plan.
- Over 50,000 served: name a qualified cybersecurity lead, report to the governing body at least annually, keep logs, and certify program compliance with the emergency plan submission.
Wastewater — DEC, 6 NYCRR Parts 616, 650, and 750
- Report a cybersecurity incident orally to your Regional Water Engineer within 24 hours of becoming aware of it, with a written report within 30 days.
- Keep an emergency response plan — your existing plan or the EPA template — with a cybersecurity incident response plan built into it, and secure copies on and off site.
- Put access control rules in writing: least privilege, password standards, multi-factor authentication for remote access to operational technology, and no default credentials.
- Put a vulnerability management process in writing: an asset inventory, which assets can be reached remotely, known vulnerabilities, risk ratings, and how they are fixed.
- Describe the network in writing, showing how operational technology is separated from IT and outside networks, or how necessary connections are secured.
- Certify compliance every year by 28 March, signed by the principal executive officer or ranking elected official.
What neither rule requires
Tabletop exercises. DEC recommends them and they are good practice, but neither rule mandates one. Be wary of anyone selling a requirement that is not in the text — the rules are short enough to check.
What should we be doing right now?
- Know who reports an incident, to whom, and how — DOH for drinking water, your Regional Water Engineer for wastewater. Both clocks are 24 hours, and both already apply.
- Find out which of your systems are connected to anything. That single question decides how much of the DOH rule applies, and it is the first thing the vulnerability analysis needs.
- Get your operators’ training on the calendar. It is tied to certification renewal, and the course must be state-approved.
- Start the vulnerability analysis now if you are under the DOH rule. 1 January 2027 is the date it must exist, not the date to begin it.
On funding
The state’s SECURE grant program, run by the Environmental Facilities Corporation, funded cybersecurity assessments and improvements for municipal water and wastewater systems in 2026. The first round closed on 15 May and awards were announced in August. No further round has been scheduled. If one opens, an assessment that maps cleanly to the rule text is the strongest thing you can bring to the application.
What is this actually going to look like?
Three groups of people, each doing the part only they can do. The rules are written for the plant, so the plant’s people are in the room from the start.
Your operators and SCADA engineers
They know how the plant actually runs — every remote connection, every vendor login, every pump station modem. The assessment is only as accurate as what they tell us, and any change to the control system is theirs to make.
Us
We run the vulnerability analysis and prepare the documentation with you and your SCADA engineers: access control rules, the vulnerability management process, the network description, the incident response plan, and the evidence behind the annual certification. We map each piece to the rule text, so whoever reviews it can see exactly what it answers.
Your chief executive or elected official
The DEC certification is signed by your principal executive officer or ranking elected official — not by us, and not by your engineers. We make sure they know what they are signing and that the documentation behind it holds up.
The order it happens in
- Map what is connected. Walk the plant, the pump stations, and the office with your operators and SCADA engineers, and record every path into operational technology.
- Run the vulnerability analysis. Rate each risk on likelihood and consequence across source, treatment, distribution, and storage, and list what fixes it.
- Fix what matters first. Remote access and default credentials are usually the cheapest, largest risks, and multi-factor authentication on remote access is required under both rules.
- Write it down. Access rules, the vulnerability process, the network description, and the incident response plan, folded into the emergency plans you already keep.
- Brief the people who sign. The governing body and the official certifying to DEC should understand what is in place and what is not.
- Keep it current. Both rules require annual review, and DOH requires an update within 30 days of a major infrastructure change.
The expensive mistakes
Assuming the plant is air-gapped
Most are not, once integrator remote access, cellular telemetry, and data copied to the office are counted. The DOH exemption depends on there being no connection at all.
Treating the sewer plant as too small to matter
The DEC rule covers every publicly owned treatment works, whatever its size. Small plants are where the paperwork is most often missing.
Assuming your integrator has it covered
Your SCADA integrator knows the system better than anyone, but the obligation sits with the municipality. Ask in writing what they have documented and how they connect remotely.
Writing the plan nobody can execute
An incident response plan the night operator has never seen is not a plan. The 24-hour reporting clock starts when you become aware, not when the right person is found.
Signing a certification you cannot support
The DEC certification is a statement by your chief executive or ranking elected official to a state regulator. The documentation behind it should be ready before anyone signs.
Where we would start
With one question: what is connected to your plant’s control systems, and who can reach it. The Compliance Readiness Snapshot is a free 30-minute readout covering which rules apply to you, which dates govern you, and what the first three moves are. No pitch, and useful whether or not you ever hire us.