New York Awards $9 Million to Strengthen Cybersecurity at 153 Water Systems
New York is distributing over $9 million through its SECURE grant program to help 153 drinking water and wastewater systems bolster cybersecurity defenses The funding supports both cybersecurity assessments (up to $50,000 per utility) and security upgrade implementations (up to $100,000 per utility), alongside free technical assistance from the Environmental Facilities Corporation The announcement follows a coordinated cyber campaign targeting operational technology at water facilities across at
Analysis
TL;DR
- New York is distributing over $9 million through its SECURE grant program to help 153 drinking water and wastewater systems bolster cybersecurity defenses
- The funding supports both cybersecurity assessments (up to $50,000 per utility) and security upgrade implementations (up to $100,000 per utility), alongside free technical assistance from the Environmental Facilities Corporation
- The announcement follows a coordinated cyber campaign targeting operational technology at water facilities across at least seven U.S. states, with Iran emerging as a leading suspect
- New York's March cybersecurity standards for utilities include mandatory operator training, incident reporting requirements, risk-based protections, and designated cybersecurity leads at larger systems
- CISA has urged water operators to remove publicly exposed programmable logic controllers from the internet, change default passwords, and route remote access through secure gateways or VPNs
Why It Matters
This development highlights the growing intersection of critical infrastructure protection and cybersecurity policy at the state level, as water systems continue to face escalating threats from nation-state actors. For AI and cybersecurity practitioners, it underscores the importance of operational technology (OT) security, the need for automated monitoring solutions, and the regulatory momentum driving infrastructure hardening across the utilities sector.
Technical Details
- The SECURE grant program provides up to $50,000 for cybersecurity assessments and up to $100,000 for implementing security improvements at eligible utilities, with no-cost technical assistance from the New York State Environmental Facilities Corporation
- New York's March cybersecurity standards for water utilities mandate certified operator training, incident reporting protocols, risk-based protections for critical operations and sensitive information, and cybersecurity lead designation for larger drinking water systems
- The recent coordinated attacks targeted programmable logic controllers (PLCs) and operational technology systems, with some facilities experiencing disruptions to automated control functions; contingency procedures allowed most to remain operational
- CISA recommendations include removing publicly exposed OT from the internet, changing default passwords, routing remote access through secure gateways or VPNs, and restricting connections to trusted IP addresses only
- The $9 million grant allocation is separate from New York's broader $3.8 billion, five-year clean water infrastructure investment in its fiscal year 2027 budget, bringing total water infrastructure grants since 2017 to over $10 billion
Industry Insight
- State-level cybersecurity mandates for critical infrastructure are accelerating, creating compliance-driven demand for OT security solutions, monitoring platforms, and professional services—organizations positioned to serve the utilities sector will see growing opportunity
- The attribution to Iranian threat actors targeting water infrastructure reinforces the need for sector-wide threat intelligence sharing and coordinated defense strategies, particularly for smaller utilities with limited security resources
- CISA's guidance on removing PLCs from public internet exposure highlights a widespread vulnerability; AI-powered network monitoring and automated vulnerability detection tools could help utilities identify and remediate exposed assets at scale
Disclaimer: The above content is generated by AI and is for reference only.