New York water cybersecurity: the operator field guide.

Any community water system serving more than 3,300 people. New York's rules, issued by the Department of Health (DOH) for drinking water and the Department of Environmental Conservation (DEC) for wastewater, cover about 318 public water systems, most in the 3,300 to 50,000 population band. Systems above 50,000 people carry additional obligations. New York is the first state to finalize cybersecurity rules for public water and wastewater systems.

The core operational technology (OT) requirements from DOH and DEC take effect January 1, 2027. Information technology (IT) rules under the Public Service Commission took effect January 1, 2026, a year ahead. Incident reporting and operator training obligations apply immediately on adoption. Because the OT work takes months, not weeks, systems should start well ahead of the 2027 deadline.

Six core obligations: a formal cybersecurity program aligned with the six functions of NIST Cybersecurity Framework 2.0 (govern, identify, protect, detect, respond, recover); annual vulnerability assessments, updated within 30 days of any major infrastructure change; a cyber asset inventory with authentication, access management, and network activity monitoring and logging; incident reporting to DOH within 24 hours of detection and vulnerability reporting within 48 hours; a tested incident response plan; and cybersecurity training for certified operators. Systems above 50,000 people must also name a designated cybersecurity lead and conduct continuous monitoring.

There is a narrow exemption for a plant with no connection at all, physical or logical, between OT and IT or any outside network, a true air gap, and for systems where a cyber incident would not put public health at risk. In practice, once you count remote access, vendor links, and cellular connections at tanks and lift stations, almost no plant is genuinely air-gapped. The way to confirm is the OT asset inventory the rules require anyway.

OT does not behave like office IT, and IT tools leave three gaps. First, the equipment cannot defend itself: a fifteen-year-old PLC cannot run antivirus or an endpoint agent and may fault if you scan it. Second, plant networks are often flat and trusted inside, so a phished office PC can reach a control system directly. Third, remote access accumulates invisibly over years, and CISA identifies insecure remote access as one of the main ways attackers get into OT systems. The rules require IT/OT segmentation precisely because a flat trusted network turns one compromised laptop into a path to the pumps.

Instead of putting software on every device, put one protective layer in front of the control equipment. It checks who is asking (authentication), enforces what each user or device is allowed to reach (segmentation), stands between the user and the device so PLCs are never exposed directly, and keeps tamper-evident records of every session. This satisfies the identify, protect, detect, and respond functions the rules ask for, without a dedicated OT security engineer, without installing software on legacy PLCs or SCADA, and without rebuilding the plant network. It runs with your existing IT support.

Three steps a utility's own team can do. One: walk the plant and list every piece of control equipment, recording what it is, where it is, what it controls, and whether anything outside the plant can reach it. Two: identify every way in, remote access tools, cellular and modem links at tanks and lift stations, vendor connections, and the IT/OT boundary. Three: decide what each device actually needs to reach. Most equipment only needs to talk to a few devices inside the plant; the smaller set that needs outside access is where your effort goes. A passive discovery tool can confirm the inventory and surface connections no one remembered.

Yes. New York's SECURE grant program is administered by the Environmental Facilities Corporation (EFC) and funded at $2.5 million, aligned with the new rules. It has two tracks: an assessment grant of up to $50,000 with no match, and an implementation grant of up to 20 percent of net eligible costs, capped at $100,000. The first application round closed May 15, 2026; EFC's Community Assistance Teams can tell you the current status and flag future rounds, and also offer free assessments and no-cost technical assistance.

The SECURE grant funds the procurement and installation of security equipment, and names firewalls, network segmentation devices, and access control systems as examples. Its terms state that subscription-based software products are not eligible. So to have the grant cover it, buy your OT security as equipment you own and install, such as an on-premise appliance, rather than as a recurring software subscription. Confirm the specific eligibility details with EFC and your finance office before you apply.

Usually yes, through a cooperative purchasing contract. Another public agency has already run the full competitive process and awarded a contract other public bodies can buy from, so the competition has already happened for you. Widely used options include Carahsoft, OMNIA Partners, and TIPS (the Interlocal Purchasing System), all accepted by New York municipalities. Confirm your entity can buy through the cooperative, get a quote citing the cooperative contract number, and issue the purchase order against it. One caution: EFC's grant terms call for specific contract language, so check the required terms with EFC and your attorney before signing.