US drinking water utilities have no dedicated federal cybersecurity regulation, yet they do have a binding statutory duty to assess and plan for cyber risk, and EPA has shown it will enforce it. That duty sits in Section 1433 of the Safe Drinking Water Act, added by America's Water Infrastructure Act of 2018 (AWIA): community water systems serving more than 3,300 people must assess the security of their "electronic, computer, or other automated systems" and build cyber resilience into an emergency response plan. Everything else EPA offers, from the Top 8 Cyber Actions to free assessments, is voluntary. This guide sets out the legally thin but real current state for utility managers, OT engineers, integrators and the consultants who certify on their behalf. Status line: based on EPA and statutory pages read on 27 October 2026.
Key takeaways
- One binding hook. SDWA Section 1433 (42 U.S.C. 300i-2) requires a risk and resilience assessment (RRA) that covers automated systems, and an emergency response plan (ERP) that includes cyber security strategies, for community water systems serving more than 3,300 people.
- Five-year cycle. Initial certifications were due between 31 March 2020 and 30 June 2021 by system size; each RRA must be reviewed at least every five years and the ERP certified within six months of the assessment.
- Enforcement is active. EPA's May 2024 enforcement alert said over 70 percent of systems inspected since September 2023 violated basic Section 1433 requirements, and that EPA had taken more than 100 enforcement actions under the section since 2020.
- Penalties exist through the general SDWA machinery. Section 1433 is an "applicable requirement" under 42 U.S.C. 300g-3, which carries civil penalties of up to $25,000 per day in the statute, and false certifications can be prosecuted under 18 U.S.C. 1001.
- The real gaps are identity gaps. EPA inspectors found default passwords, a single login shared by all staff and former employees who still had access, which are credential management failures before they are OT failures.
Scope: who and what is covered
| Utility type | Binding federal cyber duty | What applies instead |
|---|---|---|
| Community water system serving more than 3,300 people | Yes: Section 1433 RRA and ERP, with certification to EPA | Plus EPA enforcement, inspections and voluntary resources |
| Community water system serving 3,300 or fewer | No Section 1433 RRA or ERP duty | EPA guidance and technical assistance under 1433(e) |
| Wastewater utility | Section 1433 is a Safe Drinking Water Act provision for community water systems, so it does not reach wastewater treatment as such | Voluntary EPA and CISA resources, state law, and Clean Water State Revolving Fund support |
| Utility that is also a federal contractor or regulated in another sector | Depends on that other regime | See the Critical Infrastructure Regulation Map |
The RRA must cover risks from malevolent acts and natural hazards to pipes and constructed conveyances, intakes, pretreatment, treatment, storage and distribution, and the "electronic, computer, or other automated systems (including the security of such systems)". It must also cover monitoring practices, financial infrastructure, chemical handling and operation and maintenance (1433(a)(1)). In practice that last group pulls in billing systems, SCADA, PLCs, HMIs, remote access and the vendors who reach them.
Key obligations
| Obligation | Detail from the statute | Reference |
|---|---|---|
| Risk and resilience assessment | Assess the risks and resilience above, including automated systems and their security; may include capital and operational needs | 42 U.S.C. 300i-2(a)(1) |
| Certification of the RRA | Certify to EPA that the assessment was conducted, reviewed or revised; the certification may contain only the system's identity, the date and that statement | 300i-2(a)(3), (a)(4) |
| Five-yearly review | Review the RRA at least once every five years after the applicable deadline and certify the review and any revision | 300i-2(a)(3)(B) |
| Emergency response plan | Prepare or revise an ERP that incorporates the RRA findings, and certify it no later than six months after completing the RRA | 300i-2(b) |
| ERP content | Strategies and resources to improve resilience, including physical security and cybersecurity; response plans and procedures; actions to lessen impacts; detection strategies | 300i-2(b) |
| Coordination | Coordinate, to the extent possible, with local emergency planning committees under EPCRA | 300i-2(c) |
| Record retention | Keep copies of the RRA and ERP for five years after certification | 300i-2(d) |
| Standards route | A system may use technical standards recognised by EPA to meet the requirements | 300i-2(f) |
Confidentiality: a system cannot be required under state or local law to provide its assessment to a state or local agency solely because it certified to EPA (1433(a)(5)). Keep the RRA itself under restricted access; it is a map of your weak points.
What EPA inspectors look for
The May 2024 enforcement alert lists the gaps EPA found and the eight actions it wants utilities to take. Read them as the de facto inspection checklist.
- Reduce exposure to the public-facing internet.
- Conduct regular cybersecurity assessments.
- Change default passwords immediately.
- Inventory OT and IT assets.
- Develop and exercise cybersecurity incident response and recovery plans.
- Back up OT and IT systems.
- Reduce exposure to vulnerabilities.
- Conduct cybersecurity awareness training.
Timeline and current status
| Date | Event | Source |
|---|---|---|
| 23 October 2018 | AWIA enacted; ERP certification required as soon as reasonably possible after this date | 42 U.S.C. 300i-2(b) |
| 31 March 2020 | RRA certification deadline, systems serving 100,000 or more | 300i-2(a)(3)(A) |
| 31 December 2020 | RRA certification deadline, systems serving 50,000 to under 100,000 | 300i-2(a)(3)(A) |
| 30 June 2021 | RRA certification deadline, systems serving more than 3,300 but under 50,000 | 300i-2(a)(3)(A) |
| 2023 | EPA attempted to add cybersecurity to state sanitary surveys by memorandum and later withdrew it; we could not read the official withdrawal notice, so treat this as background | Not confirmed from an official page |
| 1 December 2023 | US agencies advise on CyberAv3ngers attacks on Unitronics PLCs, including at least 34 water sector devices | CISA AA23-335A |
| May 2024 | EPA enforcement alert on drinking water system cybersecurity | EPA enforcement alert |
| 31 March 2025 onward | Five-yearly RRA reviews fall due, starting with the largest systems | Derived from 300i-2(a)(3)(B) |
| 22 September 2026 | EPA cybersecurity hub last updated; resources remain voluntary | EPA hub |
Current status: EPA's sanitary survey page (updated 13 August 2026) lists eight survey elements, none specific to cybersecurity. So, as of our check, the binding federal requirement remains Section 1433 plus enforcement, and the rest is voluntary guidance. Watch for federal legislation or rulemaking that would change this; none was found in the sources we read.
Enforcement and penalties
- Applicable requirement: 42 U.S.C. 300g-3(i)(1) defines "applicable requirement" to include Section 1433 (300i-2), bringing it under the general SDWA enforcement section.
- Administrative orders: EPA may issue an order requiring compliance; violating an order carries a penalty of up to $25,000 per day in the statute (300g-3(g)(3)(A)).
- Civil actions: a court may impose a civil penalty not exceeding $25,000 for each day of violation, considering seriousness and population at risk (300g-3(b)). Statutory figures are adjusted for inflation by EPA regulation, so check current amounts.
- Emergency powers: where cyber vulnerabilities may present an imminent and substantial endangerment, EPA says it may act under SDWA Section 1431.
- False certification: EPA's alert notes possible criminal sanctions under 18 U.S.C. 1001 for knowingly and willfully false certifications. A certified RRA that ignores cyber risk is not a safe harbour.
What it means for AI agents and non-human identities
Water OT runs on machine-to-machine trust: PLCs polled by SCADA servers, historians pulling data, telemetry over cellular modems, vendor remote access tools and, increasingly, analytics and AI services reading plant data. Each is a non-human identity with credentials.
- Default and shared credentials are the finding: EPA's inspectors called out default passwords and a single login shared by all staff. Give each operator, engineering workstation and integration its own account, and replace default PLC and HMI passwords. The Unitronics attacks reached devices on TCP port 20256 that had default or no passwords. See the CyberAv3ngers Threat Actor Profile.
- Leaver access: former employees retaining access was a named gap. Tie OT accounts and VPN or remote access tool accounts to HR leaver events (NIST SP 800-53 PS-4, AC-2).
- Service accounts and integrations: SCADA to historian, historian to cloud analytics and billing interfaces use service accounts and API keys. Inventory them in the RRA's automated systems section and set owners and rotation.
- AI agents with plant data: if an AI assistant or agent reads SCADA data or drafts operator actions, keep it read-only, behind the same remote access controls as people, with no write path to PLCs and full logging. Treat it as a new automated system in the next RRA review.
- Vendor remote access: integrator accounts should be named, time-bound and MFA protected. See the OT Third-Party and Integrator Access Guide.
Binding versus voluntary: where EPA resources fit
EPA's cybersecurity hub (last updated 22 September 2026) does not say which items are mandatory. The split below follows the statute: only the first row is a legal duty, but the voluntary resources are the easiest way to produce evidence for it.
| Item | Status | Use it for |
|---|---|---|
| Section 1433 RRA and ERP, with certification | Binding for community water systems serving more than 3,300 | The legal baseline that inspectors check |
| EPA guidance on cybersecurity in AWIA RRAs and ERPs | Voluntary guidance | Structuring the automated systems section and cyber resilience strategies |
| Top 8 Cyber Actions and the incident action checklist | Voluntary guidance | Quick wins that match the enforcement alert findings |
| Self, third-party and EPA cybersecurity assessments, technical assistance requests | Voluntary, free from EPA | Assessment evidence for the RRA review |
| EPA Tabletop Exercise Tool cyber scenario | Voluntary | Exercising the ERP |
| EPA and CISA fact sheet on unsecured HMIs | Advisory | Finding and closing remote HMI exposure |
Compliance steps
- Confirm applicability and dates. Check population served, your original certification date, and therefore when your five-year review is due.
- Pull the last RRA and ERP. Check that the automated systems section exists and is not a single paragraph; EPA found missing sections in many plans.
- Inventory OT and IT assets. PLCs, HMIs, RTUs, SCADA servers, historians, modems, remote access tools, and every account and service credential they use.
- Assess. Use an EPA-recognised standard or an EPA or CISA free assessment, and run external exposure checks for internet-facing HMIs and PLC ports.
- Fix the inspection items first. Change default passwords, remove shared logins, remove leavers, close internet exposure. Test changes on one site or a spare PLC, keep offline copies of logic and configuration so you can roll back.
- Write cyber into the ERP. Include manual operation fallback, who isolates networks, how to restore PLC logic from offline backups, and who to call (EPA, CISA, FBI). Exercise it with EPA's tabletop tool.
- Certify and retain. Certify the RRA review and ERP within the deadlines and keep both for five years.
- Fund it. EPA points to the Drinking Water and Clean Water State Revolving Funds and the CISA State and Local Cybersecurity Grant Program.
Decision guidance by utility size
| Size | Practical approach | Trade-off |
|---|---|---|
| Very small (3,300 or fewer) | No 1433 duty; use EPA technical assistance and the Top 8 actions | No legal driver, so board support depends on risk framing |
| Small to medium (3,301 to 49,999) | Free EPA or CISA assessment, integrator support under contract terms that require named accounts and MFA | Heavy reliance on integrators; contracts must carry the controls |
| Large (50,000 and above) | Formal OT security programme against NIST SP 800-82 or ISA/IEC 62443, monitoring of OT networks | Higher cost, but RRA evidence becomes straightforward |
Detection, measurement and framework mapping
- Exposure: number of internet-reachable OT interfaces, target zero.
- Default credentials: percentage of PLCs and HMIs with default passwords replaced, target 100 percent.
- Shared accounts: count of shared OT logins remaining.
- Leaver lag: days between leaving and OT or remote access removal.
- Recovery readiness: percentage of PLCs with a tested offline logic backup.
- Plan currency: months until the next RRA review and ERP certification are due.
| Section 1433 element | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Assess automated systems | ID.AM-01, ID.RA-01, ID.RA-05 | CM-8, RA-3, RA-5 |
| Accounts and credentials | PR.AA-01, PR.AA-03, PR.AA-05 | AC-2, IA-2, IA-5, PS-4 |
| Remote access and exposure | PR.IR-01 | AC-17 |
| Backups and recovery | PR.DS-11 | CP-9, CP-2 |
| ERP and incident response | RS.MA-01 | IR-8 |
Common failure patterns
- Cyber as a paragraph: an RRA whose automated systems section says little more than "we have antivirus", which EPA describes as missing required sections.
- Default PLC passwords: the pattern behind the Unitronics campaign. See the PLC Security Guide.
- Shared operator login: one account for every shift, so no accountability and no way to remove one person.
- Integrator always-on access: a vendor remote access tool left running with a static password.
- No offline logic backup: when ladder logic is wiped, there is nothing clean to restore.
- Missed review date: treating the 2020 to 2021 certification as a one-off rather than a five-yearly cycle.
Practitioner checklist
- Confirm Section 1433 applicability and the date your five-year RRA review is due.
- Check the RRA covers electronic, computer and other automated systems in real detail.
- Inventory PLCs, HMIs, SCADA, remote access tools and every service credential.
- Replace default passwords and remove shared logins on all OT devices.
- Link OT and remote access accounts to the leaver process.
- Remove internet exposure of HMIs and PLC programming ports.
- Keep tested offline backups of PLC logic and configurations.
- Write cyber response and manual operation into the ERP and exercise it.
- Certify the RRA review and ERP on time and retain both for five years.
Standards and references
- US Code: 42 U.S.C. 300i-2, Community water system risk and resilience
- US Code: 42 U.S.C. 300g-3, Enforcement of drinking water regulations
- EPA: Enforcement Alert, Drinking Water Systems to Address Cybersecurity Vulnerabilities
- EPA: Cybersecurity for the Water Sector
- EPA: Sanitary Surveys
- CISA: Cybersecurity Advisory AA23-335A, IRGC-affiliated exploitation of Unitronics PLCs
This guide summarises SDWA Section 1433 and EPA's water sector cybersecurity enforcement and guidance as published by official sources when read on 27 October 2026, and is not legal advice. Related NHI Mgmt Group resources: Water and Wastewater Cybersecurity Guide · Critical Infrastructure Regulation Map · Identity for OT Environments Guide · NIST SP 800-82 OT Security Guide