EPA released new regulations that require states to assess cybersecurity risks at drinking water systems and ensure these systems have sufficient cyber protections. Here’s what you need to know — and how Tenable can help.
The U.S. Environmental Protection Agency (EPA) issued a memorandum on March 3, 2023, directing states to include cybersecurity assessments when they conduct sanitation surveys, or audits, of public water systems (PWSs). This memorandum came one day after the release of the Biden administration’s National Cybersecurity Strategy, which called for the development of new cybersecurity requirements across critical infrastructure sectors. The EPA also released corresponding guidance, titled “Evaluating Cybersecurity During Public Water System Sanitary Surveys,” for how states and water utilities can evaluate and improve the cybersecurity of their systems.
When conducting a sanitary survey, which is “an onsite review of the water source, facilities, equipment, operation, and maintenance of a PWS for the purpose of evaluating the adequacy of such source, facilities, equipment, operation, and maintenance for producing and distributing safe drinking water,” states must now also do the following:
- If the PWS uses an industrial control system (ICS) or other operational technology (OT) as part of the equipment or operation of any required component of the sanitary survey, then the state must evaluate the adequacy of the cybersecurity of that OT for producing and distributing safe drinking water.
- If the state determines that a cybersecurity deficiency identified during a sanitary survey is significant, then the state must use its authority to require the PWS to address the significant deficiency.
The EPA guidance includes a checklist in its appendix A section, which is an optional tool states can utilize when conducting their sanitary surveys of a PWS’ cybersecurity protections. States can evaluate cybersecurity at a PWS through:
- self-assessments
- third-party assessments
- direct surveyor evaluations during sanitary surveys of a PWS
- their states’ current programs for assessing for cybersecurity gaps
Throughout this process, the EPA is offering technical support and training to assist states in addressing cybersecurity in their PWS sanitary surveys. More information can be found here.
How Tenable can help states meet the new EPA cybersecurity requirements
Here’s how Tenable can help PWSs meet the exposure management requirements included in the EPA’s guidance for states reviewing cybersecurity practices.1
| Checklist Category | Tenable Solution |
|---|---|
| Account Security(1.1-1.7) | 1.1, 1.2, 1.4 Tenable audits operating system (OS) configuration to ensure the control is active and will identify incorrect configuration via reports. |
| Device Security (2.1-2.5) | 2.2 Tenable audits OS configuration to ensure the control is active and will identify incorrect configuration via reports.
|
| Data Security (3.1-3.4) | 3.1 Tenable collects network traffic and creates logs for use in forensic investigations.
|
| Vulnerability Management (5.1-5.6) | 5.1 Tenable leverages domain expertise in industrial security for OT assets, and Nessus for IT assets. Tenable’s VPR scoring generates vulnerability and risk levels using each asset in your ICS network. Reports include detailed insights, along with mitigation suggestions. This enables authorized personnel to quickly identify the highest risk for priority remediation.
|
| Response and Recovery (7.1-7.4) | 7.4 Tenable maps the network and baselines its communications between all discovered devices aiding in the incident response (IR) process. |
__________________
1 This checklist does not include the categories that are related to policies versus products or technologies.
Learn more
- Webinar: The Constant Drip: EPA Water Regulations, Funding Sources, and How Tenable Can Help
- Tenable Blog: Navigating Recommendations for Public Water Utilities: How Tenable Can Help
- Protecting Public Water Systems from Cyber Attacks
- Tenable OT Security Solutions for Water Utilities
- Forrester Wave Report for Industrial Control Systems (ICS) Security Solutions
- City of Raleigh Case Study
- EPA Fact Sheet on Sanitary Surveys
- State and Local Cybersecurity Grant Program (SLCGP)
