Skip to content

EPA Launches Comprehensive Cybersecurity Resources as Water Sector Faces Escalating Threats

November 19, 2025 – Published on Nexus Connect

he U.S. Environmental Protection Agency recently released a set of new planning and response tools designed to strengthen the cybersecurity defenses of the nation’s at-risk water treatment systems. The move marks the latest in a series of federal actions aimed at bolstering the protection of drinking water and wastewater infrastructure in the U.S. from nation-state-driven cyberattacks.

The timing of these EPA resources coincides with the water sector’s growing concern about a surge in cyber incidents that have exposed critical vulnerabilities across public utilities. This week’s EPA announcement includes an updated Emergency Response Plan Guide for wastewater utilities, a new Cybersecurity Incident Response Plan template, incident action checklists, and a cybersecurity procurement checklist specifically designed to help utilities evaluate the security practices of vendors and manufacturers.

Patrick Gillespie, Practice Director, Operational Technology at GuidePoint Security, said success in defending against adversaries starts with the right foundations in treatment plant people, process, and technology. That begins with the proper preparation of treatment plant workers. 

“Operators, engineers, and IT/OT teams are the front line of cybersecurity,” he said, and added that proper training and clearly defined roles come before tool implementation.

“If people don’t understand their part in defending the plant, even the best technology will be misused, ignored, or bypassed,” Gillespie explained. From there, Gillespie advised treatment plants to implement proper security processes before deploying new technology. These processes include building and maintaining an accurate asset inventory, developing and testing incident-response plans, and creating requirements for technology-based controls on existing assets and protocols. Finally, he added, conduct tabletop exercises and define reporting lines.

Read more HERE.