EPA Issues Cybersecurity Regulations for Public Water Systems: How Tenable Can Help
EPA released new regulations that require states to assess cybersecurity risks at drinking water systems and ensure these systems have sufficient cyber protections. Here’s what you need to know — and how Tenable can help.
The U.S. Environmental Protection Agency (EPA) issued a memorandum on March 3, 2023, directing states to include cybersecurity assessments when they conduct sanitation surveys, or audits, of public water systems (PWSs). This memorandum came one day after the release of the Biden administration’s National Cybersecurity Strategy, which called for the development of new cybersecurity requirements across critical infrastructure sectors. The EPA also released corresponding guidance, titled “Evaluating Cybersecurity During Public Water System Sanitary Surveys,” for how states and water utilities can evaluate and improve the cybersecurity of their systems.
When conducting a sanitary survey, which is “an onsite review of the water source, facilities, equipment, operation, and maintenance of a PWS for the purpose of evaluating the adequacy of such source, facilities, equipment, operation, and maintenance for producing and distributing safe drinking water,” states must now also do the following:
- If the PWS uses an industrial control system (ICS) or other operational technology (OT) as part of the equipment or operation of any required component of the sanitary survey, then the state must evaluate the adequacy of the cybersecurity of that OT for producing and distributing safe drinking water.
- If the state determines that a cybersecurity deficiency identified during a sanitary survey is significant, then the state must use its authority to require the PWS to address the significant deficiency.
The EPA guidance includes a checklist in its appendix A section, which is an optional tool states can utilize when conducting their sanitary surveys of a PWS’ cybersecurity protections. States can evaluate cybersecurity at a PWS through:
- self-assessments
- third-party assessments
- direct surveyor evaluations during sanitary surveys of a PWS
- their states’ current programs for assessing for cybersecurity gaps
Throughout this process, the EPA is offering technical support and training to assist states in addressing cybersecurity in their PWS sanitary surveys. More information can be found here.
How Tenable can help states meet the new EPA cybersecurity requirements
Here’s how Tenable can help PWSs meet the exposure management requirements included in the EPA’s guidance for states reviewing cybersecurity practices.1
| Checklist Category | Tenable Solution |
|---|---|
| Account Security (1.1-1.7) | 1.1, 1.2, 1.4 Tenable audits operating system (OS) configuration to ensure the control is active and will identify incorrect configuration via reports. |
| Device Security (2.1-2.5) |
2.2 Tenable audits OS configuration to ensure the control is active and will identify incorrect configuration via reports.
|
| Data Security (3.1-3.4) |
3.1 Tenable collects network traffic and creates logs for use in forensic investigations.
|
| Vulnerability Management (5.1-5.6) |
5.1 Tenable leverages domain expertise in industrial security for OT assets, and Nessus for IT assets. Tenable’s VPR scoring generates vulnerability and risk levels using each asset in your ICS network. Reports include detailed insights, along with mitigation suggestions. This enables authorized personnel to quickly identify the highest risk for priority remediation.
|
| Response and Recovery (7.1-7.4) | 7.4 Tenable maps the network and baselines its communications between all discovered devices aiding in the incident response (IR) process. |
__________________
1 This checklist does not include the categories that are related to policies versus products or technologies.
Learn more
- Webinar: The Constant Drip: EPA Water Regulations, Funding Sources, and How Tenable Can Help
- Tenable Blog: Navigating Recommendations for Public Water Utilities: How Tenable Can Help
- Protecting Public Water Systems from Cyber Attacks
- Tenable OT Security Solutions for Water Utilities
- Forrester Wave Report for Industrial Control Systems (ICS) Security Solutions
- City of Raleigh Case Study
- EPA Fact Sheet on Sanitary Surveys
- State and Local Cybersecurity Grant Program (SLCGP)
Related Articles
Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight
December 20, 2024Check out the new cloud security requirements for federal agencies. Plus, beware of North Korean government operatives posing as remote IT pros. Also, learn how water plants can protect their HMIs against cyberattacks. And get the latest on the U.S. cyber incident response framework; the CIS Benchmarks; and local and state governments’ cyber challenges.
Cybersecurity Snapshot: Telecoms May Face Tougher Regulations After Salt Typhoon Hacks, as Study Finds Cyber Pros More Stressed at Work
December 13, 2024The FCC wants stronger cyber regulations for telecoms after cyber espionage breaches. Meanwhile, find out why cyber pros say work has become more difficult. Plus, check out tips to prevent AI-boosted financial fraud. And get the latest on vulnerability management, EU cyber challenges and CIS predictions for 2025.
New CISA Hardening Guidance Provides Valuable Insights for Network Security Engineers
December 11, 2024Recent guidance from CISA and the FBI highlights best practices to monitor and harden network infrastructure. The guidance, published in response to high-profile attacks on telecom infrastructure, is applicable to a wider audience. This blog unpacks important points and explains how Tenable products can help with compliance scans.
Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight
December 20, 2024Check out the new cloud security requirements for federal agencies. Plus, beware of North Korean government operatives posing as remote IT pros. Also, learn how water plants can protect their HMIs against cyberattacks. And get the latest on the U.S. cyber incident response framework; the CIS Benchmarks; and local and state governments’ cyber challenges.
Web App Scanning 101: What Security Pros Need to Know About CI/CD Pipelines
December 19, 2024Git, repositories and pipelines…oh my! We unpack standard practices in the web app development process and provide guidance on how to use Tenable Web Application Scanning to secure your code.
Cybersecurity Snapshot: Telecoms May Face Tougher Regulations After Salt Typhoon Hacks, as Study Finds Cyber Pros More Stressed at Work
December 13, 2024The FCC wants stronger cyber regulations for telecoms after cyber espionage breaches. Meanwhile, find out why cyber pros say work has become more difficult. Plus, check out tips to prevent AI-boosted financial fraud. And get the latest on vulnerability management, EU cyber challenges and CIS predictions for 2025.
- IT/OT
- Federal
- Government