EPA Issues Cybersecurity Regulations for Public Water Systems: How Tenable Can Help
EPA released new regulations that require states to assess cybersecurity risks at drinking water systems and ensure these systems have sufficient cyber protections. Here’s what you need to know — and how Tenable can help.
The U.S. Environmental Protection Agency (EPA) issued a memorandum on March 3, 2023, directing states to include cybersecurity assessments when they conduct sanitation surveys, or audits, of public water systems (PWSs). This memorandum came one day after the release of the Biden administration’s National Cybersecurity Strategy, which called for the development of new cybersecurity requirements across critical infrastructure sectors. The EPA also released corresponding guidance, titled “Evaluating Cybersecurity During Public Water System Sanitary Surveys,” for how states and water utilities can evaluate and improve the cybersecurity of their systems.
When conducting a sanitary survey, which is “an onsite review of the water source, facilities, equipment, operation, and maintenance of a PWS for the purpose of evaluating the adequacy of such source, facilities, equipment, operation, and maintenance for producing and distributing safe drinking water,” states must now also do the following:
- If the PWS uses an industrial control system (ICS) or other operational technology (OT) as part of the equipment or operation of any required component of the sanitary survey, then the state must evaluate the adequacy of the cybersecurity of that OT for producing and distributing safe drinking water.
- If the state determines that a cybersecurity deficiency identified during a sanitary survey is significant, then the state must use its authority to require the PWS to address the significant deficiency.
The EPA guidance includes a checklist in its appendix A section, which is an optional tool states can utilize when conducting their sanitary surveys of a PWS’ cybersecurity protections. States can evaluate cybersecurity at a PWS through:
- self-assessments
- third-party assessments
- direct surveyor evaluations during sanitary surveys of a PWS
- their states’ current programs for assessing for cybersecurity gaps
Throughout this process, the EPA is offering technical support and training to assist states in addressing cybersecurity in their PWS sanitary surveys. More information can be found here.
How Tenable can help states meet the new EPA cybersecurity requirements
Here’s how Tenable can help PWSs meet the exposure management requirements included in the EPA’s guidance for states reviewing cybersecurity practices.1
| Checklist Category | Tenable Solution |
|---|---|
| Account Security (1.1-1.7) | 1.1, 1.2, 1.4 Tenable audits operating system (OS) configuration to ensure the control is active and will identify incorrect configuration via reports. |
| Device Security (2.1-2.5) |
2.2 Tenable audits OS configuration to ensure the control is active and will identify incorrect configuration via reports.
|
| Data Security (3.1-3.4) |
3.1 Tenable collects network traffic and creates logs for use in forensic investigations.
|
| Vulnerability Management (5.1-5.6) |
5.1 Tenable leverages domain expertise in industrial security for OT assets, and Nessus for IT assets. Tenable’s VPR scoring generates vulnerability and risk levels using each asset in your ICS network. Reports include detailed insights, along with mitigation suggestions. This enables authorized personnel to quickly identify the highest risk for priority remediation.
|
| Response and Recovery (7.1-7.4) | 7.4 Tenable maps the network and baselines its communications between all discovered devices aiding in the incident response (IR) process. |
__________________
1 This checklist does not include the categories that are related to policies versus products or technologies.
Learn more
- Webinar: The Constant Drip: EPA Water Regulations, Funding Sources, and How Tenable Can Help
- Tenable Blog: Navigating Recommendations for Public Water Utilities: How Tenable Can Help
- Protecting Public Water Systems from Cyber Attacks
- Tenable OT Security Solutions for Water Utilities
- Forrester Wave Report for Industrial Control Systems (ICS) Security Solutions
- City of Raleigh Case Study
- EPA Fact Sheet on Sanitary Surveys
- State and Local Cybersecurity Grant Program (SLCGP)
Related Articles
Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP’s List of Cyber Risks for GenAI LLM Apps
November 22, 2024Don’t miss OWASP’s update to its “Top 10 Risks for LLMs” list. Plus, the ranking of the most harmful software weaknesses is out. Meanwhile, critical infrastructure orgs have a new framework for using AI securely. And get the latest on the BianLian ransomware gang and on the challenges of protecting water and transportation systems against cyberattacks.
Cybersecurity Snapshot: Five Eyes Rank 2023’s Most Frequently Exploited CVEs, While CSA Publishes Framework for AI System Audits
November 15, 2024Check out the CVEs attackers targeted the most last year, along with mitigation tips. Plus, a new guide says AI system audits must go beyond check-box compliance. Meanwhile, a report foresees stronger AI use by defenders and hackers in 2025. And get the latest on cloud security, SMBs' MFA use and the CIS Benchmarks.
Cybersecurity Snapshot: CISA Warns of Global Spear-Phishing Threat, While OWASP Releases AI Security Resources
November 8, 2024CISA is warning about a spear-phishing campaign that spreads malicious RDP files. Plus, OWASP is offering guidance about deepfakes and AI security. Meanwhile, cybercriminals have amplified their use of malware for fake software-update attacks. And get the latest on CISA’s international plan, Interpol’s cyber crackdown and ransomware trends.
Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP’s List of Cyber Risks for GenAI LLM Apps
November 22, 2024Don’t miss OWASP’s update to its “Top 10 Risks for LLMs” list. Plus, the ranking of the most harmful software weaknesses is out. Meanwhile, critical infrastructure orgs have a new framework for using AI securely. And get the latest on the BianLian ransomware gang and on the challenges of protecting water and transportation systems against cyberattacks.
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.
- IT/OT
- Federal
- Government