New York adopts cybersecurity requirements for wastewater systems, with grants available to help utilities comply
New York has adopted statewide cybersecurity requirements for wastewater systems, adding new duties for certified operators, SPDES permittees and publicly owned treatment works. The New York State Department of Environmental Conservation published the Notice of Adoption on March 11, 2026.
The rules require certified wastewater operators to obtain cybersecurity training. SPDES permittees must report cybersecurity incidents, while publicly owned treatment works must maintain emergency-response plans and cybersecurity controls.
The state also announced $2.5 million in SECURE grants to help utilities and local governments meet the new requirements. The program offers grants of up to $50,000 for cybersecurity assessments and up to $100,000 for implementation projects.
What the adopted rules require
The rulemaking amends 6 NYCRR Parts 616, 650 and 750, the portions of New York’s regulations covered by the adoption notice. Its requirements address both workforce preparation and the ability of wastewater facilities to identify, report and respond to cybersecurity problems.
Training for certified operators is intended to give personnel responsible for wastewater operations cybersecurity knowledge relevant to their work. The incident-reporting requirement creates a formal obligation for SPDES permittees to report cybersecurity incidents. Publicly owned treatment works must also maintain emergency-response planning and cybersecurity controls.
Together, the requirements apply to functions that support wastewater treatment and the continued operation of essential services. The state describes the measures as protections for water quality, public health and service continuity. They are intended to reduce operational risk, but the rules do not guarantee that a facility will avoid a cyberattack or that service will never be interrupted.
Grants are available for assessments and upgrades
The SECURE program provides a potential source of funding for the work required to evaluate and improve cybersecurity. Assessment grants can provide up to $50,000, while implementation grants can provide up to $100,000. The state announced $2.5 million for the program overall.
Those grants may help offset implementation costs for local governments and utilities. An assessment can help a utility identify weaknesses and determine what improvements are needed; an implementation project can support upgrades after those needs are identified. The grant amounts are maximum awards, not a guarantee that every applicant will receive the full amount.
The New York State Department of Environmental Conservation announced the regulatory adoption, and the state’s Office of Information Technology Services announced the SECURE grant program. The state also identifies the New York State Environmental Facilities Corporation and the New York State Department of Health among the agencies connected to the initiative.
Public response and next steps
The rulemaking received 66 written comments. No verbal comments were submitted at the virtual hearings, according to the DEC adoption notice.
The adopted requirements now establish statewide cybersecurity duties for the wastewater entities covered by the regulations. The DEC notice does not state a separate compliance deadline for every regulated facility, so utilities will need to follow the applicable regulatory requirements and grant information as implementation proceeds.
For residents, the practical significance is tied to the reliability and safety of wastewater services. Cybersecurity failures can create operational challenges for systems responsible for treating wastewater. The new training, reporting, planning and control requirements, combined with state assistance, give utilities a framework for preparing for and responding to those risks.
Sources
- Statewide – 6 NYCRR Parts 616, 650, and 750 Wastewater Cybersecurity and Related Regulations, New York State Department of Environmental Conservation
- Governor Hochul Announces First-In-Nation Cybersecurity Regulations and Grants to Protect New York Water Systems, New York State Office of Information Technology Services
Look for updates to this story
Discover more from Interactive News
Subscribe to get the latest posts sent to your email.