SMSMC Blog
Compliance & Audit AssuranceOctober 2026 · 8 min read

New York's water and wastewater cybersecurity rules: who is covered, what is due, and a plan

DOH's Appendix 5-E and DEC's Part 750 amendments put cybersecurity duties on New York water and wastewater systems. Some apply now; the rest are due in 2027. Here is who is covered and a practical plan.

By Jim Venuto

On March 11, 2026, New York adopted cybersecurity rules for drinking-water and wastewater systems. The Department of Health (DOH) added Appendix 5-E to 10 NYCRR Subpart 5-1 for drinking water, and the Department of Environmental Conservation (DEC) amended 6 NYCRR Parts 616, 650 and 750 for wastewater. The Governor’s office described them as first-in-nation regulations. Some duties already apply. The rest fall due in 2027.

This post is for village, town, city and authority leaders, superintendents and the boards they report to. It covers who is covered, what is due when, and a practical sequence. It is a reading of the published rules, not legal advice; confirm your system’s obligations with DOH, DEC or counsel.

Drinking water: DOH Appendix 5-E

Who is covered. Appendix 5-E applies to “all community water systems which serve populations greater than 3,300 people.” Some duties apply only above 50,000 people served (combined wholesale and retail). The operator-training section applies to every certified drinking-water operator, whatever the system’s size.

When. Covered systems have until January 1, 2027 to comply, but the training section (5-E.7) and incident reporting (5-E.9) were “effective immediately upon adoption” on March 11, 2026.

What is required. In summary, from the regulation:

  • A cybersecurity vulnerability analysis (CVA), submitted to DOH, reviewed and updated at least annually and within 30 days after major infrastructure changes become operational. Vulnerabilities identified by the CVA are to be reported to DOH within 48 hours of identification.
  • A cybersecurity program “based on the findings of the covered water system’s CVA,” including: multi-factor authentication for anyone accessing operational technology (OT) from an external network, unless compensating controls are approved; separate OT and IT user accounts; at least an annual review of user access, and immediate removal of access when a user leaves; disabling remote access to OT that is not needed; no default passwords in OT; and a cyber asset inventory.
  • A written cybersecurity incident response plan, as part of the system’s emergency plan.
  • Incident reporting to DOH “as soon as possible, but no later than 24 hours” after determining that a cybersecurity incident has created or may create a public health hazard. DOH’s cybersecurity overview page gives the reporting contact.
  • Operator training: at least one hour of cybersecurity training every three years, from a DOH-approved curriculum.

Above 50,000 people served, systems must also designate a qualified individual “with demonstrable knowledge of cybersecurity principles and practical experience in system protection or risk management,” who makes “a confidential report in writing at least annually to the system’s governing body,” and they must monitor and log network activity.

Failure to meet the core duties is treated as a significant deficiency, to be corrected within 120 days. A system whose OT has no physical or logical connection to IT or external networks may request an exclusion from most of the appendix, but the incident response plan and reporting still apply, and DOH’s overview says training does too.

Wastewater: DEC Parts 616, 650 and 750

Incident reporting applies now to every SPDES permittee. According to DEC’s wastewater cybersecurity resources, all SPDES permittees have had to report cybersecurity incidents since March 26, 2026. The Part 750 express terms require an oral report to the regional water engineer “as soon as possible, but no later than 24 hours” after the permittee becomes aware of an incident, followed by a written report within 30 days. DEC’s incident reporting page explains the online form and phone process; read it before you need it.

POTW plan and controls apply to every publicly owned treatment works, whatever its size, and DEC says the POTW remains responsible whether it operates the plant itself or contracts out operations. DEC’s resources page and its Regulatory Impact Statement put the effective date of these requirements at March 11, 2027, one year after the Notice of Adoption. (DEC’s Assessment of Public Comment refers to January 1, 2027; we treat DEC’s current resources page as controlling, but confirm with your regional office.) The requirements include an emergency response plan covering cybersecurity, access controls, vulnerability management and an asset inventory, with annual reviews by March 28. POTWs with a design flow of 10 million gallons per day or more must also monitor and log network activity.

Annual certification of compliance is due by March 28 each year; DEC’s Assessment of Public Comment says the first certifications are not due until March 28, 2027.

Operator training. DEC’s resources page says wastewater operators in grades 1/1A and 2/2A need two hours of cybersecurity training, and grades 3/3A and 4/4A need four hours every five years, counted within existing renewal hours and only from DEC-approved courses.

DEC’s rules do not create a named cybersecurity-leader role. For smaller drinking-water systems (3,300 to 50,000 served), Appendix 5-E does not either. That does not remove the need for someone to own the program; it means the board decides who.

The federal picture

EPA’s May 2024 enforcement alert reported that over 70% of systems it had inspected since September 2023 were in violation of basic requirements of Section 1433 of the Safe Drinking Water Act, the federal risk and resilience assessment and emergency response plan duties. Among the weaknesses EPA described were systems that failed to change default passwords, used single logins for all staff, or failed to curtail former employees’ access. New York’s rules target exactly those practices.

CISA, EPA and the FBI’s fact sheet Top Cyber Actions for Securing Water Systems (February 2024) lists eight actions that line up closely with the state rules: reduce exposure to the public-facing internet, conduct regular cybersecurity assessments, change default passwords immediately, inventory OT and IT assets, develop and exercise incident response and recovery plans, back up OT and IT systems, reduce exposure to vulnerabilities, and conduct cybersecurity awareness training.

A practical plan for a small or mid-size utility

  1. Confirm which rules apply: drinking water above 3,300 served, above 50,000 served, any SPDES permit, any POTW, and design flow of 10 MGD or more. Write it down for the board.
  2. Make the reporting duties work today. Put the DOH contact, the DEC reporting form and your regional water engineer’s details in the incident response plan, and name who calls whom. These duties already apply.
  3. Start the inventory and the CVA or vulnerability process now. They drive everything else, and a January or March 2027 deadline is closer than a procurement cycle.
  4. Close the named quick wins first: MFA for remote access to OT, separate OT and IT accounts, no default passwords, remote access turned off where it is not needed, and same-day removal of leavers’ access.
  5. Use the free help. CISA offers no-cost vulnerability scanning for water utilities with weekly reports. EPA’s Water Sector Cybersecurity Evaluation Program offers a free assessment. DOH publishes a CVA checklist and program template on its overview page. WaterISAC publishes its cybersecurity fundamentals for water and wastewater utilities.
  6. Track funding. The State’s SECURE grant program awarded more than $9 million to 153 local government projects in August 2026. No new round has been announced as of this writing; watch NYS Environmental Facilities Corporation notices.
  7. Give the board an owner and a calendar. One page: who owns the program, the three or four dates that matter, what is done, and what needs a decision or a budget line. CSF 2.0’s Govern function (GV.RR) is a useful frame for assigning those roles.
  8. Train and record it: DOH- or DEC-approved courses for operators, with the records kept where an inspector can find them.

Where SMC fits

Hudson Valley CISO is Security Medic Consulting’s fractional CISO and NIST CSF 2.0 Govern practice. Jim Venuto founded SMC after a career leading security, privacy, GRC and CISO-level work for mid-size and large enterprises and public bodies. For a utility, that means owning the program at the leadership level: reading which rules apply, building the vulnerability analysis and program around them, briefing the board, and verifying that your operators, integrators and IT provider close the items. Where a system needs OT testing or hands-on work, SMC brings in specialist partners rather than stretching beyond its role.

If your system is covered and you want a clear plan before the 2027 dates, start with the Hudson Valley CISO fractional CISO page, or Book a free 30-minute call. You can also write to support@securitymedic.com.

Sources

Tags#utility#municipal#sled#nist-csf-2#checklist#executive