Cybersecurity & IT Solutions
for Water Districts

Current requirements include:

• One hour of cybersecurity training every three years for drinking water operators
• 24-hour reporting of cybersecurity incidents
• 48-hour reporting of cybersecurity vulnerabilities identified through a Cybersecurity Vulnerability Analysis (CVA)

These requirements make cybersecurity readiness an ongoing responsibility rather than a one-time project.

Appendix 5-E requirements include:

• Annual review and update of the Cybersecurity Vulnerability Analysis
• Submission of the CVA to the New York Department of Health every five years
• Submission within 30 days following major infrastructure changes
• Establishment of a cybersecurity program informed by CVA findings
• Program practices covering asset inventory, access controls, monitoring, detection, incident response, and recovery planning
• Designating a qualified individual responsible for the cybersecurity program
• Certification of the program every five years
• Annual confidential reporting to the governing body
• Ongoing network monitoring and logging

For larger systems serving a combined wholesale and retail population exceeding 50,000, additional requirements include:

Cybersecurity vulnerabilities affecting public health or compliance requirements require corrective action within the regulatory timelines.

Appendix 5-E requires more than completing documentation.

Water districts must assess risk, maintain documentation, implement controls, monitor their environments, and build programs that can be sustained over time.

Comprehensive Evaluations and Security Roadmaps

Cyber advisory services help districts evaluate their environment, identify gaps, and build prioritized security roadmaps.

Supports: Vulnerability analysis, risk identification, planning, and ongoing program development.

Dedicated Cybersecurity Expertise

Access cybersecurity professionals who can help assess risk and guide decision-making.

Supports: Organizations that need specialized expertise beyond internal operational resources.

Incident and Recovery Planning

Develop documented response and recovery processes before an incident occurs.

Supports: Incident readiness, reporting obligations, and response planning.

Managed IT and Cybersecurity

Connect advisory recommendations to practical cybersecurity controls and operational improvements.

Supports: Access management, authentication, infrastructure security, and ongoing control management.

Security and Network Monitoring

Gain continuous visibility into network activity and potential threats.

Supports: Monitoring, logging, detection, and ongoing cybersecurity operations.

Personnel Compliance and Program Support

Support the people, processes, and governance activities required to maintain a sustainable cybersecurity program.

Supports: Annual reviews, roadmap updates, compliance obligations, and continuous improvement.

Know What Assets Exist → Separate Critical Environments → Control Access → Monitor Activity → Detect Potential Threats → Respond and Recover

The operational benefits are significant:

• Reduced exposure to cybersecurity incidents
• Better visibility into critical systems and assets
• Faster identification of unusual activity
• Improved preparation for incident response and recovery
• Greater readiness for regulatory requirements
• Increased confidence in technology decisions
• Less pressure on internal teams to become cybersecurity specialists

The objective is not to make a water district operate like an IT company.

It is to apply practical cybersecurity controls around the systems that keep the district operating.