The governors’ water letter handed one problem to three state secretaries
The March 2024 White House and EPA letter invited each state’s environmental, health and homeland security secretaries. That list was the finding: water cybersecurity in a state sits with a regulator, a funder and a responder, and few governors had named anyone to join them.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On March 19, 2024, EPA released a letter, dated March 18, from Administrator Michael Regan and National Security Advisor Jake Sullivan to every governor. It said disabling cyberattacks were striking water and wastewater systems. It cited attacks by actors affiliated with Iran’s Islamic Revolutionary Guard Corps on Unitronics controllers left with default passwords, and the Chinese state-sponsored group Volt Typhoon’s pre-positioning in critical infrastructure. It asked states to ensure that all water systems assess their cybersecurity, deploy controls and exercise incident plans. It invited each state’s environmental, health and homeland security secretaries to a virtual meeting, held on March 21. EPA would also form a Water Sector Cybersecurity Task Force with the sector’s coordinating councils. The letter came five months after EPA withdrew a 2023 memo on cybersecurity in sanitary surveys, following a legal challenge by states and water associations.
Commentary on the letter focused on the federal side: an agency that had lost a legal fight asking for voluntary help. Earlier in this series we covered the municipal side, where small utilities lack people, money and mandates. The letter’s address list pointed to a third layer, state government, and it is the one a governor could change fastest. By inviting three secretaries, Washington acknowledged that no single state office owned water cybersecurity. Each of the three holds a different lever. The regulator has routine contact with every system. The funder controls money utilities can spend on security. The responder acts when an attack lands. This article takes them in that order.
The regulator: routine contact with every system
Every state but Wyoming has primacy for drinking water, so a state agency runs the federal program day to day. In some states that agency sits in the environmental department. In others it sits in health. Either way, its staff visit water systems on a regular cycle for sanitary surveys, review operator certification and track compliance.
That contact is the most valuable asset in the whole system. It reaches the small systems that never call CISA or join an information-sharing center. EPA’s 2023 memo had tried to use it by requiring cybersecurity in sanitary surveys. After the memo was withdrawn, states remained free to add cybersecurity questions on their own authority.
A state regulator can act without new law in several ways. Inspectors can carry a short, nonbinding cybersecurity checklist: default passwords changed, no controllers reachable from the internet, remote access documented, backups of controller logic held offline. The results can feed a statewide register of exposed systems. Operator certification training can add a module on control-system security. Where state law allows, the regulator can make cyber findings a condition of follow-up visits.
The trade-off is staffing. Sanitary survey inspectors are engineers and scientists, not security specialists. A checklist they can complete during a routine visit is more useful than an assessment they cannot perform. Questions that need judgment should go to a state or shared-service specialist, with the inspector’s answers as the starting point.
The funder: money a utility can actually spend
Two federal streams reach water systems through state hands, and they sit in different offices. The Drinking Water State Revolving Fund is run by the state environmental or health agency, sometimes with a separate finance authority. According to EPA, its set-asides can pay for cybersecurity assessments and planning, and its loans can finance control-system upgrades. The State and Local Cybersecurity Grant Program, created by the 2021 infrastructure law, is run through a state administrative agency, usually homeland security or emergency management. Utilities generally reach it through a city or county sub-award tied to the state’s cybersecurity plan.
Neither stream was designed with small water systems in mind. Revolving fund priority lists favor pipes and treatment, scored on public health criteria where cyber projects rarely rank. Cybersecurity grant committees often focus on county networks and election systems. A utility manager would need to know both programs exist, which office runs each, and how to apply.
A governor can fix that with coordination rather than new money. The two program offices can agree on a common eligibility statement for water cyber projects. The revolving fund can add a cybersecurity scoring factor. The grant committee can reserve part of its local pass-through for shared services that utilities use, such as managed monitoring or vulnerability scanning. Contracts funded this way should require that integrators remove default credentials and hand over configuration backups.
The responder: who acts when an attack lands
The third lever sits with homeland security and emergency management. State homeland security advisors receive federal threat information, including classified briefings, that utilities do not see. Many states run fusion centers, and several have National Guard cyber units that can support local governments when the governor activates them.
For a small utility hit by an attack, the practical question is whom to call in the first hour. If the answer is the integrator who installed the controllers, the state has no visibility. If the answer is a state hotline that routes to an incident team, the state can help and can warn other systems running the same equipment. The Unitronics attacks showed why that matters, because the same device and the same default password were exposed at many sites.
States can make this concrete. Add water and wastewater to the state cyber incident response plan with named contacts. Include utilities in state exercises. Agree in advance with the regulator how a cyber incident that affects treatment will be handled, since it is both a security event and a public health event. Pre-arrange Guard support terms so activation is not negotiated during the incident.
Each lever works only if the others are connected. Inspectors find exposed controllers, the funder pays to fix them, and the responder knows which systems are weakest. Few states had one person with authority across all three. The letter could not appoint one. A governor could.
With hindsight
The warning proved accurate. On May 20, 2024, EPA issued an enforcement alert on drinking water cybersecurity. It said more than 70 percent of systems inspected since September 2023 did not fully comply with existing Safe Drinking Water Act resilience requirements, and that inspections would increase. In September 2024, Arkansas City, Kansas, moved its water treatment plant to manual operations after a cyber incident, and in October 2024 American Water disclosed a cyberattack on its systems.
The most concrete state answer came from New York. In July 2025 its health and environmental conservation departments proposed cybersecurity rules for drinking water and wastewater systems, with a state grant program. The rules were finalized in March 2026 and include incident reporting to the state within 24 hours. The split between two departments mirrored the letter’s address list. It also showed that a state could act where federal authority had stalled.