Cybersecurity a top priority for utilities, report finds

The 2025 iteration of the American Water Works Association’s (AWWA) State of the Water Industry survey included new questions exploring natural and human-caused hazards facing water utility professionals.

Among human-caused hazards, cybersecurity was the No. 1 concern. Two-thirds of utility executives surveyed said cybersecurity and privacy are top priorities moving into this year. However, one-quarter of small systems indicated they have limited ability to implement cybersecurity controls.

The State of the Water Industry survey results demonstrate that awareness of cyberthreats is higher than it has ever been, rising in the past several years to consistently rank in the top 10 of utility manager concerns. AWWA and other water sector partners are supporting policy initiatives designed to provide sound footing for sensible, risk-based cybersecurity measures, including additional funding for tools, technical assistance, and enhanced information-sharing.

AWWA has advocated for a sector-led model to build cyber resilience among water systems, which is the intent of H.R. 2594, the Water Risk and Resilience Organization (WRRO) Establishment Act. The act would establish an independent, nongovernmental organization led by the sector to develop minimum cybersecurity requirements with oversight from the U.S. Environmental Protection Agency. This approach ensures direct engagement by water system owners, operators, and subject-matter experts in the development of cybersecurity requirements that can be right-sized to the needs of water systems.

“This bill represents exactly the kind of thoughtful collaboration we need to address a very serious threat to our nation’s water systems,” David LaFrance, AWWA CEO, said when the bill was introduced earlier this year.

In the meantime, utilities have access to free AWWA resources that can assist in cybersecurity planning:

• Water Sector Cybersecurity Risk Management Guidance, newly updated to help water systems at any stage of their cybersecurity journey.
• The Getting Started Guide to risk management, outlining the first set of actions any system can implement to mitigate cyber threats.
• An Assessment Tool that generates a customized, prioritized list of controls that are most applicable to the system and its threats.

Among natural hazards, the data show a split by geographic region.

The eastern half of North America reported extreme weather patterns, precipitation patterns, and flooding as the top concern. The western half listed droughts, wildfires, and precipitation patterns as their top concerns.

The combination of climate variability and escalating cybersecurity threats is among the considerations all systems can evaluate in relation to their ability to sustain continuity or service. This comes as many community water systems are in the process of updating their risk and resilience assessment and emergency response plan to comply with SDWA Sec. 1433

“By embracing innovative solutions and sustainable practices, we can ensure system integrity and reliability, even as we face increasing natural hazards and the pressures of climate change,” said Heather Collins, AWWA president and director of water system operations at the Metropolitan Water District of Southern California. “Together, we must prioritize investment in resilient infrastructure to secure the future of water services for generations to come.”

To compile the industry report, AWWA surveyed 3,575 water professionals from Sept. 23 to Nov. 1, 2024. The largest category of respondents represented water sector utilities (64%), followed by those providing goods and services to the water sector (19%).

For the full report and other information, visit https://www.awwa.org/state-of-the-water-industry/.