The DEC and DOH now require all water and wastewater utilities in New York state to follow basic cybersecurity standards. The focus is sustained protection rather than a one-time exercise, and these requirements align with federal cybersecurity guidance.

Starting October 1, 2026, Connecticut’s new bill, Raised Bill No. 117, will require organizations to hire outside forensic experts and submit a detailed report to the state if they discover a data breach affecting at least 100,000 Connecticut residents. This only applies to Connecticut residents and excludes non-CT residents. For organizations across the U.S. handling Connecticut resident data, a single large breach could trigger Connecticut’s requirements regardless of location.