--- title: What New York’s New Water System Cyber Rules Mean for Your Utility (and How to Use SECURE Grant Funding) description: New York is the first state to require cybersecurity protection for drinking water and wastewater utilities. To help pay for these upgrades, the state offers SECURE grants. This means local water utilities now have new rules to follow and new funding to improve their cyber defenses. image: https://info.janusassociates.com/hubfs/JANUS-Wastewater%20Cybersecurity%20Resources%20-%20NYSDEC.jpg --- [JANUS](https://janusassociates.com/) Protecting our clients' data & best interests since 1988. [203-251-0200](tel:203-251-0200) [Menu](https://info.janusassociates.com/blog/what-new-yorks-new-water-system-cyber-rules-mean-for-your-utility-and-how-to-use-secure-grant-funding#menu) - [Menu Item](https://janusassociates.com/) - [Cybersecurity Services](https://janusassociates.com/services/) - [CMMC Readiness Services](https://janusassociates.com/services/cmmc-advisory-readiness-services/) - [Risk Assessments](https://janusassociates.com/services/assessments/) - [Advanced Penetration Testing](https://janusassociates.com/services/penetration-testing/) - [VCISO Services](https://janusassociates.com/services/cio-ciso-services/) - [Business Resilience](https://janusassociates.com/services/business-resilience/) - [Enterprise Risk & Compliance](https://janusassociates.com/solutions/enterprise-risk-compliance/) - [ARC-AMPE (MARS-E) Compliance](https://janusassociates.com/services/mars-e/) - [Security Architecture & Implementation](https://janusassociates.com/solutions/security-architecture-implementation/) - [Strategy & Advice](https://janusassociates.com/solutions/strategy/) - [Employee Training & Awareness](https://janusassociates.com/solutions/training-awareness/) - [Sectors](https://janusassociates.com/sectors/) - [Commercial](https://janusassociates.com/sectors/commercial/) - [Education & Nonprofit](https://janusassociates.com/sectors/education-non-profit/) - [Financial Services](https://janusassociates.com/sectors/financial-services/) - [Gaming, Casinos, & Entertainment](https://janusassociates.com/sectors/gaming-casinos-entertainment-2/) - [Government](https://janusassociates.com/sectors/government/) - [Healthcare](https://janusassociates.com/sectors/health-care/) - [Legal](https://janusassociates.com/sectors/legal/) - [Manufacturing & Critical Infrastructure](https://janusassociates.com/sectors/critical-infrastructure/) - [About Us](https://janusassociates.com/about/) - [Leadership Team](https://janusassociates.com/about/leadership/) - [Contracts & Certifications](https://janusassociates.com/about/contracts-certifications/) - [Cyber Security Framework Expertise](https://janusassociates.com/cyber-security-framework-expertise/) - [Partnerships](https://info.janusassociates.com/partnerships) - [Information Hub](https://info.janusassociates.com/blog) - [Blog](https://info.janusassociates.com/blog) - [Case Studies](https://janusassociates.com/ebooks/) - [Federal Guidance & Frameworks](https://janusassociates.com/resources/) - [Small Business Resources](https://janusassociates.com/small-business-resources/) - [Videos](https://janusassociates.com/video/) - [Contact Us](https://janusassociates.com/contact/) - [Request Consultation](https://info.janusassociates.com/request-a-consultation) Blog What New York’s New Water System Cyber Rules Mean for Your Utility (and How to Use SECURE Grant Funding) 7:25 # What New York’s New Water System Cyber Rules Mean for Your Utility (and How to Use SECURE Grant Funding) ## ![JANUS-Wastewater Cybersecurity Resources - NYSDEC](https://info.janusassociates.com/hs-fs/hubfs/JANUS-Wastewater%20Cybersecurity%20Resources%20-%20NYSDEC.jpg?width=1960&height=1103&name=JANUS-Wastewater%20Cybersecurity%20Resources%20-%20NYSDEC.jpg) The DEC and DOH now require all water and wastewater utilities in New York state to follow basic cybersecurity standards. The focus is sustained protection rather than a one-time exercise, and these requirements align with federal cybersecurity guidance. ## New York water system cybersecurity: what the new rules require Here’s what water and wastewater utilities need to do: - Conducting risk-informed cybersecurity activities across IT and OT/SCADA environments, including treatment, distribution, and control systems. - Providing mandatory cybersecurity training for certified operators as part of their ongoing credential requirements. - Reporting cybersecurity incidents within specified timeframes, including for SPDES-permitted wastewater facilities. - Implementing risk-based, tiered protections for critical operations and sensitive information, such as access controls, segmentation, and secure remote access. - Designating a cybersecurity lead for larger drinking water systems to own governance and oversight. Wastewater utilities must report any cybersecurity incidents to the Regional Water Engineer within 24 hours. A written report is due within 30 days. These rules mean utilities need to keep up regular policies, monitoring, training, and reporting; not just do a one-time project. ## How the SECURE grant program works in New York To help utilities pay for these new cybersecurity requirements, New York created the SECURE grant program. The state is offering about $2.5 million in grants, managed by the Environmental Facilities Corporation. Here’s** how the SECURE grant works:** - Up to $50,000 per eligible utility for a cybersecurity assessment for water utilities and wastewater systems. - Up to $100,000 per eligible utility to implement cybersecurity upgrades that address identified gaps. All water and wastewater utilities in New York can apply starting March 2026. Check the official program site for deadlines and details. If you get funding, be ready to show your work is well-planned, risk-based, and clearly documented for regulators. For additional program details, utilities should review the official [SECURE grant announcement](https://www.governor.ny.gov/news/governor-hochul-announces-first-nation-cybersecurity-regulations-and-grants-protect-new-york) from EFC and DEC’s wastewater cybersecurity resources. ## Immediate action steps for New York utilities (and how JANUS can help) With SECURE funding, your utility can build a strong, practical cybersecurity program. Here are seven steps, each one supported by JANUS Associates’ expertise. ### 1. Clarify your regulatory scope and risk profile **Action:** Inventory IT and OT/SCADA assets, identify which plants, remote sites, and SPDES-permitted operations fall under the New York cybersecurity regulations for utilities, and assess your current cyber maturity. **JANUS:** Our cybersecurity experts provide cyber risk and compliance assessments aligned to NIST Cybersecurity Framework, CIS Controls, and ISO 27001, with clear, audit-ready documentation for state regulators, boards, and municipal leadership. ### 2. Apply for SECURE funding with a structured assessment plan **Action:** Build a scoped, defensible proposal for how [SECURE’s $50,000 dollar](https://www.governor.ny.gov/news/governor-hochul-announces-first-nation-cybersecurity-regulations-and-grants-protect-new-york) assessment allocation will be used, including methodology, systems to be evaluated, and concrete deliverables. **JANUS:** Designs grant-funded cybersecurity assessments aligned to NIST CSF and CIS Controls, with transparent scoping, milestones, and reporting that support EFC review and local governance expectations. ### 3. Perform a comprehensive IT and OT/SCADA risk and control assessment **Action:** Evaluate OT and SCADA security across treatment plants, distribution systems, telemetry, and remote sites, as well as corporate IT, identity, remote access, and vendor connectivity. **JANUS:** Our OT and SCADA security services review and assess industrial control architectures, segmentation, access control, and monitoring, translating OT and SCADA security realities into actionable, standards-aligned improvements. [![Horizontal-CTA Data Breach Incident Response Plan - Content Offer](https://no-cache.hubspot.com/cta/default/4114417/e82a826f-1b96-452e-8ef6-bbf14fc5e73e.png)](https://cta-redirect.hubspot.com/cta/redirect/4114417/e82a826f-1b96-452e-8ef6-bbf14fc5e73e) ### 4. Build a prioritized security roadmap aligned to SECURE upgrade dollars **Action:** Turn your assessment into a step-by-step plan that addresses the biggest risks first and fits your SECURE grant budget. **JANUS:** Our team develops security architecture and roadmaps aligned with NIST CIS and ISO 27001 cybersecurity controls, tying specific control implementations to risk reduction, regulatory expectations, and available grant and local funding. ### 5. Implement security upgrades that qualify for grant funding **Action:** Use SECURE grant funds for upgrades that truly reduce your risks, such as segmenting networks, creating and testing reliable backups, and implementing advanced methods to detect and respond to attacks. **JANUS:** We help you implement a resilient security architecture, providing hands-on design guidance, configuration guidance, and vendor coordination while remaining vendor-neutral and focused on measurable risk-reduction outcomes. ### 6. Formalize governance, training, and leadership **Action:** Establish or update cybersecurity policies, incident response plans, operator cyber training, and regular reporting to boards and municipal leaders, including procedures for SPDES incident reporting timelines. **JANUS:** Through virtual CISO and cybersecurity governance support, JANUS helps utilities formalize governance structures, define the cybersecurity lead role, design operator training, and run tabletop exercises aligned to DEC/DOH and NIST expectations. ### 7. Plan for continuous improvement and re-assessment **Action:** Treat SECURE-funded work as the start of a recurring risk lifecycle, with scheduled reassessments, vulnerability management, and periodic training updates. **JANUS:** Many clients opt for an ongoing vCISO engagement, recurring assessments, and continuous vulnerability and risk management. This helps utilities demonstrate sustained program maturity over time. [*For more on JANUS capabilities, review cyber risk and compliance assessments from JANUS Associates.*](https://janusassociates.com/services/enterprise-risk-compliance/) ## Why JANUS Associates is the right partner for New York utilities JANUS Associates is a long-standing, New York–based, vendor-neutral cybersecurity and risk management firm with deep experience in public utilities, critical infrastructure, and regulated sectors. JANUS already supports water and wastewater utilities and other SCADA/OT operators, bridging the realities of treatment plants and field operations with governance and compliance expectations at the board and regulator level.  Assessments and roadmaps from JANUS are anchored in widely recognized frameworks such as the NIST Cybersecurity Framework, CIS Critical Security Controls, and ISO 27001, making it easier to defend investment decisions and demonstrate alignment with best practices. By focusing on risk-based, standards-aligned outcomes rather than specific products, JANUS helps utilities use SECURE grant dollars efficiently while building sustainable, right-sized programs. [![Request a Complimentary Cybersecurity Consultation](https://no-cache.hubspot.com/cta/default/4114417/interactive-197944013912.png)](https://info.janusassociates.com/hs/cta/wi/redirect?encryptedPayload=AVxigLIQuSvtrN7BHImOeiZn22AYoj03bxc7bJOEtjsIz2BoPBv09PeDrTzhuedfi9s6DfoZZH4dfjz47BiLWvjLqjnLsaAGQ0R%2BEmZIKMKvG%2FcnvzRnal0ehXNd2%2B8kiZLXhWoPH1NxqjOceWR9VN0%2F2mnX%2FRvz1rkXXxN%2FG1WK%2F3VfayjLddAP%2BSjcBjuyZf%2F3zIMzPJsNzzbkRZg%3D&webInteractiveContentId=197944013912&portalId=4114417) ### Get Started Now SECURE grant applications are open, and new rules are coming soon. Act quickly but make sure you have a clear plan. A short consultation can help you understand the rules, set up a grant-eligible assessment, and create a plan that makes the most of SECURE funding.   Topics: [CIO & CISO Services](https://info.janusassociates.com/blog/tag/cio-ciso-services), [Enterprise Risk & Compliance](https://info.janusassociates.com/blog/tag/enterprise-risk-compliance) ### Topics - [Business Resilience (22)](https://info.janusassociates.com/blog/tag/business-resilience) - [Data Breach Protection (16)](https://info.janusassociates.com/blog/tag/data-breach-protection) - [Employee Security Awareness Training (13)](https://info.janusassociates.com/blog/tag/employee-security-awareness-training) - [Incident Response (13)](https://info.janusassociates.com/blog/tag/incident-response) - [Managing Cyber Risks (10)](https://info.janusassociates.com/blog/tag/managing-cyber-risks) - [CIO & CISO Services (8)](https://info.janusassociates.com/blog/tag/cio-ciso-services) - [Vulnerability Assessments (8)](https://info.janusassociates.com/blog/tag/vulnerability-assessments) - [AI and Cybersecurity (7)](https://info.janusassociates.com/blog/tag/ai-and-cybersecurity) - [Cybersecurity Education (7)](https://info.janusassociates.com/blog/tag/cybersecurity-education) - [Business Continuity & Disaster Recovery (BCDR) (6)](https://info.janusassociates.com/blog/tag/business-continuity-disaster-recovery-bcdr) - [Information Security (InfoSec) (6)](https://info.janusassociates.com/blog/tag/information-security-infosec) - [Ransomware (6)](https://info.janusassociates.com/blog/tag/ransomware) - [Case Study (5)](https://info.janusassociates.com/blog/tag/case-study) - [Cyber Insurance (5)](https://info.janusassociates.com/blog/tag/cyber-insurance) - [Enterprise Risk & Compliance (5)](https://info.janusassociates.com/blog/tag/enterprise-risk-compliance) - [Penetration Testing (5)](https://info.janusassociates.com/blog/tag/penetration-testing) - [Cybersecurity Maturity Model Certification (CMMC) (4)](https://info.janusassociates.com/blog/tag/cybersecurity-maturity-model-certification-cmmc) - [Attack Surface Discovery (ASD) (2)](https://info.janusassociates.com/blog/tag/attack-surface-discovery-asd) - [Small Business (1)](https://info.janusassociates.com/blog/tag/small-business) See all ### Cybersecurity Moves Fast. Stay Informed. [![New Government Guidance: Principles for the Secure Integration of Artificial Intelligence in Operational Technology](https://no-cache.hubspot.com/cta/default/4114417/interactive-202638233961.png)](https://info.janusassociates.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLNnxtb09UT%2B1VuOtNajf8Vs0hNiSrtw1AoOjJT264ie0RGDzPOT7x36UC0p9KHyeglraRBtx4eBRbMqH52%2Bpn5eU6d1Ee1dCZk7mI%2FO8Jr8T9MjUrbiMaie6gxxWiE39tBH9cmPkUwYO6tb0g%2FKzM0WsbqV1WX1oqfp61Di0VL2FmERHeDnPahFu%2B6CmGqw88i516wwbCHsYm1sfyeVkCumg0EuRTuPoHkCV0nJUTFz8kxKMtmKR15hUOw0VwHHhlI%2B4snAnQIiaRRbZznBEYzOor5h89hAfhCM1sgQhSdjhlxrQ%3D%3D&webInteractiveContentId=202638233961&portalId=4114417) [![JANUS-ARCAMPE-MARSE-HEALTHCARE-SECURITY-MEDTECH](https://no-cache.hubspot.com/cta/default/4114417/interactive-205217918251.png)](https://info.janusassociates.com/hs/cta/wi/redirect?encryptedPayload=AVxigLIVwut233Stn6a4LbtDS0151c%2B1y06qDt6%2F4AEq8Yy4SGHIJObmLghUfgdpu6eIQblqlYYgOXyV%2B6gv%2FWP9pE3PLCttDj4GR2kuOO29hTQbFnLKVZRcOnlY8q93Jzf5KlBbp4v2AwQaap1DF7QwT%2ByVnUNGcBWRbt4lIMS9wPiGRSCrrW5p7HFEKSlTmnYAS8eA&webInteractiveContentId=205217918251&portalId=4114417) - [Cybersecurity Blog](https://info.janusassociates.com/blog) - [JANUS Services](https://janusassociates.com/services/) - [ARC-AMPE (MARS-E) Compliance](https://janusassociates.com/services/mars-e/) - [Small Business Complete](https://janusassociates.com/services/small-business-complete/) - [Contact Us](https://janusassociates.com/contact/) - [Site Map](https://janusassociates.com/page-sitemap.xml) - [Privacy Policy](https://janusassociates.com/privacy/) [![GSA Advantage Logo/Link](https://janusassociates.com/wp-content/uploads/2017/04/GSAAdvantage_full_Color_generic_2015_vector-1.png)](https://www.gsaelibrary.gsa.gov/ElibMain/contractorInfo.do?contractNumber=GS-35F-471BA&contractorName=JANUS+SOFTWARE%2c+INC.&executeQuery=YES) #### JANUS Associates 1200 High Ridge Road Stamford, CT 06905 Tel: [203.251.0200](tel:203-251-0200) Fax: 203.251.0222 Email: [info@janusassociates](mailto:info@janusassociates.com?Subject=Janus%20Inquiry) © 2026 JANUS Associates, Inc. - - - - - ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Emily Burnaman", "url" : "https://info.janusassociates.com/blog/author/emily-burnaman" }, "dateModified" : "2026-04-15T19:11:55.317Z", "datePublished" : "2026-04-07T16:08:59.000Z", "headline" : "What New York’s New Water System Cyber Rules Mean for Your Utility (and How to Use SECURE Grant Funding)", "image" : [ "https://info.janusassociates.com/hubfs/JANUS-Wastewater%20Cybersecurity%20Resources%20-%20NYSDEC.jpg" ], "mainEntityOfPage" : { "@id" : "https://info.janusassociates.com/blog/what-new-yorks-new-water-system-cyber-rules-mean-for-your-utility-and-how-to-use-secure-grant-funding", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://info.janusassociates.com/hubfs/logo-1.png" }, "name" : "JANUS Associates" } } ```