EPA withdrew an interpretative memorandum on October 11 that directed state drinking water administrators to include cybersecurity in the Sanitary Surveys that drinking water utilities undergo every three years.   

The memo was opposed by national water sector associations, including NACWA, as explained in a January 25  letter from the associations to EPA Administrator Michael Regan, asking that the Agency withdraw the memo.   The associations argued that the Sanitary Survey approach for cybersecurity would be ineffective and burdensome to both utilities and the states.   

EPA’s withdrawal comes after the US Court of Appeals for the Eighth Circuit paused EPA’s implementation of the memo in July.  The states of Missouri, Arkansas, and Iowa challenged the memo, arguing that it was not just an interpretation of an existing rule, but a rule that was promulgated without the required public notice procedures.  The American Water Works Association (AWWA) and the National Rural Water Association (NRWA) also filed a motion for a stay, which was granted by the court.      

EPA and national water sector associations like NACWA agree on the need for the sector to increase the cybersecurity of utilities, but the preferred approaches have differed.  In addition to EPA’s attempt to include cybersecurity in the drinking water Sanitary Surveys, the Agency has also considered adding cybersecurity requirements to National Pollutant Discharge Elimination System (NPDES) permits for wastewater utilities.  NACWA has similar concerns with this approach for its members as for the sanitary survey approach for drinking water.    

NACWA will continue to work with EPA and the water sector associations to find practical, effective solutions to cybersecurity for drinking water and wastewater utilities.  The Association will keep its members informed on developments related to cybersecurity requirements.  Members with questions about cybersecurity should contact Cynthia Finley, NACWA’s Director of Regulatory Affairs.