Download PDF

Critical Infrastructure Protection/EPA Urgently Needs a Strategy to Address Cybersecurity Risks to Water/Wastewater Systems: GAO Issued Report

The United States Government Accountability Office (“GAO”) released on August 1st a Report titled:

Critical Infrastructure Protection:

EPA Urgently Needs a Strategy to Address Cybersecurity Risks to Water and Wastewater Systems. (“Report”).

See GAO-24-106744.

GAO states that it undertook the Report because:

…Recent cyber incidents highlight the vulnerability of the 170,000 water and wastewater systems in the U.S. water sector.

The role of the United States Environmental Protection Agency (“EPA”) in leading, coordinating, and supporting activities to reduce cybersecurity risks to the water sector is addressed. However, GAO notes that EPA also works in partnership with the United States Department of Homeland Security’s Infrastructure Security Agency and other federal, state, and local entities.

GAO was asked to review:

• Cybersecurity threats facing the water sector.
• Federal government’s efforts to address these threats.

The GAO Report:

1. Describes cybersecurity risks and incidents.
2. Examines actions by selected federal and non-federal entities to improve cybersecurity.
3. Evaluates EPA’s actions to address known risks.

The GAO report makes four recommendations for EPA that include:

1. Assess sector risk.
2. Develop and implement a national cybersecurity strategy.
3. Evaluate the sufficiency of its legal authority to carry out its cybersecurity responsibilities.
4. Seek additional authority as necessary.

EPA in response to the GAO Report is stated to have indicated its concurrence with the recommendations and that it is taking action to complete them.

A copy of the Report can be downloaded here.