7 Ways the U.S. Is Trying To Defend Its Water System From Hackers

In the wake of nationwide cyberattacks on America’s water infrastructure, the Trump administration launched Project Watershed 250 on August 31. The six-month pilot, based in Texas, pairs local water utilities with free federal, state, and private-sector cybersecurity services.

Water utilities, especially the 90 percent of the sector considered small utilities that serve communities of fewer than 3,300 people, are easy targets for hackers due to limited budgets, cybersecurity investment, and expertise. The White House effort is the latest in a series of funding, technical assistance, and regulatory initiatives aiming to tackle this problem. Here’s what to know:

1. Cyber-specific federal funding is needed for U.S. water utilities.

The federal Clean Water and Drinking Water State Revolving Funds have provided billions of dollars in assistance to communities over the past 30 years for water-related projects. Communities can use the funds for a wide range of water infrastructure projects, but only a few states prioritize projects that incorporate cybersecurity. In August, Sens. Adam Schiff (D-CA) and Amy Klobuchar (D-MN) introduced the Water Cyber Shield Act of 2026, which would authorize an additional $300 million for the Drinking Water State Revolving Fund solely for cybersecurity needs.

2. Federal subsidies would expand water utilities’ membership in cybersecurity information-sharing programs.

Industries maintain information-sharing bodies to quickly disseminate cyber and physical security risk information. The nonprofit Water Information Sharing and Analysis Center (WaterISAC) provides threat intelligence and incident alerts for water utilities. Because it is a dues-based membership organization and the fees are too expensive for small operators, only 1 percent of the nation’s community drinking water systems are members. To close that gap, Rep. Jan Schakowsky (D-IL) and Sen. Ed Markey (D-MA) introduced a bill that would direct the Environmental Protection Agency (EPA) to create a grant program to help offset WaterISAC membership dues. Despite industry endorsement, the bill is currently held up in a subcommittee.

3. The private sector is pitching in on water cybersecurity.

On August 7, the National Rural Water Association (NRWA) and its partners at DEF CON Franklin — an initiative out of the University of Chicago — launched the Water Watch Center, through which private cybersecurity firms will provide threat intelligence and vulnerability management information through the NRWA to small utilities. The initiative builds on a two-year volunteer effort that recruited nearly 450 cyber experts to work with water utilities in seven states to test and refine defense strategies. The center will provide similar services to those being tested in the White House pilot program, which will connect tech companies such as Reflection AI, Palo Alto Networks, and Dragos Inc. with Texas Cyber Command to support water utilities.

4. Hands-on technical assistance is critical for water utilities.

In 2025, the U.S. Department of Agriculture (USDA) completed a year-long pilot program adapting an existing rural water technical support program for cybersecurity. The existing Circuit Rider Program provides operational, regulatory compliance, and physical security assistance and training to rural water utilities, but until now, it has not offered cybersecurity support.

The pilot tested extending the program’s benefits to cyber through 24 full assessments and nearly 300 direct contacts with utilities. The pilot found that utilities were most willing to engage when they were provided with in-person, plain-language support. Following its execution, Sens. Catherine Cortez Masto (D-NV) and Mike Rounds (R-SD) and Reps. Don Davis (D-NC) and Zack Nunn (R-IA) introduced legislation to create dedicated cyber circuit rider teams. Industry groups support the idea, which has been incorporated in the House and Senate versions of the Farm Bill.

5. Industry wants to lead development of water risk and resilience standards and requirements.

Over the past three years, both Iran- and Russia-connected hackers have disrupted operations at U.S. water providers. These threats have prompted industry organizations to argue for the creation of a Water Risk and Resilience Organization (WRRO) to develop and oversee cybersecurity requirements for the water industry. Minimum standards created by the WRRO would primarily cover water utilities serving 3,300 or more people. In the wake of the latest cyberattacks, the American Water Works Association sent a letter to Congress and publicly called for the creation of the “sensible” and “scalable” requirements “shaped by water professionals and cybersecurity experts.”

6. Congress is considering federal water cybersecurity regulations.

Congress is also exploring expanding existing regulatory requirements. In 2018, the America’s Water Infrastructure Act amended the Safe Drinking Water Act to require water utilities serving more than 3,300 people to conduct risk and resilience assessments covering natural hazards and physical and cybersecurity risks. The proposed Water Cyber Shield Act of 2026 would, for the first time, extend a parallel set of requirements to large wastewater treatment systems. The bill would also direct the EPA to create cybersecurity standards for the sector, conduct cybersecurity assessments, and require corrective action when significant vulnerabilities are identified. Industry prefers the WRRO’s more collaborative model over EPA rulemaking, warning against a one-size-fits-all approach.

7. Research initiatives may point the way for improved water defenses.

Idaho National Laboratory (INL), the nation’s premier industrial control system cybersecurity research institution, created a Water Security Test Bed to improve detection of chemical, biological, or radiological agents introduced after an intentional attack or a natural disaster. Over time, cyberattacks have become a key research area, so INL is expanding the test bed to more closely mirror how a real municipal water system is monitored and controlled. INL has also redeveloped parts of its water test bed to enable cybersecurity testing of new operational systems.

Sophie McDowall is a research associate for the Center on Cyber and Technology Innovation (CCTI) at the Foundation for Defense of Democracies (FDD), where Kateryna “Katya” Kvasha is an intern. For more analysis from the authors and FDD, subscribe HERE. Follow Sophie on X @SophieMcDowall. Follow FDD on X @FDD and @FDD_CCTI. FDD is a Washington, DC-based, nonpartisan research institute focusing on national security and foreign policy.