Cybersecurity Hub
SECURE Grant and No-Cost Technical Assistance for New York’s Water and Wastewater Systems
Overview
New York’s Commitment to Cybersecurity
EFC provides grant funding and no-cost technical assistance to help local governments and eligible entities strengthen the cybersecurity of their drinking water and wastewater systems. This program is part of Governor Kathy Hochul's comprehensive cybersecurity initiative to strengthen and protect water infrastructure statewide. The Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancement (SECURE) grant program, together with hands-on support from the Community Assistance Teams, equips local governments with the tools to prevent, detect, and respond to increasingly sophisticated and dangerous cyber threats to critical water infrastructure while strengthening services that millions of New Yorkers rely on every day.
FUNDING AVAILABLE: $2.5 MILLION
Details and How to Apply
SECURE grants can fund assessments and improvements that protect water and wastewater systems from evolving cyber threats. EFC uses an online application. Applications are due by 5 p.m. on May 15.
UP TO $50K FOR CYBERSECURITY ASSESSMENTS
Eligible Activities:
- Third-party cybersecurity risk assessments and penetration testing
- Network architecture reviews and asset inventories
- Creation of system-specific cybersecurity implementation roadmaps
UP TO $100K TO IMPLEMENT CYBERSECURITY UPGRADES
Eligible Activities:
- Procurement and installation of security equipment (firewalls, network segmentation devices, access control systems, etc.)
- Development and implementation of incident response plans and continuity of operations plans
- Deployment of monitoring, alerting, and backup/recovery solutions
EFC’s Community Assistance Teams are available to provide no-cost guidance and tools to help water and wastewater systems implement cybersecurity best practices. Communities can request one-on-one consultations and access centralized training and best practice resources below.
Cybersecurity Resources
Learn the Risks, Take Action
Webinar Recording: Cybersecurity Tips and First Steps
Learn about cybersecurity basics for the water industry, get an in-depth look at EFC’s 12 First Steps for Cybersecurity Preparedness, and hear more about new State cybersecurity initiatives through EFC and our partner agencies.
Video: Cybersecurity 101
Not sure what cybersecurity really means for your water or wastewater system? This video from the U.S. Environmental Protection Agency (EPA) explains the basics in plain language. It covers the difference between your office computers and the systems that run your pumps and valves, how hackers try to get in, and what simple steps you can take to stop them.
RTC Number 26194-26C | Credit available: 0.5 contact hours
Online Course: Basic Cybersecurity Measures
Once you understand the basics of cybersecurity, we recommend this self-paced, interactive course that walks you through practical steps your team can take to protect your systems. You'll learn how to set up stronger passwords, manage who has access, keep your software up to date, and respond to a cyberattack. Originally created for the Massachusetts Department of Environmental Protection, this course counts toward training hours for certified operators in New York State.
RTC Number 26193-26C | Credit available: 1 contact hour
EPA’s Water Sector Cybersecurity Evaluation Program
Did you know performing a cybersecurity assessment could reduce the risk of a cyber attack by up to 45%?
Drinking water and wastewater utilities can use this form to request a free cybersecurity assessment. This evaluation will provide the assessed utility with a risk mitigation template to help understand discovered cybersecurity vulnerabilities and provide guidance on enhancing overall cybersecurity posture.
Security Controls: How Does Your System Compare?
Want to see how your system stacks up? This worksheet helps you review your current security measures and spot areas that need improvement. It’s based on widely accepted best practices from the Center for Internet Security and is a great tool to start planning your next steps.
12-Step Checklist
Improve your system’s defenses with these easy first steps recommended by the Community Assistance Teams. The resources above will help prepare you to take the actions listed below. Act today to avoid a cybersecurity incident tomorrow.
- Change default passwords
- Use strong passwords and implement a password policy
- Enforce access controls
- Take inventory of all assets
- Back up both operational and informational systems
- Keep all software updated
- Develop an incident response plan
- Enable multifactor authentication
- Learn how to identify phishing attempts
- Ensure operational systems are not accessible via unsecured internet connections
- Apply user privilege management
- Review our cybersecurity resources