Cybersecurity Hub
SECURE Grant and No-Cost Technical Assistance for Water and Wastewater Systems
Overview Details and How to Apply
The application period closed on May 15.
Sign up for emails from EFC or contact our Community Assistance Teams to learn about future rounds.
EFC provides grant funding and no-cost technical assistance to help local governments and eligible entities strengthen the cybersecurity of their drinking water and wastewater systems. The SECURE grant program, together with hands-on support from the Community Assistance Teams, equips local governments with the tools to prevent, detect, and respond to increasingly sophisticated and dangerous cyber threats to critical water infrastructure while strengthening services that millions of New Yorkers rely on every day.
Communities can request one-on-one consultations and access centralized training and best practice resources below.
Cybersecurity Resources Learn the Risks, Take Action
EFC Webinar Recording: Cybersecurity Tips and First Steps
Learn about cybersecurity basics for the water industry, get an in-depth look at EFC’s 12 First Steps for Cybersecurity Preparedness, and hear more about new State cybersecurity initiatives through EFC and our partner agencies.
U.S. Environmental Protection Agency's Cybersecurity 101 Webinar: Recorded Training
Not sure what cybersecurity really means for your water or wastewater system? This video explains the basics in plain language. It covers the difference between your office computers and the systems that run your pumps and valves, how hackers try to get in, and what simple steps you can take to stop them.
To receive the credit, operators must complete the post-training quiz and email it to [email protected]; operators will receive a certificate of completion within 3-5 business days. Retain this certificate for submission with your 5-year renewal application.
2025 RTC Number: 25274-25 (0.5 contact hours)
2026 RTC Number: 26194-26C (0.5 contact hours)
Online Course: Basic Cybersecurity Measures for Water and Wastewater Systems
Once you understand the basics of cybersecurity, we recommend this self-paced, interactive course that walks you through practical steps your team can take to protect your systems. You'll learn how to set up stronger passwords, manage who has access, keep your software up to date, and respond to a cyberattack. Originally created for the Massachusetts Department of Environmental Protection, this course counts toward training hours for certified operators in New York State.
2025 RTC Number: 25347-25 (1 contact hour)
2026 RTC Number: 26193-26C (1 contact hour)
U.S. Environmental Protection Agency's Water Sector Cybersecurity Evaluation Program
Did you know performing a cybersecurity assessment could reduce the risk of a cyber attack by up to 45%?
Drinking water and wastewater utilities can use this form to request a free cybersecurity assessment. This evaluation will provide the assessed utility with a risk mitigation template to help understand discovered cybersecurity vulnerabilities and provide guidance on enhancing overall cybersecurity posture.
Security Controls: How Does Your System Compare?
Want to see how your system stacks up? This worksheet helps you review your current security measures and spot areas that need improvement. It’s based on widely accepted best practices from the Center for Internet Security and is a great tool to start planning your next steps.
12-Step Checklist
Improve your system’s defenses with these easy first steps recommended by the Community Assistance Teams. The resources above will help prepare you to take the actions listed below. Act today to avoid a cybersecurity incident tomorrow.
- Change default passwords
- Use strong passwords and implement a password policy
- Enforce access controls
- Take inventory of all assets
- Back up both operational and informational systems
- Keep all software updated
- Develop an incident response plan
- Enable multifactor authentication
- Learn how to identify phishing attempts
- Ensure operational systems are not accessible via unsecured internet connections
- Apply user privilege management
- Review our cybersecurity resources