Build Your Own Cybersecurity Awareness Month Campaign

The recent increase in cyberattacks targeting critical infrastructure has reinforced the growing importance of cybersecurity across the water and wastewater sector. As utilities continue to adopt connected technologies to improve operations, treatment processes, and system monitoring, they also face a growing threat landscape. Cybersecurity is no longer just an IT concern. It is a shared responsibility that requires awareness from every member of your organization. Taking prompt action against suspected cyber threats helps safeguard essential services, protect sensitive data, and ensure the continued delivery of clean water and wastewater treatment services to the communities we serve.

This October, the Cybersecurity and Infrastructure Security Agency (CISA), invites organizations to take proactive steps to strengthen their cyber defenses with the theme, "Securing the Next 250." This campaign emphasizes that organizations supporting critical infrastructure play a vital role in strengthening national resilience against cyber threats to ensure a secure digital future for the nation. For water and wastewater utilities, that means focusing on foundational cybersecurity practices such as training employees to recognize phishing attempts, requiring strong passwords and multifactor authentication, maintaining up-to-date software, backing up critical data, and preparing for potential disruptions through effective incident response planning.

CISA reminds us that no organization is too small to be a target and that every organization connected to critical infrastructure has a role to play in protecting essential services. Cybersecurity Awareness Month provides an opportunity to reinforce security best practices, engage employees in ongoing cybersecurity education, and evaluate where additional safeguards may be needed. By making cybersecurity a year-round priority, water and wastewater professionals can help strengthen operational resilience, reduce risk, and ensure reliable service for the customers and communities who depend on them every day.

This year, CISA has provided a toolkit to help organizations build their own Cybersecurity Awareness Month campaigns.

Other organizations outside of CISA have created cybersecurity resources that can be useful for water and wastewater systems in protecting their utility. A great resource we'd like to highlight comes from WSU Environmental Finance Center in the form of a video titled: "Protect Your Utility: Cybersecurity Tips for Water and Wastewater Systems" (below). This video features "Michelle Dehaven, a Senior Program Manager at the Environmental Finance Center at Wichita State University, as she explains a few tips for keeping even the smallest system protected from random cybersecurity threats. In this video, Michelle helps you understand the potential impacts of a cybersecurity incident and how you can take simple steps to build a baseline of protection." The video will cover: what cybersecurity is, the potential impacts a cyber incident could have on your utility, and some no-cost to low-cost ways to reduce that risk. The video also highlights the following additional resources to help you build your own risk and resilience plan:

• Secure Your Business

• CISA Hygiene Services

• EPA Incident Action Checklists

• EPA Water Cybersecurity Assessment Tool (WCAT)

Do you have questions or need help with your utility's cyber-awareness, reach out to the EFCN for technical assistance and training support. Get help at: https://efcnetwork.org/get-help/