/01What changed in 2021
Governor Murphy signed P.L. 2021, c. 262 on November 8, 2021, amending the Water Quality Accountability Act of 2017. The amendments apply to every public community water system with more than 500 service connections, and they removed the old exemption for systems without internet-connected control systems.
The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) oversees the cybersecurity requirements. The New Jersey Department of Environmental Protection oversees the rest.
/02The cybersecurity checklist
- A written cybersecurity program consistent with the NIST Cybersecurity Framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family of standards. The deadline to update or develop it was May 7, 2022, so programs written before the amendments need checking.
- The program, and every revision of it, submitted to the NJCCIC.
- A process to report cybersecurity incidents to the NJCCIC promptly, required since February 6, 2022. Decide who reports, how, and what the report includes.
- A cybersecurity insurance policy, required since February 6, 2022.
- An annual certification of compliance that includes your cybersecurity program, signed by the responsible official (for a municipal system, the mayor or chief executive officer) and posted on your website.
- Records ready for an audit. An incident report can lead to an NJCCIC audit of your program and your response. NJDEP audits 10% of annual certifications each year, and a false or misleading certification is referred to the Attorney General.
/03Reporting an incident
Report to the NJCCIC at 1-833-4-NJCCIC (1-833-465-2242), at njccic@cyber.nj.gov, or through its online incident report. Have ready what happened, which systems are affected, when it started, and what you have done so far.
If a control system is involved, report to the FBI and to CISA as well. Our briefing on the July 2026 attacks lists what federal responders ask for.
/04The rest of the WQAA
The amendments also changed the asset management rules:
- Inspect valves 12 inches and larger at least every four years, and all other valves at least every eight years
- Test every hydrant annually
- Keep inspection, test and flushing records for at least 12 years
- Submit a Capital Improvement Report every year, covering improvements made in the previous year and planned for the next ten
/05The WQAA cybersecurity questionnaire
The WQAA cybersecurity questionnaire works as a baseline cybersecurity and resiliency controls assessment, and it covers the NIST Cybersecurity Framework (NIST CSF). In 2026 it puts greater emphasis on:
- ICS asset management
- Performing cybersecurity risk assessments
- Incident response preparation and plans
If your inventory, risk assessment and response plans are current, answering it becomes a matter of showing your evidence.
/06Choosing a framework
| Framework | What it is | A good fit for |
|---|
| NIST Cybersecurity Framework 2.0 | Six functions: Govern, Identify, Protect, Detect, Respond and Recover. Flexible and widely understood. | Most utilities. It maps cleanly to SDWA Section 1433 and to what insurers ask. |
| CIS Critical Security Controls v8.1 | 18 prioritized controls in three Implementation Groups. Group 1 is the essential baseline. | Small systems that want a concrete, prioritized list. |
| ISO/IEC 27000 family | A certifiable information security management system, under ISO/IEC 27001. | Larger utilities that want formal certification. |
For most small and mid-size systems, the NIST Cybersecurity Framework or CIS Implementation Group 1 is the practical starting point.
/07One program for both laws
If you serve more than 3,300 people, SDWA Section 1433 applies too. Build one program: the inventory, risk assessment and incident procedures that satisfy your WQAA framework are the same evidence your Risk and Resilience Assessment and Emergency Response Plan need. Read the Section 1433 guide.
/08How we help
We build or update your program to the NIST Cybersecurity Framework or CIS Controls, set up your NJCCIC reporting process, map your controls to your insurer’s requirements, and document it all for your annual certification. Culper-I and our SOC supply the monitoring and the incident details your program promises. The result is water and wastewater compliance. See the rules it covers.
