Know which rules apply to you, by system and by state, and what it takes to meet them. Every DT6 product ends in a compliance result, so the evidence builds as the protection runs.
Compliance solution briefPDF, 2 pages
Built for
The requirements, reporting channels, insurance and grants that apply to water and wastewater systems, by level of government.
| Area | Federal | New Jersey | New York |
|---|---|---|---|
| Water systems | EPA cybersecurity for the water sector | Water Quality Accountability Act (WQAA) | NYSDOH Appendix 5-E |
| Wastewater systems | CISA federal roles for cyber incident response | None listed | NYCRR wastewater cybersecurity rules |
| Emergency cybersecurity incident reporting | National Incident Management System (NIMS)Water and Wastewater Agency Response Networks (WARN) | NJCCIC incident report | NYSDOH incident reporting |
| Insurance | EPA cyber insurance guidance | NJ MEL Cyber JIF | None listed |
| Grants | State and Local Cybersecurity Grant Program (SLCGP) | New Jersey Water Bank (NJWB) | New York grants for water and wastewater systems |
Area by area
SDWA Section 1433, the NJ WQAA and NYSDOH Appendix 5-E: what each asks, and when.
Explore water systemsThe MEL Deductible Reduction Groups, and what an underwriter will ask.
Explore cyber insuranceWhat each mandate asks of you, and how we help you meet it.
| Requirement | What it asks | How we help |
|---|---|---|
| Safe Drinking Water Act, Section 1433Community water systems over 3,300 people | Assess the security of electronic, computer and automated systems, plan your response, and recertify to EPA every five years. | The cyber sections of your Risk and Resilience Assessment and Emergency Response Plan. The Section 1433 guide |
| NJ Water Quality Accountability ActNJ systems over 500 service connections | A cybersecurity program aligned to NIST CSF, CIS Controls or ISO 27000, incident reporting to NJCCIC, cybersecurity insurance, and an annual certification that NJDEP can audit. | A program built to the framework you choose, a reporting process, and the evidence for your certification. The WQAA checklist |
| New York State Department of Health, Appendix 5-ENY community water systems over 3,300 people | A cybersecurity program, a yearly vulnerability analysis, incident reports within 24 hours and vulnerability reports within 48 hours, with all of it in force by January 1, 2027. | A program and reporting process for New York. Much of the same work covers your New Jersey obligations. |
| New York DEC, 6 NYCRR Parts 616, 650 and 750NY wastewater operators, SPDES permittees and publicly owned treatment works | Incident reports within 24 hours and a second report within 30 days, operator training, and written access, asset, network and incident response controls by March 11, 2027, with annual certification. | Controls, an incident response plan and a reporting process for your plant, documented for your certification. |
| NJ MEL Deductible Reduction GroupsMembers of a municipal Joint Insurance Fund | Three levels of controls: Basic, Intermediate and Advanced Security. Meeting them cuts the deductible on a cyber claim by up to $80,000. | An assessment against each group, the gaps closed, and the documents your governing body adopts. The groups, explained |
| NIST SP 800-82, NIST CSF and CISA Performance GoalsAll critical infrastructure | Federal guidance and baseline practices such as asset inventory, changing default passwords and logging. | Non-intrusive assessments to SP 800-82, and controls mapped to the framework you choose. |
| CIPA, COPPA and FERPASchools and colleges | Internet safety and student privacy rules. | Training and compliance modules that take them into account. |
Source: New York State Department of Health, for Appendix 5-E. Source: New York State Department of Environmental Conservation, for wastewater. Source: MEL, 2026 Renewal Overview, for the Deductible Reduction Groups.
Every product ends in a compliance result. Which one depends on the type of compliance.
| Area of compliance | Products that get you there |
|---|---|
| Water systems | Culper-I: A current asset inventory, exposure findings and incident records for your SDWA, WQAA or NYSDOH program. QVULT: A certificate inventory and reporting your auditors can use, as evidence for your cybersecurity program. PIA: Regulatory reporting and work orders that record each step for your annual certification. Threat Intelligence: Sector threats and advisory triage that feed the risk assessment your rules ask for. |
| Wastewater systems | Culper-I: The asset, access, network and incident controls that New York’s wastewater rules ask for. QVULT: Authentication you can document, using NIST-approved algorithms, for New York’s access control rules. SOC: Network monitoring and logging, which New York requires of treatment works of 10 MGD or more. |
| Incident reporting | Culper-I: Incident details ready for NJCCIC or NYSDOH. PIA: Incident reports, approvals and follow-up tasks that route themselves, so nothing is dropped. SOC: 24/7 detection and response, with what happened and what we did, ready for your report to NJCCIC or NYSDOH. Threat Intelligence: Alerts that already carry context and a risk score, so a report starts from what is known. |
| Insurance | MSSP++: Help assessing and meeting the NJ MEL Deductible Reduction Groups and your insurer’s requirements. SOC: Monitoring, reporting and insurer-aligned training, the controls carriers ask about most. |
| Grants | PIA: Grant and vendor processes automated, with a log of every step. |
| Schools | MSSP++: Web filtering, activity monitoring and support for CIPA, COPPA and FERPA requirements. |
We work out which rules, reporting channels, insurance and grant programs apply to your systems.
An OT or digital risk assessment measures where you stand against each one.
The products above close what is missing, in an order your budget can fund.
Inventories, logs and reports build as the protection runs, ready for your next certification or audit.
It depends on what you run and where. Water and wastewater follow different rules, and New Jersey and New York differ. The map above is the starting point, and an assessment confirms it for your systems.
Usually. The inventory, risk assessment and incident procedures behind one rule are largely the evidence another asks for, so we build one program and map it to each.
With an assessment. Water and wastewater systems usually start with an OT risk assessment, and towns and agencies with a digital risk assessment.
Tell us what you run and where. One of our engineers will map the rules that apply and show you where you stand.
Prefer to talk now? 973-339-0090
© 2025 Digital Team Six, Inc. | Your Cyber. Our Passion.™ | Cybersecurity Solutions Specialized for Municipalities, K12, Education Sector and Non-profits.
