Digital Team Six 973-339-0090 Request an assessment

HomeSolutionsComplianceCyber insurance

Cyber insurance compliance for water systems and towns

Meet what your insurer or joint insurance fund asks for, lower your deductible, and keep the evidence for your next renewal.

Request a digital risk assessment

Built for

  • Municipalities and counties
  • Water and wastewater systems
  • Departments of public works
  • Joint Insurance Fund members
The three MEL Deductible Reduction Groups are met in turn, and the deductible on a cyber claim drops from $35,000 to $20,000 to $0.

The rules you answer to.

The insurance programs and guidance that apply, by level of government.

Level of governmentThe rules you answer to
FederalEPA cyber insurance guidance
New JerseyNJ MEL Cyber JIF
New YorkNo statewide program listed. Your carrier sets the requirements.

What each one asks.

Coverage decisions rest with your carrier or joint insurance fund. Here is what they, and the law, expect.

RequirementWho it coversWhat it asks
NJ Water Quality Accountability ActA state lawNJ public community water systems with more than 500 service connectionsA cybersecurity insurance policy, required since February 6, 2022.
NJ MEL Cyber JIFA joint insurance fundMembers of the Municipal Excess Liability Joint Insurance FundThree Deductible Reduction Groups. Members who meet a group’s controls can lower the deductible on a cyber claim.
EPA cyber insurance guidanceGuidance, not a ruleDrinking water and wastewater systemsRead your policy. If cyber coverage is not explicitly included, it is excluded, and ransomware may need separate coverage.

Sources: NJDEP, 2021 WQAA guidance; MEL 2026 Renewal Overview; EPA cyber insurance factsheet, Oct 2024.

The MEL Deductible Reduction Groups.

As of January 1, 2026, every MEL member is covered, and the per-claim deductible is $50,000 plus 20% coinsurance of the next $150,000, up to $80,000 out of pocket. Meeting a group’s controls reduces it.

GroupDeductible reduced toSavings
Basic Security$35,000Up to $45,000
Intermediate Security$20,000Up to $60,000
Advanced Security$0Up to $80,000

Sources: MEL 2026 Renewal Overview. The Cyber JIF has said it will post an updated framework, so confirm the current controls with your JIF before your governing body adopts them.

See what each group asks for

What an underwriter will ask.

EPA says the application can be lengthy, because insurers want to understand your operations and your security. Expect questions on:

  • Security controls, for both operational technology and information technology
  • Your water rate revenue and service area
  • How much personal or sensitive data you hold
  • Your claims history
  • Who manages cybersecurity at your organization
  • Your third-party vendors
  • Patch management and disaster recovery

In a small utility, a superintendent and an IT or OT contractor might handle the application. In a large one, expect a risk manager, CFO, CISO or CIO, and general counsel. Sources: EPA cyber insurance factsheet, Oct 2024.

The products that get you there.

The result: insurance compliance, built around what your carrier or joint insurance fund asks for.

MSSP++

Managed Security Services Provider

Help assessing and meeting the NJ MEL Deductible Reduction Groups and your insurer’s requirements.

See MSSP++

SOC

Security Operations Center

Monitoring, reporting and insurer-aligned training, the controls carriers ask about most.

See SOC

How we get you there.

  1. Assess

    We check you against each group and your insurer’s questions, control by control.

  2. Close the gaps

    MSSP++ closes them, starting with Basic Security and working up.

  3. Adopt

    We document the standards so your governing body can adopt them by resolution.

  4. Keep the evidence

    Backup logs, training records and access reviews, ready for your fund or carrier at renewal.

Questions about cyber insurance.

New Jersey public community water systems with more than 500 service connections do, under the Water Quality Accountability Act. As of January 1, 2026, every MEL member is covered through the fund. Elsewhere it is your choice, and EPA says it can play an important role in managing cyber risk.

Probably not in full. EPA says standard general liability policies typically have limited coverage for cyber incidents, and that if cyber coverage is not explicitly included in your policy language, it is excluded.

For MEL members, up to $80,000 on a claim: Advanced Security reduces the deductible to $0. EPA says premiums depend on your controls, risk profile, claims history, coverages, limits and deductible, among other factors.

Yes. EPA says insurance should be only a small part of your overall cybersecurity plan, and insurers ask about your controls before they cover you.

EPA says to contact your insurer immediately, because they may have a preferred list of vendors. Keep their number in your incident response plan, and check your reporting deadlines on our Incident reporting page.

Find out which group you meet today.

A digital risk assessment measures you against each Deductible Reduction Group and your insurer’s questions, then shows you what to close first.

Request a digital risk assessment

Prefer to talk now? 973-339-0090