HomeSolutionsComplianceIncident reporting
When something happens, the clock starts. Know who to tell, how fast, and what they will ask for, before you need it.
Built for
The reporting channels and response networks that apply, by level of government.
| Level of government | The rules you answer to |
|---|---|
| Federal | National Incident Management System (NIMS)Water and Wastewater Agency Response Networks (WARN) |
| New Jersey | NJCCIC incident report |
| New York | NYSDOH incident reporting |
More than one of these can apply to you at once, so check each one.
| Who you are | Report to | How fast | How |
|---|---|---|---|
| New Jersey water systemPublic community systems with more than 500 service connections | The NJCCIC | Promptly, under the Water Quality Accountability Act | 1-833-4-NJCCIC, njccic@cyber.nj.gov or the online report |
| New Jersey public agency or government contractorAgencies of the state or any political subdivision, and contractors with access to their systems | The NJ Office of Homeland Security and Preparedness, through the NJCCIC | Within 72 hours of reasonably believing an incident occurred | The same NJCCIC contacts |
| New York water systemCommunity systems serving more than 3,300 people | NYSDOH | Incidents within 24 hours of identifying them, and vulnerabilities within 48 hours | The online incident report. For vulnerabilities, TPP@health.ny.gov |
| New York wastewater permit holderAll SPDES permittees | The NY Department of Environmental Conservation | Within 24 hours of becoming aware, with a second report within 30 days | The online report, then a call to your Regional Water Engineer or Manager. DEC Dispatch: 1-844-332-3267 |
| Any water or wastewater systemFederal partners, voluntary today | The FBI, CISA and EPA | As soon as you can | Your local FBI field office or ic3.gov. CISA: 1-844-SAY-CISA or contact@cisa.dhs.gov. EPA: watercyberta@epa.gov |
| Anyone with cyber coverageYour carrier or joint insurance fund | Your insurer | Immediately | Keep the number in your incident response plan. Your insurer may have preferred vendors. |
Sources: NJDEP, 2021 WQAA guidance; NJ P.L. 2023, c. 19; NYSDOH requirements table; NY DEC wastewater resources; FBI and EPA alert, July 30, 2026; CISA, FBI and EPA response guide, Jan 2024; EPA cyber insurance factsheet, Oct 2024; HIPAA Journal on CIRCIA, Oct 5, 2026. Check each agency’s current form before you rely on it.
Every call goes faster with these in hand.
Sources: FBI and EPA alert, July 30, 2026; CISA, FBI and EPA response guide, Jan 2024.
Water and Wastewater Agency Response Networks
Utilities helping other utilities respond and recover, through mutual aid. Join yours before you need it.
EPA on mutual aidNational Incident Management System
A shared structure for managing an incident across agencies, so your team and your responders work the same way.
FEMA on NIMSEvery state has one
Fusion centers track cyber incidents, and some states offer more response resources for utilities that cannot secure outside support.
The federal response guideThe result: incident reporting requirements met, with what happened and what we did ready for your report.
Process Intelligence and Automation
Incident reports, approvals and follow-up tasks that route themselves, so nothing is dropped.
See PIASecurity Operations Center
24/7 detection and response, with what happened and what we did, ready for your report to NJCCIC or NYSDOH.
See SOCSector Threat Intelligence
Alerts that already carry context and a risk score, so a report starts from what is known.
See Threat IntelligenceOur US-based analysts confirm what an alert means, around the clock.
We contain it and call your team, by phone within the hour for high-severity alerts.
You file, and we hand you what happened and what we did, ready for your report.
We support the root cause analysis and what comes after, such as the second report New York’s wastewater rules ask for.
It depends on the rule. New York’s water and wastewater rules set 24 hours. New Jersey’s law for public agencies and government contractors sets 72 hours, and its water system rule says promptly. More than one can apply.
It depends on the rule. New York’s Department of Environmental Conservation says unauthorized access discovered in an operational technology network must be reported even if no harm has occurred. NYSDOH asks for incidents that may affect your ability to comply or may pose a risk to public health. Build each test into your plan.
In New Jersey, notifications under the 72-hour law are confidential and not subject to the Open Public Records Act.
Not yet. Federal reports to the FBI, CISA and EPA are voluntary today. A federal law, CIRCIA, will change that: its final rule went to the White House for review in October 2026 and is not yet in force. As proposed, it asks for incident reports within 72 hours and ransom payment reports within 24 hours.
Decide before you need to. Name a person and a backup in your plan, along with what they report and to whom, so nobody works it out at 2 AM.
An assessment checks your reporting process against the rules that apply, and shows you what to fix before you need it.
Prefer to talk now? 973-339-0090
© 2025 Digital Team Six, Inc. | Your Cyber. Our Passion.™ | Cybersecurity Solutions Specialized for Municipalities, K12, Education Sector and Non-profits.
