HomeSolutionsComplianceWater systems
Federal law, New Jersey and New York each set cybersecurity rules for drinking water systems. Here is what each one asks, when it is due, and how one program answers all of them.
Built for
The requirements that apply to drinking water systems, by level of government.
| Level of government | The rules you answer to |
|---|---|
| Federal | EPA cybersecurity for the water sector |
| New Jersey | Water Quality Accountability Act (WQAA) |
| New York | NYSDOH Appendix 5-E |
Who each rule covers, what it asks of you, and the dates that matter.
| Requirement | What it asks | When |
|---|---|---|
| Safe Drinking Water Act, Section 1433Community water systems serving more than 3,300 people | A Risk and Resilience Assessment that covers electronic, computer and other automated systems, and an Emergency Response Plan, each certified to EPA. | Every five years. Next: Emergency Response Plans for systems serving 3,301 to 49,999 people, by December 31, 2026. The Section 1433 guide |
| NJ Water Quality Accountability ActNJ public community water systems with more than 500 service connections | A written cybersecurity program consistent with NIST CSF, CIS Controls or ISO/IEC 27000 and submitted to the NJCCIC, prompt incident reporting to the NJCCIC, and a cybersecurity insurance policy. | In force since 2022, with a certification every year, signed by your responsible official and posted on your website. The WQAA checklist |
| NYSDOH Appendix 5-ENY community water systems serving more than 3,300 people | A cybersecurity program, a Cybersecurity Vulnerability Analysis reviewed every year, and an hour of training for operators every three years. Incidents are reported within 24 hours, and vulnerabilities within 48 hours. | Incident reporting and training apply now. The other requirements take effect on January 1, 2027. Systems serving more than 50,000 people also certify every five years. |
Sources: EPA, AWIA Section 2013; NJDEP, 2021 WQAA guidance; NYSDOH requirements table.
The same work answers each rule, so we build one program and map it to all of them.
| What you do | Section 1433 | NJ WQAA | NYSDOH Appendix 5-E |
|---|---|---|---|
| Assess your risk | Risk and Resilience Assessment | The risk assessment in your framework | Cybersecurity Vulnerability Analysis |
| Write the plan | Emergency Response Plan | Written cybersecurity program | Cybersecurity program |
| Report incidents | Procedures in your Emergency Response Plan | To the NJCCIC, promptly | To NYSDOH, within 24 hours |
| Show your proof | Certify to EPA every five years | Annual certification, posted on your website | Analysis submitted every five years |
The result: water and wastewater compliance, with the evidence to show for it.
Culper-I Early Warning System
A current asset inventory, exposure findings and incident records for your SDWA, WQAA or NYSDOH program.
See Culper-IQVULT PKI-as-a-Service
A certificate inventory and reporting your auditors can use, as evidence for your cybersecurity program.
See QVULTProcess Intelligence and Automation
Regulatory reporting and work orders that record each step for your annual certification.
See PIASector Threat Intelligence
Sector threats and advisory triage that feed the risk assessment your rules ask for.
See Threat IntelligenceWe confirm which rules apply from your population served, your service connections and your state.
An SDWA readiness review or an OT risk assessment shows where you stand against each one.
Culper-I and the products above close what is missing, in an order your budget can fund.
Your inventory, findings and incident records build as the protection runs, ready for your next certification.
Section 1433 and NYSDOH Appendix 5-E start above 3,300 people. New Jersey’s Water Quality Accountability Act starts at more than 500 service connections, so a smaller New Jersey system can still be covered.
As of October 2026, there is no new standalone EPA cybersecurity rule. The binding federal requirement is Section 1433 of the Safe Drinking Water Act, and EPA enforces it, with at least 100 enforcement actions between 2020 and 2024.
No. The inventory, risk assessment and incident procedures behind one rule are largely the evidence another asks for, so we build one program and map it to each.
No. Wastewater follows different rules, and New York’s Department of Environmental Conservation has its own. The map on our Compliance page lists them.
Tell us what you run and who you serve. One of our engineers will map the rules that apply and show you the gaps.
Prefer to talk now? 973-339-0090
© 2025 Digital Team Six, Inc. | Your Cyber. Our Passion.™ | Cybersecurity Solutions Specialized for Municipalities, K12, Education Sector and Non-profits.
