New York water and wastewater cybersecurity assessments

Start with the system and its responsible authority

A drinking-water supplier and a wastewater permittee can share networks while having different regulatory duties. A public water authority, municipal treatment works and an investor-owned water utility also need different applicability decisions. GDF helps teams organize technical scope and evidence; the accountable operator, compliance team and counsel determine the controlling requirements.

Start with system type, population or design flow, ownership, permits, critical process functions and the people authorized to approve access. Keep the actual plant diagrams and vulnerability detail in your approved repository. The public planner only asks for preparation status.

Drinking water assessment preparation

Build a preparation record for the actual drinking-water system and its operating constraints. Determine the relevant DOH system tier and current instructions before selecting a deadline or signing a statement. Keep sensitive engineering and vulnerability records in the operator's approved repository.

DOH publishes drinking-water-specific guidance, a requirements table and templates. Those instructions are distinct from DEC wastewater requirements and PSC utility IT rules. Confirm the system category, covered population and current dates directly with DOH.

• System category and responsible role: Record system classification, population, ownership and the designated decision maker.
• Treatment and supply dependencies: Prepare a restricted map of treatment, pumping, storage, communications and supporting IT.
• Vulnerability analysis inputs: Gather the existing analysis, approved scope, asset inventory and unresolved findings.
• Remote access and service accounts: List authorized support paths, vendors, remote-access approvals and account owners.

Wastewater assessment preparation

Separate permit-wide incident reporting, POTW control requirements and individual operator training. Keep the facility, design flow, permit and responsible municipal authority attached to the preparation record. The operator retains process and safety authority.

DEC identifies reporting provisions effective March 26, 2026; ERP/control provisions effective March 11, 2027; and first annual certifications due March 28, 2027. Some training provisions begin with certifications expiring from January 1, 2027. Scope and current instructions still need entity-specific review.

• Permit and facility scope: Record the SPDES permit, POTW status, design flow and legally responsible party.
• Reporting and escalation route: Gather the incident triage route, authorized contacts and current reporting instructions.
• ERP and cybersecurity IRP: Locate the emergency response and cyber incident plans and their controlled copies.
• Access and vendor-control records: Gather account inventories, remote-support methods, approvals and termination records.

Review evidence before interacting with live controls

An engagement can begin with inventory reconciliation, architecture records, remote-access permissions, incident plans and recovery evidence. Passive observations are considered before active methods. The operator approves targets, methods, windows, stop conditions and recovery authority. A scan alone does not establish process safety, resilience or compliance.

The resulting technical handoff can include a scoped asset record, evidence index, limitations, findings, corrective owners and a verification plan. Missing logs and documents remain explicit gaps. No automatic compliance result or promise of uninterrupted operation is made.

Connect preparation to technical services

OT, ICS and SCADA security · Network segmentation validation · OT incident response · All New York preparation resources

Official New York sources

• NYS DOH Cybersecurity for Public Water Systems (opens a new tab)
• NYS DOH Drinking Water Cybersecurity Requirements Table (opens a new tab)
• NYS DEC Wastewater Cybersecurity Resources (opens a new tab)

DOH and DEC guidance covers distinct systems, tiers and dates. Obtain the current complete DOH instructions for the system before choosing dates or signing a statement. The worksheets help organize a review and are not a complete regulatory checklist.