GAO: Cybersecurity Risks to U.S. Water and Wastewater Systems, EPA Urgently Needs a Strategy

A cyberattack on U.S. drinking and wastewater systems could, for example, produce drinking water with unsafe levels of bacteria or chemicals. Nations, cybercriminals, and others have targeted some of the nearly 170,000 U.S. water systems, which are increasingly automated. The Environmental Protection Agency (EPA) leads water cybersecurity efforts. It has worked with the water sector to improve cybersecurity. However, EPA hasn't identified and prioritized the greatest risks sector-wide. It also relies on water systems to voluntarily agree to improve cybersecurity. We recommended that EPA develop a national cybersecurity strategy, assess whether it needs more authority, and more.