Strengthening Cybersecurity for Rural Water Systems
About the National Rural Water Cybersecurity Center
Cybersecurity threats have become a significant concern for Water infrastructure in the United States. The Director of National Intelligence’s 2025 Annual Threat Assessment stated that “U.S. water infrastructure has become a more common target” for domestic and international adversaries.
The National Rural Water Cybersecurity Center assists systems in preparing for, preventing, and responding to cybersecurity threats. The center serves as the hub for cybersecurity information, services, and products, including partnerships and initiatives specifically designed to support small water systems.
Tools & Resources
Rural Water’s Ripple Effect: National Security, Cyber Threats, and the Future of Water
America’s rural water systems are under siege — from foreign cyber adversaries and from within. This policy paper reveals how a “five-front battle” of workforce challenges (such as aging staff, low pay, and shrinking talent pools) is converging with escalating attacks from China, Russia, and Iran to create dangerous national security vulnerabilities.
With 57% of rural water workers nearing retirement and over 400 military bases dependent on these systems, the stakes couldn’t be higher. Five targeted federal recommendations offer a pragmatic path forward. The window for action is closing — read the full paper to understand why rural water security is everyone’s concern.
Water Watch Center
The National Rural Water Association has partnered with DEF CON Franklin to launch the Water Watch Center (WWC) in August 2026.The WWC provides direct support to small water utilities to mitigate attacks by adversaries, such as the recently alleged Iranian cyberattacks on water infrastructure. The WWC strengthens utilities’ cyber defenses, detects attacks, and mitigates breaches to ensure that clean water flows reliably from American faucets every day. Five managed detection and response providers have joined forces with DEF CON Franklin and NRWA to deliver cyber services directly to small water utilities serving fewer than 10,000 people, which make up 91% of the approximately 50,000 community water systems in the country. These providers, including Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies, exchange threat information and patches through a dedicated collaboration mechanism and share that information with NRWA, which serves as the national hub.
Cyber Updates and Advisories
Click the link below to review the later cyber advisories and updates from our partners, including WaterISAC and CISA.
Free WaterISAC Membership for Eligible Members
SANS Training Modules
As a part of NRWA’s collaboration with the SANS Institute, SANS is providing NRWA members with five training modules for systems to complete. Click the links below to watch the modules, anytime, anywhere, for free.
| Module 1: ICS Incident Response Plan | Watch Now |
| Module 2: Defensible ICS Network Architecture | Watch Now |
| Module 3: ICS Network and Visibility Monitoring | Watch Now |
| Module 4: ICS Secure Remote Access | Watch Now |
| Module 5: Risk-Based ICS Vulnerability Management | Watch Now |
Additionally, SANS is offering $100 off the ICS310 course to all NRWA members.
The ICS310: ICS Cybersecurity Foundations course delivers essential knowledge for professionals seeking to understand and secure Industrial Control Systems (ICS) and Operational Technology (OT) environments. Participants will:
- Master the Five ICS Cybersecurity Critical Controls to protect water and utility systems
- Analyze real-world case studies that highlight sector-specific threats
- Explore key frameworks including NIST 800-82, IEC 62443, and NERC CIP
This self-paced, beginner-level course provides 6 CPEs and hands-on labs led by SANS Fellows Tim Conway, Robert M. Lee, and Jeffrey Shearer.NRWA Member Offer: Save $100 when you register using code ICS310PARTNER25.
Recursos
| WaterISAC’s Cybersecurity Fundamentals for Water and Wastewater Utilities: Small Water Systems Guidance Compendium | Más información |
| EPA Cybersecurity Procurement Evaluation Checklist for Drinking Water and Wastewater Systems | Más información |
| EPA’s Incident Action Checklists for Water Utilities | Más información |
| EPA’s Cybersecurity Planning for Water | Más información |
| Protecting Critical Water Systems with the Five ICS Cybersecurity Critical Controls l SANS | Más información |
| Ley de Infraestructuras Hídricas de Estados Unidos (AWIA) | Más información |
| Evaluación de la vulnerabilidad | Más información |
NRWA Cyber Initiatives & Partnerships
NRWA and WaterISAC
In February 2024, the National Rural Water Association (NRWA) and the Water Information Sharing and Analysis Center (WaterISAC) announced a formal collaboration to strengthen the security and resilience of rural water and wastewater systems. Through this partnership, WaterISAC and NRWA are working together to help utilities across the country prepare for and respond to a wide range of risks—including cyber and physical threats, natural disasters, and other operational challenges.
As part of this partnership, systems serving populations of 10,000 or fewer are eligible for a free WaterISAC membership.
Eligible NRWA members receive WaterISAC’s Security and Resilience Update (SRU)—a weekly newsletter providing the water sector’s most comprehensive information on cyber and physical threats, natural hazards, and resilience best practices. Members also gain access to WaterISAC’s monthly Threat Briefing webinars, its extensive Resource Center, and discounted registration for WaterISAC’s H2OSecCon conferences.
NRWA and DEFCON Franklin
DEF CON Franklin is a partnership between NRWA, the Cyber Policy Initiative at the University of Chicago, and DEF CON (the world’s largest and longest-running community of technologists). Franklin offers a completely free cyber volunteer task force to water systems across our nation. Water systems are matched with volunteers based on the specific needs found in each district or governing body. Volunteers will help systems harden their OT and IT infrastructure against outside attacks. The assistance is provided completely free of charge, and volunteers will help the systems as long as needed. Currently, Franklin operates across four states. If you are interested in receiving free cyber assistance from experts, please contact paulc13@uchicago.edu.
NRWA and SANS
NRWA and the SANS Institute have partnered together to provide tools and resources to small and rural public water systems concerning cybersecurity.
Launched in 1989 as a cooperative for information security thought leadership, it is SANS’ ongoing mission to empower cybersecurity professionals with the practical skills and knowledge they need to make our world a safer place.
Through the SANS Water / Wastewater Utilities Partnership and the Aggregate Buy program, Public Water Utilities can get the training they need, at an affordable cost, to improve their institution’s security posture. Special discounts are available throughout the year, with the lowest pricing available during SANS’ special Aggregate Purchase Program windows.
NRWA and Microsoft
Microsoft has sponsored the Center on Cyber and Technology Innovation and the Cyber Readiness Institute (CRI) to launch a pilot initiative called the “Phased Critical Infrastructure Pilot: Resiliency for Water Utilities.” This initiative aims to provide small water and wastewater utilities with basic cybersecurity training and promote a culture of cyber readiness. The pilot is based on the CRI’s Cyber Readiness Program, which offers CRI Certified Cyber Coach-supported training and resources designed to enhance cybersecurity risk management and improve the ability to respond to and recover from cybersecurity incidents. The pilot is for water and wastewater utilities serving between 500 and 10,000 customers.
NRWA and Dragos, Inc.
Dragos Inc. is a leading industrial cybersecurity company that specializes in operational technology (OT) security, providing advanced threat detection, asset visibility, and incident response for industrial control systems. Dragos offers two free programs designed to help small utilities with limited budgets or staff secure their operational technology from adversaries seeking to exploit resource challenges by targeting basic cyber hygiene needs. The Community Defense Program (CDP) provides any US or Canadian water, electric, or natural gas utility with under $100M in annual revenue with free access to the Dragos Platform for asset visibility, threat detection, and vulnerability management. Every CDP membership also includes Dragos OT-CERT, a free industrial control system/operational technology community that any water operator can join today. OT-CERT offers how-to guides, training, demonstration videos, tabletop exercises, and members-only working sessions to help utilities build cybersecurity programs at their own pace.
Last reviewed September, 2026