DDW-2024-010353

System CybersecurityPlan
Utah Department of Environmental
Quality
P R E P A R E D B Y Utah Division of Drinking Water
Utah Division of Water Quality
Public drinking water and wastewater systems in the United States,regardless of their size,are at
risk of cyberaacks with malicious intent.Unfortunately,these aacks are becoming more common,
with aackers aempting various pathways to gain unauthorized access to critical data files,
records,and operator technology control functions.
Cyberaacks on public drinking water and wastewater systems can have far-reaching
consequences beyond disrupting essential services.They can pose significant public health risks,
be extremely costly and impact various aspects of a community's well-being.To address these risks,
the Utah Department of Environmental Quality DEQhas developed a plan to assist public water
systems in preventing and responding to cyberaacks eectively.
Security of Public Drinking Water andWastewaterSystems
Security and emergency response is crucial for managing public drinking water and wastewater
systems.The Utah Department of Environmental Quality’s goal is to ensure all public drinking water
and wastewater systems thoroughly review their current cybersecurity procedures to find any major
vulnerabilities,implement strategies and controls to decrease cybersecurity risks where necessary,
and routinely practice plans to prepare and respond to cyberaacks.
The Division of Drinking Water and Division of Water Quality are partnering with the U.S.Department
of Homeland Security's Cybersecurity Infrastructure Security Agency CISA,and the Environmental
Protection Agency EPAto support public water and wastewater systems to improve cybersecurity
resilience.
Through collaborative eorts with public drinking water and wastewater systems and our partners,
we will enhance Utah's cybersecurity framework by facilitating essential information sharing with
public drinking water and wastewater systems.Our goal is to promote statewide preparedness and
provide support for preventing,responding to and recovering from all cyber incidents that may arise,
thus safeguarding our public drinking water and wastewater infrastructure against cyber threats for
the well-being and safety of Utah residents.
Cybersecurity Assessment
Every public drinking water and wastewater system,whether using simple or complex technology,
faces the risk of a cyberaack.To address this threat,DEQ,with support of our partners,the Division
of Technology Services DTS,CISA,and EPA,will regularly send updated information to high-risk
System CybersecurityPlan•UTAHDEPARTMENT OF ENVIRONMENTAL QUALITY 2 of 5
public drinking water and wastewater systems and maintain valuable resources and information
detailing how all public drinking water and wastewater systems can access support for conducting
cybersecurity assessments.These resources will oer guidance on identifying and addressing
cybersecurity vulnerabilities within public drinking water and wastewater systems,ensuring they are
equipped to mitigate risks and strengthen their defenses against potential cyber threats.
Utah's public drinking water and wastewater systems demonstrate varying degrees of technological
complexity,cybersecurity vulnerabilities,and protective measures.Understanding these nuances is
essential for eectively supporting these systems.To deliver the best possible assistance to public
drinking water and wastewater systems,the Division of Drinking Water and Division of Water Quality
will develop a specialized self-guided questionnaire tailored for public drinking water and
wastewater systems.This questionnaire will be designed to gather crucial data regarding
cybersecurity risk levels,with a particular emphasis on technological and operational controls such
as SCADA (Supervisory Control and Data Acquisition)systems.By gaining insights into the distinct
cybersecurity landscapes of each system,DEQ can customize support and response eorts to
strengthen cybersecurity resilience throughout Utah's public water and wastewater infrastructure.
Furthermore,the Division of Drinking Water will oer technical support to public water systems
during sanitary survey inspections to assist operators in identifying vulnerabilities and evaluate
adherence to cybersecurity best practices.The America’s Water Infrastructure Act AWIASection
2013 requires all community public drinking water systems serving more than 3,300 people to
integrate cybersecurity into their risk and resilience assessments.The EPA oers complimentary
resources to assist public drinking water systems in meeting this requirement.As part of sanitary
survey inspections,the Division of Drinking Water will emphasize the importance of regularly
updating emergency response plans and exercising cybersecurity assessments and response
plans.
The Division of Water Quality will review facility emergency response plans to cybersecurity aacks
during Compliance Evaluation Inspections.The Division of Water Quality recommends that
wastewater service providers report all cyberaacks to the Division of Water Quality.
By proactively promoting cybersecurity awareness and providing accessible support resources,DEQ
aims to enhance the overall cybersecurity posture of public drinking water and wastewater systems
across Utah.This proactive approach empowers water systems to safeguard their critical
infrastructure and ensure the delivery of safe and reliable drinking water to communities.
System Cybersecurity Plan•UTAHDEPARTMENT OF ENVIRONMENTAL QUALITY 3 of 5
Cyber Incident Response
Cyberaacks are considered a public water and wastewater system emergency incident.Utah’s
public water systems have experienced various cyber incidents,such as unauthorized access and
ransomware aacks.Understanding the magnitude or extent of a cyberaack can be challenging
for a water system.Swift and eective response to any cyberaack is crucial for minimizing potential
damage to water systems.
Upon suspecting a cyberaack,it is imperative for a public drinking water or wastewater system to
promptly initiate incident response measures.Persistent compromises or failures within water or
wastewater system technology could have cascading impacts across critical infrastructure.
Responding immediately and eectively to a cyberaack is essential for minimizing potential
damage to water and wastewater systems.
Per Utah Administrative Code UACR30910518,public drinking water systems need to contact
the Division of Drinking Water within eight hours if an emergency situation exists.
R30910518(e)defines a threat or evidence of vandalism or sabotage that may aect the quality of
delivered water as an emergency incident.By contacting the Division of Drinking Water as soon as a
cyberaack is suspected or confirmed,our team will assist the water system with contacting State
and Federal cybersecurity experts to immediately provide support.
Utah Pollutant Discharge Elimination System UPDESpermit holders (wastewater service
provider)are required under UAC R31784 to report any noncompliance that may endanger
health or the environment.UAC R317801 requires sanitary sewer collection system owners
(wastewater service provider)to report sanitary sewer overflows in accordance with the
requirements of R3178014.If the wastewater service provider has prior knowledge of a potential
non-compliance event,such as one caused by cybersecurity aacks,the entity must report
anticipated noncompliance to the Division of Water Quality in accordance with the requirements of
their permit.By contacting the Division of Water Quality immediately when a cyberaack is
suspected or confirmed,the team will assist the wastewater service provider with contacting state
and federal cybersecurity experts to immediately provide support.
Our objective is to assist all public drinking water and wastewater systems in immediate
response,investigation,and isolation of cyberaacks by connecting them with top state and
federal cybersecurity experts and providing technical support during the incident.
System CybersecurityPlan•UTAH DEPARTMENT OF ENVIRONMENTAL QUALITY 4 of 5
Contacts
Department of Environmental Quality DEQ
Report an Incident 24/7 response line
8015364123
hps://deq.utah.gov/general/report-an-incident
The Division of Technology Services DTS
[e-mail]
24/7 response line 8015383011
Division of Drinking Water DDW
24/7 Emergency response line
8015608456
Rural Water Association of Utah RWAU
[e-mail]
Cybersecurity &Infrastructure Security
Agency CISA
24/7 [e-mail]
8882820870
Resources
EPA EPA Cybersecurity for the Water Sector,which includes the EPA Water Cybersecurity
Assessment Tool WCATXLSX.CISA Cyber Resilience Review CRRand CPG Checklist PDFCISA Cyber Resource Hub
CISA Top Cyber Actions for Securing Water Systems
NIST Cybersecurity FrameworkAWWACybersecurityandGuidance,including small system guidance.DEQ Cybersecurity and Incident Response Resources
Kim Shelley,Executive DirectorUtahDepartmentofEnvironmental Quality
System Cybersecurity Plan•UTAHDEPARTMENT OF ENVIRONMENTAL QUALITY 5 of 5