EPA Water Cybersecurity Grants Fall Short of Utility Needs

What EPA announced

The U.S. Environmental Protection Agency has awarded $11.75 million to help midsize and large drinking water systems defend against cyberattacks and build resilience to extreme weather.1 The money flows through the Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability grant program and will fund ten projects.1 Jess Kramer, EPA's Assistant Administrator for Water, cited cyberattacks, wildfires, and flooding as significant risks to water system operations. She described the grants as "just one part of the equation," alongside the agency's technical assistance and its work with other federal agencies and states.1

That qualifier matters. Spread evenly, the award averages about $1.2 million per project. That money must also cover two very different categories of threat, digital intrusion and physical climate hazards. The announcement is a useful signal of federal priorities. On its own terms, though, it is a small intervention in a sector facing escalating pressure.

The threat picture has sharpened

The grants arrive after a string of incidents showing how exposed U.S. water infrastructure is. Commentary in CyberScoop points to Iranian hackers who hit water systems in 12 states over the summer. It argues that the episode exposed the sector's weakness against foreign adversaries.4 The same piece cites the U.S. intelligence community's 2026 Annual Threat Assessment. That assessment names cyber actors from China, Russia, Iran, and North Korea, along with ransomware groups, as critical threats to U.S. networks and infrastructure.4

The problem has also hit close to home for lawmakers. Senators Amy Klobuchar and Adam Schiff said coordinated attacks recently targeted more than 30 community water systems in Minnesota. They framed the incidents as evidence of how vulnerable local infrastructure is, and of the potential for drinking water contamination.3

Why utilities struggle to respond

Route Fifty's reporting explains why many utilities can't simply buy their way to better security. Cybersecurity spending competes with rising construction costs, mounting regulatory and environmental demands, and aging infrastructure.2 The outlet also notes that EPA has raised concerns that many utilities do not meet existing federal requirements.2 That suggests the gap is not only about advanced threats. Many systems also lack basic compliance.

The federal response so far has leaned on guidance and coordination more than money. EPA issued recommendations last summer. It also endorsed cybersecurity recommendations from its Water Sector Cybersecurity Taskforce in 2025.2 EPA, the National Security Council, and the Cybersecurity and Infrastructure Security Agency have urged states to develop action plans and address vulnerabilities.2 Some states are acting through administrative rules, legislation, technical assistance, and funding programs. The result is a patchwork that varies by jurisdiction.2

Congress weighs a bigger lift

Legislators are looking at more structural fixes. Route Fifty reports that Congress has introduced legislation to support cybersecurity resilience investments for midsize and large drinking water systems.2 Separately, the Klobuchar–Schiff Water Cyber Shield Act would expand EPA's oversight powers. It would authorize the agency to conduct cybersecurity assessments and require corrective action when significant problems are found. It would also provide funding to local drinking water and wastewater utilities.3 Klobuchar framed the bill as a way to strengthen defenses without passing costs on to ratepayers.3 That reflects the affordability concern Route Fifty describes.2

The two approaches differ in emphasis. EPA's announcement presents grants plus technical assistance as part of a broader effort.1 The Senate bill pairs money with enforcement authority, suggesting its sponsors see voluntary measures as insufficient.3 CyberScoop goes further, arguing the country still lacks a real plan to defend water systems.4

Reading the moment

Taken together, the picture is of a federal government that has clearly identified the risk but is funding the response in small increments. Ten grants to midsize and large systems will likely produce useful projects, and possibly practices others can copy. That fits Kramer's stated goal of advancing best practices across the sector.1 But the program covers a narrow slice of a highly fragmented sector. By design, it leaves out smaller systems that may be least equipped to defend themselves.

The gap between the threat and the funding is wide. Nation-state actors are probing utilities across a dozen states, and coordinated attacks have struck dozens of systems in a single state.34 Meanwhile, many utilities fall short of existing requirements.2 Grants of this size can show what is possible, but they cannot close that gap.

The more consequential question is whether Congress moves on legislation that pairs sustained funding with enforceable standards. Until then, the defense of the nation's water supply will rest largely on cash-strapped local utilities and an uneven set of state efforts.