The US Environmental Protection Agency announced $11.75 million in grants to ten midsize and large drinking water systems to strengthen protections against cyber threats and improve resilience to extreme weather. The awards are funded through the agency’s Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability program, which is open to utilities serving 10,000 or more people. According to the agency, awards were made via a competitive process. The funding ties infrastructure upgrades to specific risks from hurricanes, wildfires, and drought across six states.
The ten projects span a range of operational and control system upgrades. They include SCADA and pump control improvements in Lake City, Florida; a new well facility in Bay City, Texas; dam infrastructure work at Denver Water in Colorado; and programmable logic controller (PLC) replacement in San Diego, California. These efforts focus on hardening critical assets and modernizing automation to reduce exposure to cyber compromises and service disruptions.
Additional awards support standby power, storage, and monitoring enhancements designed to maintain service during emergencies. These include generators, storage tank replacement, and smart monitoring equipment for projects in Orange City and Hemet, as well as upgrades at California-American Water Company’s Sacramento system. Collectively, the funded activities aim to sustain water delivery and treatment performance under severe weather conditions while reducing cyber risk to operational technology.
This is the program’s second funding round in a little over a year. The EPA launched the initiative with approximately $9 million in August 2025 and released a report outlining ten recommendations to build sector-wide resilience. The new round builds on that framework by targeting both digital and physical vulnerabilities that can impact continuity of service at larger community systems.
The threat landscape facing water utilities has intensified over the past year. The FBI and EPA issued a joint warning in August about attackers exploiting internet-facing PLCs, with incidents confirmed across at least seven states. The alert followed a wave of intrusions affecting more than 30 Minnesota water systems, underscoring the need for upgraded controls, segmentation, and incident response planning in the sector.
In addition to grant funding, the EPA points to ongoing work identifying vulnerabilities at individual utilities and to free assessment and training resources offered through the Cyberwater program. The agency also highlights the Strengthening Water Infrastructure for Tomorrow (SWIFT) initiative to support natural hazard planning. A separate water cybersecurity bill has been introduced that would expand the EPA’s authority to set sector-wide cybersecurity standards, reflecting broader efforts to address systemic risk across drinking water utilities.
