The US Environmental Protection Agency announced $11.75 million in grants to ten midsize and large drinking water systems to strengthen defenses against cyberattacks and improve resilience to extreme weather. The awards were made through the agency’s Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability program, which is open to utilities serving populations of 10,000 or more. According to the agency, the funding was awarded through a competitive process.
The selected projects span operational technology upgrades, source and storage reliability, and emergency power. Named examples include SCADA and pump control upgrades in Lake City, Florida; a new well facility in Bay City, Texas; dam infrastructure work at Denver Water in Colorado; and programmable logic controller replacements in San Diego, California. Several other awards will fund backup generators, storage tank replacement, and smart monitoring intended to lower exposure to drought, wildfire, and hurricanes, including projects in Orange City and Hemet, and at California-American Water Company’s Sacramento system.
This is the program’s second funding round in a little over a year. The EPA opened the program in August 2025 with roughly $9 million and accompanied that launch with a report outlining ten recommendations to help drinking water providers build system-wide resilience to natural hazards and cybersecurity threats. The new round continues that emphasis on practical, utility-focused risk reduction.
Since the program began, federal agencies have reported a sharper cyber threat environment for water infrastructure. In a joint advisory issued in August, the FBI and the EPA warned about attackers exploiting internet-facing programmable logic controllers at water facilities, with incidents confirmed across at least seven states. That alert followed reports of a coordinated set of intrusions impacting more than 30 water systems in Minnesota.
In parallel with these developments, a federal proposal has been introduced to strengthen water-sector cybersecurity oversight by expanding authority to set cybersecurity standards for drinking water systems. The measure is intended to clarify expectations for utilities and support consistent mitigation of known control-system risks.
Beyond grant funding, the agency pointed to complementary support available to utilities. This includes efforts to identify vulnerabilities at individual systems; free assessment and training resources offered through the Cyberwater program; and planning tools under the Strengthening Water Infrastructure for Tomorrow initiative to help utilities prepare for natural hazards.
