Regulators to Urge Congress for Water Cyber Panel
State utility regulators plan a resolution at their November annual meeting seeking an EPA-overseen water cybersecurity body.
Updated on Nov. 6, 2026 in Utilities
State utility regulators plan to call on Congress to create a Water Risk and Resilience Organization under EPA oversight. A draft resolution is scheduled for approval at the National Association of Regulatory Utility Commissioners' annual meeting on November 8-11.
Why it matters
The draft resolution would set minimum cybersecurity requirements for water systems and expand EPA cybersecurity authority over them. Many water utilities are struggling to meet cybersecurity needs, and the Iran war has raised the stakes for the sector.
The annual meeting runs November 8-11, 2026, with the draft resolution scheduled for approval during that window. The extraction does not provide dollar figures, utility counts, or other quantitative measures for the proposal.
The players
National Association of Regulatory Utility Commissioners (NARUC)
NARUC is a national association of state public utility commissions that coordinates policy positions on utility regulation across the states.
U.S. Environmental Protection Agency (EPA)
The EPA is the federal agency responsible for administering the Safe Drinking Water Act and overseeing public water system regulation.
The details
The draft resolution calls on Congress to create a Water Risk and Resilience Organization that would function as a rule-setting body under EPA oversight. It would set minimum cybersecurity requirements for water systems and expand the EPA's cybersecurity authority over them.
Timeline
The NARUC annual meeting runs November 8-11, 2026, when the draft resolution is scheduled for approval.
Industry Landscape
The proposal would extend EPA oversight under the Safe Drinking Water Act into cybersecurity, a domain the extraction does not describe as currently regulated by that framework. It places state regulators in the position of asking Congress to build a new federal rule-setting body for water utilities.
If adopted and acted on, the proposal would introduce minimum cybersecurity requirements for water systems that customers rely on for safe drinking water. The extraction does not specify timing or cost effects for ratepayers.
The takeaway
Water systems face growing cybersecurity demands, and state regulators are seeking a federal framework to address them. Readers should watch whether Congress takes up the proposal after the November meeting.
What happens next
The draft resolution is scheduled for approval at the NARUC annual meeting on November 8-11, 2026.
Further reading
For more on how utilities are handling risk, explore Utilities coverage.
