Recent cyberattacks targeting water systems in multiple U.S. states have raised understandable questions about the security of the nation's drinking water infrastructure. While some utilities experienced operational disruptions, officials have reported no impacts to drinking water quality or public health. Water systems continued operating safely, and no contamination has been reported.

Still, the incidents are a reminder that water systems – like all critical infrastructure – are targets for both foreign and domestic hackers who seek to instill fear or collect money. Water utilities must prepare for many types of risks, including both physical and digital threats. For decades, utilities focused mostly on hardening physical infrastructure to help facilities protect themselves and their equipment. Today, utilities also invest in cybersecurity tools, employee training and operational safeguards designed to keep water service safe and reliable.

Recognizing the importance of cybersecurity, the Water Infrastructure Act of 2018 requires drinking water utilities serving more than 3,300 people to evaluate risks and vulnerabilities, including cyber threats, and develop plans to strengthen resilience and response capabilities. The recent attacks, however, underscore that utilities must be ever-vigilant, and that threats are always evolving.

Water utilities get some help from federal, state and local partners to identify risks, strengthen defenses and respond quickly to potential threats. In fact, just days prior to the recent attacks, federal agencies warned that water and wastewater systems are being targeted by attackers seeking to disrupt critical infrastructure. But it’s clear that more help will be needed in the years ahead, both in terms of technical expertise and financial resources.

These investments come as water utilities also face increasing costs for infrastructure, treatment and other operational expenses to keep systems safe and reliable. After the events of the past month, cybersecurity must be considered a central part of water utility operations.