American Water Works Association (AWWA) Security Advisory – Updated/New Cybersecurity Resources

Read the complete advisory bulletin from the above video:

AWWA Security Advisory - July 7, 2025

Who: AWWA
What: Updated/new cybersecurity resources
When: Available now

AWWA has released significant updates and revisions to its cybersecurity resources to aid utilities in building their cyber resilience. This comes as water and wastewater systems in the United States are being advised to remain vigilant amidst escalating global tensions that may threaten critical infrastructure, including but not limited to the conflict involving Iran.

AWWA has prepared a suite of resources that are freely available on the cybersecurity resource page.

The new Water Sector Cybersecurity Risk Management Guidance has been revised to engage water systems wherever they are in their cybersecurity journey, starting with the fundamentals for supporting increasing levels of maturity. The objective was to provide systems with actionable steps that provide the most immediate risk reduction value.

The updates and revisions include:

  1. Creation of a Getting Started Guide focused on the fundamentals of mitigation

  2. Integration of the Small Systems Getting Started Guide into guidance and assessment tool

  3. Update of control mapping to the NIST Cybersecurity Framework 2.0 and CISA Cyber Performance Goals (CPGs)

  4. Provide mapping to EPA ‘s Cybersecurity Inspection Checklist

  5. Development of supplementary resources including:

    1. Cyber Risk Management Plan Template

    2. Cyber-Incident Response Plan Template

The new Getting Started Guide represents the first set of actions any system should implement to mitigate cyber threats. These actions are generated in the first phase of the Assessment Tool. The second phase of the process provides users with two primary options to examine the implementation status of various cybersecurity controls, where Option 1 is recommended for systems serving under 10,000 and Option 2 provides tailored assessment based on how the system applies various technology.

In addition, AWWA developed a Cybersecurity Risk Management Plan (CRMP) template to support systems’ long-term cybersecurity planning. Another template provides the outline for a Cyber-Incident Response Plan (CIRP) that serves as a starting point for any water or wastewater system that does not already have one to ensure it is prepared to respond to a cyber incident.

Questions can be directed to Kevin Morley, AWWA federal relations manager.