New York cyber regulations for water organizations to take effect in 2027

New York has approved new cybersecurity regulations for water and wastewater systems requiring mandatory cybersecurity training, incident response and recovery plans, reporting, and designated cyber leads for larger utilities, backed by a $2.5M grant program and technical assistance; the rules target community systems serving more than 3,300 people with additional requirements for larger systems. The move is framed as a response to escalating nation-state threats, citing campaigns such as China’s 'Volt Typhoon' that have targeted water infrastructure, prompting state-level action to strengthen defenses and align with federal guidance.