CISA's dams sector page lists more than 92,000 dams, over 24,000 miles of levees and more than 25,000 miles of waterways made navigable by locks. The sector supplies hydropower, water supply, irrigation, flood control and navigation, so its software and control systems matter to several other sectors.
What the sector provides
The page names these services: hydroelectric power, municipal and industrial water supply, agricultural irrigation, sediment and flood control, inland river navigation, industrial waste management and recreation.
Who depends on it
CISA lists five dependencies:
- Communications enables remote operations and control.
- Energy. Hydropower provides electricity and blackstart capability.
- Food and Agriculture. Irrigation water and flood protection for farmland.
- Transportation. Locks enable inland freight, and roads may cross dams.
- Water. Drinking water supply and pumping.
Blackstart is the ability to restart a grid from nothing. Hydropower is useful for that reason.
What this means for cyber risk
The page lists remote operation as a dependency on communications. Where a dam can be operated remotely, the remote path is part of the safety case. Our other posts on OT remote access cover the general risks. This post does not claim any incident, since the page does not discuss one.
A reading plan for a small operator
- List what you control remotely and over what link.
- Find who can issue a command, and how they log in.
- Check that a manual fallback exists and has been tried.
- Join your sector coordinating council. The page describes both a Dams Sector Coordinating Council and a Government Coordinating Council.
A gap to note
The page does not name a sector risk management agency, and it does not break down ownership. If you need to know who regulates your dam, check with your state dam safety program or CISA.
Safeguard does not operate dam controls. For software tied to monitoring and reporting, SBOM and dependency scanning can give an inventory.
Why scale matters here
With so many dams, most operators are small. A small operator may rely on one vendor for remote monitoring and one person for everything else. That makes simple controls count: a strong login for the remote path, a log of who used it, and a written manual fallback. None of this needs a large budget, and each item can be checked in an afternoon.
Another useful exercise is to ask what happens downstream if the dam's monitoring link is lost for a day. Does a human visit? How often? The answer is the real resilience of the site, and it is easy to find out by asking.
Quick check
How many dams does CISA list?
More than 92,000.
Why does the energy sector care about dams?
Hydropower provides electricity and blackstart capability, per CISA.
Sources
Last reviewed: 19 October 2026.
