EPA's Water Sector Cybersecurity Evaluation Program offers free cybersecurity assessments to drinking water and wastewater utilities. You request one through an online form, and afterward receive a risk mitigation template and guidance on improving your posture. Prepare by gathering an asset list, network diagrams and remote access details.
What the program is
The EPA request page says drinking water, wastewater and combined utilities can ask for an assessment. The form asks for utility type, population served (small, medium or large) and whether the utility is run by a state, tribe or territory. The evaluation is free.
After an assessment, the utility receives a risk mitigation template to help it understand the vulnerabilities found, along with guidance on improving its overall cybersecurity.
Claims to treat with care
The EPA page says an assessment could reduce the risk of a cyberattack by up to 45 percent, but it does not explain how that figure was derived, so we would not repeat it as fact. The page also does not say how assessment information is handled. Ask EPA or the assessor in writing about confidentiality before you share sensitive diagrams.
How to prepare
You will get more value if you arrive with the basics already pulled together:
- An asset list. Controllers, HMIs, workstations, network gear and remote access tools. Our post on OT asset inventories shows what to record.
- A network diagram that shows how the control network connects to the office network, the internet and vendors.
- A list of remote access paths, including vendors and any remote control software.
- Account practices: who has shared or default credentials, and where multifactor authentication is used.
- Backups: what exists for control logic and configuration, and when you last restored from one.
- Incident contacts: who you would call, in what order.
What to do with the results
Treat the output as a work list. Sort findings into fixes you can make this month, such as default credentials, and fixes that need budget or an engineering project. Assign an owner and a date to each. Compare the list with CISA's primary mitigations to check the basics are covered.
Share a summary with your governing board, since oversight is now a named theme in the CISA performance goals.
For small systems
Small utilities often have one operator and a contractor for the control system. The assessment can still help. Ask the contractor to join the session, because they know the settings that matter and the shortcuts taken.
Quick check
Does the assessment cost anything?
The EPA page says the evaluation is free.
Is my information kept private?
The EPA page does not say. Ask in writing before you share sensitive details.
If your utility also develops or hosts software, Safeguard offers dependency scanning and a free scan at gold.safeguard.sh/scan. It is separate from the EPA program.
Sources
Last reviewed: 19 October 2026.
