New York State Senate Joint Public Hearing - 10/01/2026

their opening statements and we'll begin with Senator Watcher. It's on. Good afternoon. Thank you Chair Martinez to all my colleagues and everyone joining us today. I want to especially thank Chair Martinez for initiating today's hearing and for her leadership as chair of the local government committee and making sure our municipalities are prepared to confront emerging threats. We are here because something most New Yorkers rarely think about has become a potential target, our water. Every day millions of New Yorkers turn on the tap and expect clean, safe water. We cannot take that for granted. Cyber attacks on water systems are no longer hypothetical. Hackers have gained access to water systems and attempted to manipulate chemical levels. They've deployed ransomware against our water utilities. Iranian-affiliated actors have compromised the programmable controllers that operate critical infrastructure, changing programming and locking out operators from their own equipment. Something as simple as manipulating the chemicals used to treat our water could potentially render it unsafe to drink. An artificial intelligence could make these threats more sophisticated and more accessible. We also have to recognize that the nature of warfare itself is changing Future conflicts between major powers may not begin with conventional armies confronting one another on a battlefield They could increasingly be waged through cyber attacks against the infrastructure that makes modern society function. That is why preparation matters. New York has already taken important steps to strengthen cybersecurity and establish standards for our water systems. But today, we need to ask hard questions. What preparations have been made for a serious cyber attack against our water infrastructure? What scenarios are we preparing for? If hackers penetrate a system, how quickly can we detect it, isolate it, and keep safe water flowing? Are our municipalities conducting exercises that simulate these attacks? Do smaller communities have the personnel, technology, and resources they need? Because protecting our water is not simply an infrastructure issue. It's a public health issue, a public safety issue, and increasingly a national security issue. We need to prepare now, not after a crisis. Thank you, and I look forward to listening to our panelists.

Thank you. Thank you very much for everybody coming. It's a great turnout. Thank you for my colleagues, of course, Senator Botcher, and of course our chair, the great senator from Brentwood, Suffolk County. Thank you. So I'm really looking forward, and thank everybody who is going to be here as a witness, provide testimony. I am certainly looking forward to learning more about this. I think that we have to, looking forward to gaining a better insight and understanding some of these real-world costs, what the costs on municipalities as we have to increase our preparedness, understand how we can do more and what we can do better. And, you know, Senator Bacchus said it, right? I think it's just you turn on the faucet and you get clean water. And I think it's something that we take for granted. It's a public health issue. It's more than just cybersecurity and attacks. It's part of our daily lives, and it's a public health issue. So, again, I am definitely looking forward to learning more and what we can do to better protect the citizens of the state of New York. So thank you very much for coming. Appreciate it.

Thank you. This is, yes, Megan Cook, Chief Cyber Officer for the State of New York. And I want to thank you for the opportunity to testify and represent New York on this important topic of cybersecurity for water and wastewater systems and the critical role that New York State plays in proactively protecting New Yorkers. But when discussing cybersecurity and preparedness for water and wastewater sector, we have to confront an escalating and deeply asymmetric threat landscape. For years, the intelligence community has warned that nation, state, and affiliated actors are targeting critical infrastructure, positioning themselves for potential disruption and destruction, including in water and wastewater systems. And today, these threat actors are becoming increasingly sophisticated, efficient, and dangerous. They are rapidly leveraging the increasing availability of AI to enhance their offensive capabilities and scale their operations. And this creates an imbalance between offense and defense. adversaries only need to succeed a few times, while our defenders must succeed all the time. This asymmetry is pronounced in the water and wastewater sector, especially at facilities where resources for personnel and cybersecurity investments are a challenge. As we all saw this summer, our nation's water and wastewater systems were targeted in coordinated cyberattacks that spanned across at least 100 facilities across 12 states. the impacts were varied, ranging from a boil water advisory issuance to operators being locked out of their systems temporarily and switching to manual operations. While New York was not one of these affected states, these cyber attacks only underscore the importance of continuing to strategically strengthen our defenses. Governor Kathy Hochul's 2023 Whole of State Cybersecurity Strategy recognizes that building New York's security posture requires the state to use two types of levers. One, control. Two, fortification. Control levers, such as legislation, regulation, and enforcement, provide our water and wastewater systems clear expectations for baseline cybersecurity requirements that are threat and risk informed, as well as cost conscious. Fortification levers, such as cybersecurity and investments and services, provide our frontline operators practical resources needed to shore up their defenses. These two key lever types are organized across five pillars that work to reinforce each other. Number one, operate New York State government networks securely and resiliently. Two, collaborate with key stakeholders. Three, regulate critical industries. Four, communicate cybersecurity guidance. And five, grow the cybersecurity workforce and economy statewide. statewide. Over the years, New York State has proactively operationalized the statewide cybersecurity strategy to protect New Yorkers from cyber threats, especially across our critical infrastructure sectors. For the water and wastewater sector, Governor Hochul directed the state regulators with jurisdiction over water and wastewater to work hand in hand to promulgate threat and risk informed, cost conscious, and harmonized cyber regulations. these cyber regulations for the water sector and wastewater were adopted in March 26 through the New York State Department of Health DOH and New York State DEC Department of Environmental Conservation As a result New York State is the first in the nation to set cybersecurity regulations for water and wastewater and has achieved through a coordinated approach to reduce regulatory burden on covered entities while still at the same time ensuring common sense regulations setting minimum cybersecurity baselines. To ensure that the sector also had access to practical resources to fortify defenses, Governor Hochul also directed the New York State Environmental Facilities Corporation to develop a dedicated cybersecurity grant program in coordination with DOH and DEC and pair it with technical assistance services. In addition to the $10 billion in investments in water and wastewater infrastructure since 2017, the state has invested over $9 million in cybersecurity project funding for 150 local governments, 150 local government projects. Moreover, there has been an investment in capacity and capability building within and across the agencies, the Division of Homeland Security and Emergency Services, or DHSES, DEC and DOH. The mandatory unified cyber reporting portal is now in place to report cyber incidents. The DOH Water and the DEC have expanded their cyber capacity and capability through the Bureau of Water Supply and Division of Water. Through continued training, interagency information sharing, and operational development, DOH and DEC continue to strengthen their ability to oversee water and wastewater sector. cybersecurity regulation and enforcement, analysis of risk cybersecurity risk assessments, and interagency information sharing. The Division of Homeland Security and Emergency Services Critical Infrastructure Unit conducts no-cost cybersecurity assessments of critical infrastructure across the state, including for water and wastewater systems pursuant to New York State Executive Law, Article 26. In addition, they review cybersecurity vulnerability assessments that public water systems submit to DOH pursuant to public health law, Section 1125. These assessments are vitally important to the state's cybersecurity risk picture across the critical infrastructure sectors and provides a valuable gateway for critical infrastructure operators to receive trusted and custom recommendations for increased cyber resilience. In New York State, we have a leading threat intelligence gathering, analysis, and dissemination muscles that are routinely built through the state's cyber intelligence functions. Namely, within the New York State Police is the New York State Intelligence Center Cyber Analysis Unit, or as we call it, the NISIC-CAU. They provide intelligence analysis and dissemination for critical infrastructure stakeholders across the state. The NISIC-CAU serves as a trusted and centralized dissemination arm to curate threat intel and communicate indicators of compromise to numerous stakeholders throughout the state. Additionally, for many local governments that operate water and wastewater facilities, statewide offerings are available. For example, the statewide Cybersecurity Shared Service Program serves as an access point to receive cybersecurity tools and defenses throughout the state. This cyber shared services model leverages the economies of scale of the state and the state's buying power to maximize the return on cyber investment and continues to be a model throughout the nation. The statewide cyber shared services program works hand in hand with the Joint Security Operations Center. As you know, the JSOC, that supports state and local governments, 24 by 7 by 365, bringing together federal, state, city, county governments, critical businesses, and utilities to coordinate and operationalize cybersecurity incident response and threat intelligence. Through the establishment of the JSOC, the state has a more unified visibility of cybersecurity events and incidents across the state, the state networks, as well as the cities and counties currently enrolled in the security information and event management offering. The unification under JSOC continues to be instrumental in coordinating effective and efficient cybersecurity incident response operations across a range of partners through very purposeful centralization. centralization. My testimony today focuses on the evolving threat landscape facing frontline water and wastewater operators on a daily basis, as well as showcases New York State's proactive investments and a nation leading cyber whole of state approach so that we can continue to strengthen local resilience and reliability against cyber attacks together. Thank you.

Thank you for your question. So there are cybersecurity regulations and cybersecurity best practices for local governments and also for water and wastewater facilities. So I believe that the regulation, when you hear from DOH and DEC, they're going to cover a lot of those regulations. For those local governments, the Division of Homeland Security and Emergency Services offers a variety of services for them, including risk assessments, rapid risk assessments, penetration tests, exercises, as well as fishing campaign training. So there's a whole host. They offer them to all local governments. In many local governments where there is a water or wastewater facility, they are folded into that exercise, as well as the shared service offerings. So the shared service offerings are also extended to water and wastewater in there. As we continue to think about the future of cyber attacks, we know that expansion of the cyber shared services program which if you talk to any local governments will say that is one of the great things that they feel has been done by New York State and the governor We continue to expand that program

So DHSCS offers them at no cost for those who request it.

No.

No, but there is tremendous input and tremendous interest in them, and they're done quite regularly.

No, no. And so here's one of the places where New York State DHSCS has really stepped up as our federal government has backed away. So the Cybersecurity Infrastructure and Security Agency, or as we call CISA, would also provide services that some local governments were able to take part in. Those have pulled back, and so, therefore, DHSES, the Cyber Incident Response Team, which provides proactive and reactive services to cybersecurity, has really stepped up and provided more of those services.

I do not know that answer.

operational technology vendors are not unique to New York. They are throughout the entire industry.

against cyber attacks? Can you repeat the question? Yeah. So from what I'm hearing from the local

against cyber attacks? So funding is, if we were to talk about cybersecurity funding 10 years ago, we would have been the only ones in the room, right? Cybersecurity funding has consistently grown over the past 10, 15 years. I think the growth has been good in New York State, and one of the things that is really interesting about the funding, especially when we hear from the Environmental Facilities Corporation, that they were able to fund all of the eligible applicants that came in. So everything that came in that was applied for that was eligible, was able to be funded, all 153, and I know you'll hear more from DEC. But one of the things that we talk about is defense in depth. So defense in depth is a series of tools that help local governments water and wastewater facilities buy down risk So as we thinking about there are certain tools that are threat and risk informed as well as cost conscious And one of the things that Governor Hochul has done in the Cyber Shared Services Program is provide those services such as endpoint detection and response and attack surface management. So there are really some key tools that you can, if you can't afford everything, there are some key tools that can be used, especially when you're looking at IT and OT. So as we look ahead, that's why we're looking to expand the Cyber Shared Services Program.

And that would obviously hurt some municipalities to get fully funded.

So thank you for your question. There's many cybersecurity defenses that can be taken that are user-based. So user-based training. Right now, the New York State Department of Information Technology Services offers their cybersecurity training free of charge to all local governments. So if there's not already training taking place, they offer theirs for anyone to do that. Included in there is a very basic approach around password security. And what we're learning is that password security, even though you've heard it, I've heard it, it sounds like we're saying the same thing over and over again. When you look at the attacks on water and wastewater, password security is paramount. So when I think about funding, I also think about the practices that are already in place that can help protect water and wastewater from the user perspective. And that is all through training. So that's one of the things that we're also, I know that DEC will talk about some of those requirements for water and wastewater operators. Thank you.

Thank you so much. You testified that within the New York State Police, there's a New York State Intelligence Center.

And it provides intelligence analysis and dissemination, and it curates threat intelligence and communicates indicators of compromise to numerous stakeholders throughout the state. Who are the stakeholders that receive these notices, these indicators of compromise?

And is that disseminated via email?

And so is the executive chamber on that list Do you receive those as well Yes How often are these notices sent out to the stakeholders How often does this happen

What kind of threats are we talking about that have been communicated out, New York State-specific threats that get sent out to stakeholders? What kind of things are we talking about?

Any other examples potentially of things such as ACH fraud?

How confident can we be that a sophisticated foreign actor hasn't already gained access to some water systems and is simply waiting?

How do we gain confidence that they don't already have access to our systems?

Thank you.

Thank you for the testimony. I appreciate it. I want to focus a little bit more on our smaller, more rural water systems. So do you believe that we have a cybersecurity workforce gap? And I guess the second part of that question is, and if so, how does that gap affect the municipality's ability to comply with the new cybersecurity requirements?

So to me it kind of sounds like we do have a gap right Which is I think we have to care for that We have to get as many people as we can So second part of that so would you support developing a workforce training program in the I guess for the purpose of recruiting and retaining cybersecurity professionals for the municipalities?

Well, I'm hopeful, and I would like to see the state, us, probably do a little bit more working with our localities to be proactive. I guess are you proactively doing that? Are you proactively, is the state proactively promoting that and saying to our villages or towns or wherever the small, I have a rural district with some small wastewater treatment plants. They can't do all this, right? So I like to, are you doing anything proactively or what can we do? Last question.

And just if you could provide me with that information because I want to go back to my towns, villages, the county that may not have this. I want to say, listen, this is what we're doing. This is what you should be doing because it's serious. So thank you very much.

Thank you. Senator Fahey.

I mean, clearly we are going to need assistance here. Every state is going to need assistance. Can you elaborate on what you meant by the federal government walking away

So the agency CISA, C-I-S-A, is what we typically in the past would work with to get threat intelligence information sooner. And the threat intelligence feed has become extremely small to almost nothing. So therefore, what we're doing is New York State has built up our own threat intel gathering. And one of the things that we talked about was the NISIC-CAU. But as the community of agencies, we all come together on a regular basis daily with threat intel information. So we have filled that gap. But local governments also participated in CISA activities, and those activities are not supported anymore. So they're turning to us, as well as many other things that we slowly continue to hear about the services that CISA was providing to local governments in New York State and throughout the nation that they're no longer doing, that we are now taking a lead on.

Yes through the DHSCS critical infrastructure unit They are hearing from municipalities that are that have water and wastewater for the cyber risk assessment So yes they are Okay and a number of them have you know they, we assume, do not have dedicated cyber security staff, especially the smaller municipalities, and yet even where I live in Albany, and even Albany Med, a much larger multi-billion dollar institution had cyber attacks, again, not with their water, but related.

So there is training available. I think what you're going to hear is that there's training available from multiple agencies, depending on the profession within the local government. So you're going to hear from DOH and DEC about what they provide to water and wastewater. For the rest of the staff, there are trainings held, but sometimes the best training is to exercise your incident response plan, and so we do that quite regularly with local governments.

So, thank you for your question. Generative AI allows, is like a force multiplier in attacks, right?

So it allows them to scale their operations, as I said, so reach more. Does it mean that all of the scale is sophisticated attacks? That is why the baseline cybersecurity regulations set forth by the governor for water and wastewater really help prevent. And so in the case, as I brought up, that we saw, changing passwords from default passwords on PLCs could have prevented some of that. But there are also sophisticated attacks that are occurring. One of the things that we go back to is we also work with our industry partners. So our industry partners have products and services already in place within water and wastewater facilities. How are they incorporating artificial intelligence to increase the defense? So we're working hand-in-hand with industry on that to make sure that what's already in place is truly a defense mechanism and complements the defense in depth approach.

Of course.

And Senator Chan.

Thank you.

Right now, we don't have any documented ones. I know you'll hear more from DOH and DEC on the information that they've been able to collect.

I do not have that number, but I'm happy to follow up and get back to you.

I don't have that information in front of me, but there's one thing to note about water and wastewater, especially as they range in size and the population that they have to serve. So they are configured in different ways. And so that also plays a role in determining the funds needed for each one.

So this is a, thank you for your question,

We can have cybersecurity professionals, we may not have the funding to hire them, the lines to bring them in. I believe in New York State through, thank you Senator Fahey for bringing up the University at Albany, also RIT, also Plattsburgh, also Columbia, have very strong programs in cybersecurity and are attracting students as well as the community colleges, the two-year programs. So I do believe working on cybersecurity workforce and understanding how you can leverage a shorter program for a more hands-on and then a four-year program for a different part of cybersecurity. So I believe that we can work on this together.

So was there any specific vulnerabilities or incidents that led the state to conclude that these mandatory requirements are necessary at this time?

And what is your opinion on the price of the water system upgrades?

Okay, so right quick, just brush up on the cybersecurity upgrades, right? Is it going to require taking the critical infrastructure temporarily offline?

Okay. Thank you very much, Ms. Cook.

Okay. Thank you, Ms. Cook.

No, we all did.

We all did.

able to do that um senator vacher excellent hi i just wanted to follow up on a question that senator fahey asked are you saying that the federal government has stopped forwarding threats that it has learned about about attacks on our infrastructure to new york state

Is that a question?

Thank you. Thank you. And just one more follow-up from Senator Fahey's question regarding those who have benefited from this. But do you happen to know the exact number of how many localities outside the recent grant winners have taken the state's offer of these services out of the over 3,000 systems we have across the state?

So how many of the localities outside of the recent grant winners have taken the state's offer?

Did you get the number for us?

Okay, thank you. Why not? Why not? So you mentioned that the FBI's notification to New York State in regards to the cybersecurity threats have dwindled.

Am I correct to say that?

And I know that we will also look forward to some of the follow-ups that we have asked for from your office. And thank you for being here.

Okay, so now moving forward, we're going to our next panel, which includes the New York State Department of Environmental Conservation. We have the Deputy Commissioner for Water Resources, AJ Smith, as well as the Environmental Program Specialist, Samantha McHart. Again, you will have ten minutes for your statements and Senators. We each have five minutes and we're not going over those five minutes.

Okay, good afternoon. Thank you for having us. Chairs Martinez, Ryan and Botcher and

Thank you. We will begin with Senator Ryan.

Yeah, so the wastewater operator certification training that we're requiring builds on the set of regulations that we actually already require for general wastewater operator training. And so I think important to note that we did a lot of outreach, right, with associations that represent wastewater operators in developing these regulations and found that that level of training should be sufficient. Obviously, it's risk-based, so the larger the number of hours is associated with the type of facility that the operator is going to be involved in managing, right? So more hours of training for a much larger, maybe more sophisticated system, which is an important note, but at a minimum providing, you know, that two to four hours. It's also a component of the overall number of total hours. So we didn't, we wanted to be clear that we weren't adding additional hours to certification requirements already. We wanted to make it part of what their existing requirements are. So I think the short answer is yes, we do believe that it is significant. and should be a very useful part of their overall training to be prepared. I don't know if you want to add anything else, Samantha. Just to answer the part of your question about what other states do,

Well, I think they should. Second question. And so the new rules regulations developed by DOHCC apply to community water systems serving more than 3,300 people. Are there any rules regulations for smaller water systems? Again, I'll go back to the rural areas, like why the cutoff and should we have them for smaller systems?

So if one of my smaller villages has their own, because I have a couple, their own municipal wastewater treatment plans, there is no, they would be included in that. They're not carved out, if you will. They are still required to get that training. Okay, good.

Thank you.

Thank you.

You both did the same or you have your own?

But we'll continue with our questioning to Alexander. Senator Ryan? I mean, Boccia? If the state were to appropriate additional funds to your agency now, let's say $100 million, what would be the first thing you would dedicate that money to? Wow. $100 million. Specific to cybersecurity?

And, you know, we have a long history of supporting speedy's permit compliance enforcement, right, and development.

I think we'll continue on on the funding piece. You know, the grants are one, the secure grants are one element.

Thank you.

Thank you. Okay, I guess I'll go. All right, thank you, and thank you for being here as well. Just to follow up on previous questions, too, DEC, you yourself, how many water systems outside of the 150 or so municipalities who have received a secure grant are you working with to help them secure their systems? Anyone? Thanks, Ann.

Now, you're saying that those who have brought in and educating them, Obviously, not all municipalities have joined in on this. What efforts are you doing to ensure that these municipalities are doing that and are applying for this grant? And aside from that, are you also seeking additional funding elsewhere outside of New York State? Yes.

incident reporting um do you feel that it is enough time to give municipalities to report not just incidents within 24 hours and or the vulnerabilities within 48 hours i mean we have states like maryland who are doing it within the hour yeah so is it enough time yeah uh yeah i think

the reporting burdens by allowing drinking water facilities, wastewater facilities, and municipalities to report to the three agencies all on the same portal rather than doing three separate reporting mechanisms so they can report to DEC, DOH, and DISHES using the same reporting portal. Okay well I have 15 seconds left but I know you're you have your own testimony so I have

you. All right Ms. Samantha. We had shared testimony. Yeah. Oh you did have shared testimony. I thought you had your own.

Just kidding.

I guess I can.

I think we probably have to defer to EFC on the specifics about qualifying eligibility for the grants themselves

yeah okay yeah if if EFC is not able to answer the question EFC and DEC will talk and be able to

You too.

Our testimony is also shared.

Good afternoon, Chair Martinez. Are we ready to go? Yes, you're all set. Great. Chair Martinez, thanks for having us here. Senator Botcher and Senator Ryan, thank you for having us here. I'm Michael Hale, I'm the Executive Vice President of the Environmental Facilities Corporation, otherwise known as EFC, which has been brought up here several times. So I'm pleased to be here today to speak about EFC's role in executing Governor Hochul's nation-leading statewide cybersecurity strategy, and specifically the first in the nation water infrastructure cybersecurity regulations and the funding that EFC has administered along with that. EFC is New York State's water infrastructure bank, and our mission is to make critical water infrastructure projects affordable for all New Yorkers. We offer expert technical assistance to help communities with capital projects as well as these cyber implementation grants. Governor Hochul's 2025 State of the State Agenda called for the creation of a grant program specifically meant to strengthen cybersecurity protocols of the water and wastewater sectors. The program provides technical assistance and funding for utilities to assess their cybersecurity posture, develop a cybersecurity plan, and improve their cybersecurity resilience. At the same time, DEC was directed to draft minimum standards for wastewater systems, and the Departments of Health and Public Service were directed to draft minimum standards for drinking water systems. EFC is providing both technical assistance and funding through our SECURE program. This two-pronged response reflects New York's commitment to providing communities with resources to affordably strengthen their drinking water and wastewater systems against increasingly sophisticated and dangerous cyber threats, protecting services that millions of New Yorkers rely on. EFC launched its technical assistance program while DOH and DEC were developing the regulations that set forth the minimum standards. This was to provide immediate resources to communities to start assessing their cyber posture. EFC expanded its existing community assistance teams initiative that since 2023 has bolstered our support for local governments in addressing their water and water. and wastewater needs. EFC has created an online cybersecurity hub to aggregate best practices, exercise, training from U.S. EPA and CISA, as well as other resources from around the cybersecurity universe. The hub launched on July 22, 2025, and it includes a meeting request form so that anyone can request a one-on-one consultation with EFC and our partner agencies. EFC coordinates with DOH and DEC and updates the hub regularly to ensure the resources align with the state's cyber regulations and remains current. The hub is one of the top pages visited on EFC's website, which has more than 100,000 users annually. EFC has handled hundreds of inquiries about cybersecurity and coordinated several one-on-one cybersecurity consultations to help communities address their unique concerns and navigate funding opportunities. As the secure grants, we opened applications for those grants on March 11, 2026, the same day the final cybersecurity standards were adopted by DOH and DEC. We provided a streamlined application process to ensure communities could easily apply for this funding. The awards were fast-tracked after federal authorities announced a series of cyber attacks on water utilities outside of New York that were discussed earlier today. Governor Hochul announced this summer that more than 9 million in grants to support 152 local government projects statewide. The total amount awarded was increased more than threefold above the original $2.5 million commitment to meet the full financial needs requested by the communities that applied for secure grants. The grants provide funding for cybersecurity assessments and implementation of cybersecurity controls at both drinking water and wastewater utilities, communities, ensuring EFC can help communities at every stage in the process of strengthening their cybersecurity resiliency. To understand a system's cybersecurity risk, the utility must perform a cybersecurity assessment. EFC's hub provides resources to assist with this effort, as do DOH's cybersecurity hub and DEC's wastewater cybersecurity resources webpage. EFC awarded 126 grants for initial assessments. Once a system has undertaken an assessment and understands its cybersecurity risks, it can begin to implement cybersecurity measures to address those risks. EFC awarded 26 implementation grants. EFC engaged with grant recipients in a pair of webinars held soon after the Governor announced the awards. EFC hosted a webinar for assessment grants and another for implementation grants to ensure the discussion was tailored to the recipients. Over 150 participants registered for these webinars. EFC implemented a simplified process to help communities enter into a grant agreement and put the grant funds to work quickly. All awardees have received a grant agreement from EFC for execution and over a third of those have been returned to our office as of today. Many communities will be accessing these funds very shortly Water infrastructure is essential to public health safety economic stability and national security making it an attractive target Cyber attacks cost money time and valuable resources and can potentially halt water services and threaten public health and the environment. That's why EFC is helping local systems strengthen their cybersecurity while keeping costs down for communities and ratepayers. Governor Hochul's initiative to safeguard New York's water infrastructure is emblematic of New York's leadership in cybersecurity, environmental protection, and affordability. EFC is proud to support the Governor's vision by helping communities assess risks, implement solutions, and build more resilient water infrastructure. Thank you.

Okay, let me just ask a couple questions about the grant allocation and secure grants. So for economic development regions, Central New York, Mohawk Valley, North Country, and the Southern Tier, there was zero implementation grants were awarded, I believe. Just fact check that. So, you know, that's, to me, somebody who represents Central New York. That's a little, I think it's concerning. And I'd like to ask, what's the rationale for leaving those regions and those municipalities behind?

likely did not have an assessment that met the standards set forth in the regulations. And Senator, could you repeat the regions? New York, Mohawk Valley, North Country, and Southern Tier.

What was the timeframe on the assessment? The timeframe on the assessment, you had to have it completed within six months prior to the end of the grant program.

And that's on the municipality to perform an assessment?

And why we set that six-month window is because we want the assessment to be current, right?

so some of the smaller areas, smaller towns or villages, you know, they may not have the, I think that's something that we should probably consider, right? So I think that not everybody has the ability. And then, so I, and you mentioned the word accelerated.

You said the window to apply, right?

application period? There's a two month window. Okay. Yes. See you know just let

We understand that, and our technical assistance remains available so that we can work with communities to assess what their needs may be in this relationship. And look forward to doing it. And when I go back and I can put some of my municipalities or the cities in touch, and that would be good. But I guess in the future, if we do continue a grant program, which, you know, hopefully we will, just bear in mind that not everybody has that short window to turn that around. And just to expand a little bit on the application. So it was a two-month period, but we did simplify the application, so there was less that was required to actually submit. Thank you.

I don't think we would be in a position to answer that. That might be best answered by the Division of Homeland Security and Emergency Services on a state level. DEC may be able to speak to that, but I don't think we could. But if you could also take that back, you know, as a follow-up. Sure. Because, for example, Suffolk County. I spoke about that before. They had a FEMA plan expired earlier this year.

receive this funding and not others? Potentially, yes, if they have done the assessment that that meets the state regulatory standards, yes. I would say so.

I don't. I can't answer that on the regulatory side.

And I can tell you from personal experience, we had them in EFC's offices on multiple occasions to do an assessment tabletop exercises. And we have municipalities that have also worked with them. And the feedback from our organization, as well as those municipalities, is absolutely 100% positive. They do a great job. They really do. So it's a great resource.

Senator Boccia?

All right. Well, thank you both. Great. Thank you all.

Thank you.

No, good morning. I don't want to keep saying good morning, but it's good afternoon. All right, good afternoon. We are now on our fourth panel. And with us we have today Ms. DeFalco from the New York City Department of Environmental Protection. And we also have Ari from, not on my glasses, but also from the New York City Department of Environmental Protection. And I will now give you the mic.

Of course. Now, thank you. I'm going to have my city folks go first. Senator Botcher? Senator Ryan, he's giving you the baton.

You are a city guy.

I think what we, our security needs can be different than some smaller utilities. And when we say risk-based rather than overly prescriptive, it's what might be a simple potential cybersecurity, you know, attempt that might be – that might not happen as small for smaller utilities, might happen far more routinely for us based on the size, even if it's what we would consider to be a small attempt or threat. But, you know, having overly prescriptive requirements to report and maintain these, we would like to be able to work on a way that makes sense so that we are not spending all of our resources documenting and logging smaller potential intrusions versus larger ones. I think that there's just a different scale of requirement when you're talking about a utility that serves half the state.

Yeah. To put it in a different but hopefully comparable context, I would imagine that other municipalities get complaints about clogged catch basins when it floods. We have 154,000 of them. The number of complaints that we get each time it rains, far different. And if we were asked to log every single one of those, the resources needed just to log them, even if it was a small So scale matters, I think, in that same context, if you were to take that and apply it to some cybersecurity.

we've been delivering water for 184 years, far, most of the time, without the Internet, obviously. And so I don't think that some smaller utilities have some of the capabilities that we do, because they may be more reliant on different systems than we are might not be able to operate manually in the way that we can. So I think that we're just looking to make sure that things aren't so overly prescriptive that they would have inadvertent effects on a utility of our size.

Senator Botcher.

time, we're able to operate. I'm not going to talk about how long we could operate safely, because I'm sure you're not the only one. Or there are many people watching this hearing today. I don't think that that would be something that we should talk about publicly.

I think one of the issues that we're facing, and Mr. Falco touched upon it, is the lack of our pension for our officers is keeping our attrition rate constantly turning over. So as of this morning, we have 36 vacancies from my top head count. So as we train people, we lose them. So I'm losing all that knowledge, that institutional knowledge, because as much as they, antidotally, as much as we find out during talking to them while they're exiting our agency, they like working for us, but the opportunity to be able to work younger, retire younger, and spend, you know, more years with their family is causing them to leave our agency.

They generally, I don't want to speak for the NYPD, but they generally leave for other New York State agencies outside of New York City. Just so you're aware, the majority, in fact, I would say the vast majority of our DEP police officers are assigned outside of the city in the watershed. There's some areas in the Bronx where they work, but the vast majority is the counties in the watershed counties. So they are constantly leaving our agency and going to other agencies which get highly trained police officers with no costs for training because the city just footed the bill to train them.

So I just want to stress that the system is safe. We do a very good job of securing the system. The police agency spends their time dedicated to just doing that What I concerned about is that the money now spent to backfill the vacancies with overtime hiring new recruits to replace those that left could be spent whether it's on physical security, you know, gates and things like that. The money could be spent other places other than having to spend that money to bring back folks and pay for the overtime.

I think that the legislature has stepped in. I think the bill has been passed and we're hopeful that it will be signed and that we'll be able to move forward and to have an easier time, you know, I think, doing recruitment. So overall, we're pretty positive about that. But in this day and time, in this moment in time right now, that's one of our biggest challenges.

And again, just following. Question? You're not up yet. Oh, sorry. No, you'll be next, sorry. Okay. You took some minutes away from me. I'm sorry.

I think we might have to get back to you on that one. I'm sorry, I don't have that one readily available. We'll see if we can get it before the end of the hearing.

All right, Senator Chan, it's all you.

We're authorized for 221.

I don't think there's been any increase in applications for that.

Like, has anything been... Yes. Oh.

First of all, do we use caustic chemicals such as sodium hydroxide in our water supply? I can understand if you're not at liberty. I'm definitely not your scientist that you want to talk to about what chemicals are called water supply, nor do I think that this is the right form to talk about that.

Not that I know of, no.

Or even a human error, like somebody just punched in the wrong number and the wrong amount of, wrong ratio of, let's say, chloride or sodium hydroxide was sent into our water supply. Do we have any instances of that? None that I'm aware of.

All right, we're done here. Thank you. All right, now we're moving to our last and final panel. Thank you. Good afternoon. We now have our fifth and final panel. We have the Center for Strategic and International Studies, Lauren Williams. And you are the Deputy Director and Senior Fellow Strategic Technologies Program. And we're also joined by Daniel Dubois, New York Section American Water Works Association. And of course, I know Dan also from Suffolk County Water Authority. Welcome to you both.

You may begin.

the challenges that water utility operators across the country face. And finally, I'll just conclude with some recommendations. Going forward, New York should, of course, continue the proactive path that it's taken and that it's committed to. And in the short term, waste and wastewater utility operators should implement basic cybersecurity hygiene, even as state and nationwide initiatives take shape. We've heard about what some of those actions are and happy to discuss in questions. Operators should monitor their systems for anomalous activities and report them to state and federal level authorities. But perhaps most importantly, the executive branch in Congress should act urgently to empower federal agencies like the EPA and establish minimum cybersecurity standards for the water sector nationwide, pairing these with funding and maybe expanding projects like Watershed 2050 Beyond Texas. In the medium and the long term, agencies should partner more closely with state and local entities to ensure they receive the appropriate threat intelligence, as we've discussed already earlier today, to protect against nation's state level threat actors and also work to strengthen the cyber workforce pipeline with critical infrastructure already vulnerable and nation-state actors demonstrating consistent intent and a capability the nation cannot afford to wait to make these changes thank you for the opportunity to provide my testimony today i look forward to answering your questions thank you that was very informative

by pre-positioning what does that mean sure so in the case of this China linked China nation state-length threat actor, Volt Typhoon, what we – when I was in government in the 2023, kind of into the Biden administration, there were lots of discussions around this. Essentially, these actors have taken an approach of gaining access to U.S. critical infrastructure, including water, energy, and communications, and maintaining that access persistently. And what's different about this approach is that it is not tied to any ransom, not tied to financial gain, but to maintain that persistent access, which has led the intelligence community and government officials to assume that China's intent is to disrupt these systems in the future, as opposed to in the present moment.

Sure. It's a great question. And fortunately there is a lot of written material that CISA and the FBI and the A wide range actually of intelligence agencies have put out the specific technical detail to answer your question. But more broadly, this really comes to the need for kind of consistent monitoring of networks and of systems so that any one of us who are operating critical infrastructure are able to notice when anomalies are taking place. And in the present day and age with AI uplifting the capability of any cyber threat actor, we also need to be implementing AI in our cyber defenses to be able to more persistently monitor for those anomalies.

Sure. A lot of things. Maybe a top three. Sure, sure, sure. So the top three for operators, and I think this gets to the specifics of the New York regulations, is to have, you know, individuals to have staff who are focused on cybersecurity and for there to be, you know, funding to maintain that staff. And I think outside of the New York City context, looking to much smaller kind of rural utilities, there may just be one or two people total who are monitoring those systems and they're using remotely controlled operations. and they might not have the resources to be focusing on cybersecurity. So what we really need to do is to be training up the workforce and to be making sure that however many people are on duty at a utility, that cybersecurity is a top priority for them or making sure that there is resourcing to add someone to a staff that is focused on cybersecurity specifically.

I think that to my mind.

Oh, you did give me a top three. Yeah, so that's one. Yeah, so that's one. We need to make sure that we're prioritizing cybersecurity. And then specifically, and we talked about risk-based requirements. Risk-based specifications are important, but identifying what that minimum tier of actions that any utility, and we're talking New York, but I look nationally, that any utility should be implementing. That's incredibly important. This state has taken a sector-by-sector approach, with water being the focus that we're talking about today. That obviously is not the case nationally, and so there is not one set of clear, you know, you must do these things requirements at the national level, and that's really essential, and that's where the national legislation that I spoke about gets to those specifics. So we really do need that. And then the last thing, as we've discussed, we've heard discussed, threatened intelligence sharing is essential. We've lost staff at the federal executive level who are able to provide this type of intelligence. But even with the right staffing, it's really challenging. We need to make sure that at the state level, there are people who can receive the information that is being shared from the executive level, how they have the right clearances so that they can be aware of things like Iran or nation state, Russia or China nation state level cyber threats. And if you don't have that ability to share information, the right people and the amount of information being shared at the executive level and that it's being accurately and completely portrayed to the states, then we're missing a whole level of information that helps make cyber security requirements more effective.

Yes. So today the New York State Chief Cyber Officer shared with us that the intelligence that New York State had been receiving from the federal government regarding potential cyber security threats against our infrastructure had slowed to a trickle since Donald Trump became president

Are we less safe because of the federal government's cuts to these agencies?

Thank you.

Thank you. Very powerful and, once again, very disconcerting. is there an area that you would say where we are particularly underestimating potential cybersecurity threats that we are not, you hit on a number of areas, whether that's underestimating here in New York or underestimating nationally, is there a particular, what's keeping you up at night on some of this? because a lot of it is certainly keeping me up at night with the growing number of AI breaches and cybersecurity breaches. And, Warren, as you mentioned, the fact that part of this growing concern is the fact that the war in Iran has only fueled concerns about breaches.

Are you seeing, given what has just happened in the last month, and as you noted there was at least a meeting held although the President himself has dismissed some of the overall threats here are you seeing a change? Do you expect them to restaff or are you seeing any help? Because I do believe as much as I'm so pleased that New York as you said is a trailblazer and thank you for that. It gives a bit of comfort but despite the fact that we may be trailblazing on these efforts, are you seeing where we will get any additional help or support and this dwindling of intelligence feeds will turn around at any time soon?

Thank you. I've only got a couple seconds left here, and I want to be respectful. You mentioned the Adam Schiff and Amy Klobuchar bill. Clearly, that's not a bipartisan bill. and we're in a very partisan phase. Does that, if things change, do you see where that is something that New York can learn from or adopt or what the governor in Texas has put out with the project watershed Do you see something there that we should be looking at on either of those fronts Absolutely So I think yes definitely the

Good. Thank you.

Thank you very much for the information. A couple questions. I've got three quick questions and a request. So you mentioned New York is leading in regulations, which is great. I'm glad that we're a leader. New York's always a leader. But in your opinion, in your assessment, how are we doing as a state implementing those through New York State?

So you think we're doing a good job, we just have to keep funding them?

Okay. Second question. What are the most effective implementation systems for water and wastewater systems that plug vulnerabilities?

What can we do?

Okay. I don't know if you can answer this, but I don't know how we can find out. So how many systems, small or rural systems, would you guess currently have Internet-connected operational technology that lacks adequate monitoring and or authentication?

Okay. So the other one I want you to take back is what do you believe is the single greatest cause of our vulnerabilities? And I don't mean like the Iranian war and you know we know that we have hackers, I mean like what causes Where it's password protection or bad passwords and don't use 111. We have people that use the internet that are tied in and they can get in the back door. So that's another question for a takeaway. What would you think would be there? What's the single greatest cause for our vulnerabilities? And then lastly, just a request. If you could provide me with some information. If you were a senator and or tell me what you think that I need to know. Tell me what you think we should know and what we need to do to implement policies, procedures that goes back to the answer, how do we lessen our vulnerabilities? And obviously that's a conversation for another day. But if you could provide me with that information, that would be helpful, and I would appreciate that.

Okay. Thank you.

Good afternoon, Dan.

Can you hear me?

All right. Chair Martinez, Senator Botcher, Senator Ryan, Senator Fahey, thank you for the opportunity to testify on the implementation, fiscal impact, and technical sufficiency of New York's water and wastewater cybersecurity regulations. My name is Daniel Dubois. I'm a member of the Water Utility Council and testifying on behalf of the New York State American Water Works Association. I'm also the director of communications and external affairs for the Suffolk County Water Authority, so wearing two hats today. New York State AWWA is the statewide voice of water professionals who safeguard public health and sustain New York's essential water infrastructure. Our members include operators, engineers, water utility leaders, scientists, regulators, manufacturers, service providers, and other experts who bring firsthand knowledge of the operational, technical, and financial realities facing water systems of every size. New York State AWWA supports New York's efforts to strengthen the cybersecurity and operational resilience of its water and wastewater systems. As the state moves from adopting these regulations to implementing them, the focus must be on ensuring that the requirements achieve meaningful risk reduction within the complex operating environments of public utilities. Every affected utility will be responsible for meeting these requirements, but utilities do not all have the same staffing, financial resources, infrastructure, or access to specialized expertise. Successful implementation will require sustained funding, professionals who understand both cybersecurity and operational technology, clear guidance from each state agency, and reasonable implementation timelines. With the right support, these regulations can strengthen security and resilience while allowing utilities to continue to provide safe and reliable service. Water and wastewater systems operate continuously and cannot simply be shut down for extensive technology upgrades. Many utilities rely on a combination of modern information technology, specialized operational technology, supervisory control and data acquisition systems, and legacy equipment designed to remain in service continuously. This is a presentation of the Department of systems treatment processes and the public health consequences of service disruptions That expertise is limited and can be especially difficult for smaller and resource-constrained utilities to obtain. Technical sufficiency, therefore, cannot be measured only by whether a utility has completed a required document or installed a particular product. The requirements must produce measurable risk reduction without disrupting treatment operations. Implementation guidance should recognize the difference between information technology and operational technology, allow appropriate compensating controls for legacy equipment, and remain adaptable as threats and technologies evolve. It should be developed with continuing input from utility operators, engineers, and cybersecurity professionals. The Department of Health and Department of Environmental Conservation Regulations adopted in 2026 appropriately address operator training, incident reporting, emergency and incident response planning, asset inventories, access controls, vulnerability management, network security, monitoring, documentation, and recurring certification. These are reasonable security objectives. Implementing them correctly, however, requires sustained attention and ongoing investment. The two agencies regulate different systems and impose different requirements. The Department of Health requirements apply to community water systems serving more than 3,300 people, with additional provisions for systems serving more than 50,000 people. The Department of Environmental Conservation requirements include reporting requirements for state pollutant discharge elimination system permittees, as well as additional controls for publicly owned treatment works and monitoring and logging requirements for larger facilities. Utilities must understand which provisions apply, identify qualified assistance, complete assessments, develop or revise plans, procure technology and services, train personnel, and document compliance. Major implementation deadlines beginning in January and March 2027 leave a limited window for this work. Each agency should provide clear, practical guidance so utilities can determine which requirements apply and avoid repeating work already completed. Many water utilities also operate within larger municipal IT environments. Changes such as network segmentation or dedicated systems may require coordination with municipal staff, specialized integration, and additional funding. Implementation guidance should account for these shared systems and the time needed to make changes safely. New York State AWWA recently conducted a preliminary survey of its utility members to better understand the financial impact of the new regulations. Because the sample is preliminary, these results should not be treated as a statewide average. They nevertheless show the magnitude and variability of the costs utilities are confronting. Utilities serving between 10,000 and 50,000 people estimate initial costs of approximately $15,000 to $300,000 and continuing annual costs of approximately $15,000 to $90,000. Utilities serving between 50,000 and 100,000 people estimate costs approximately 15,000 to 350,000 in initial costs and 40,000 to 500,000 in annual costs. Among responding utilities serving 100,000 people or more, estimated initial costs range from approximately 20,000 to more than 350,000, while annual costs ranged from approximately 50,000 to more than 700,000 per year. These estimates include vulnerability assessments third monitoring and scanning software and licensing consulting cybersecurity insurance penetration testing equipment training documentation and staff time The survey confirms that compliance creates both substantial initial expenses and significant recurring obligations In many cases, the annual cost of continuous monitoring, scanning, licensing, testing, and expert support may exceed the initial implementation costs. Utilities also identify broader implementation challenges, including uncertainty about the regulatory expectations, limited staff capacity, compressed timelines, legacy equipment, and difficulty obtaining qualified cybersecurity and operational technology expertise. These issues are interconnected. A utility may understand what must be done but still lack the personnel, procurement flexibility, or financial capacity to complete it on schedule. For a smaller utility with a few licensed operators, the same employees responsible for treatment and daily operations may also have to manage assessments, procurement, training, and cybersecurity documentation. Time away for training or implementation requires staff coverage, while specialized monitoring and support contracts are spread across a limited customer base. This is why recurring funding and access to shared technical expertise matter as much as help with the initial upgrade. Traditional municipal procurement processes can present another obstacle. Cybersecurity and SCADA projects often require specialized qualifications, careful integration, rapid response to evolving risks. Lowest price bidding alone may not identify the provider best qualified to protect an operational system. The legislature should evaluate whether municipalities need expanded access to qualifications-based selection, design-build authority, cooperative purchasing, and updated bidding and bonding thresholds for specialized cybersecurity and SCADA projects. New York State AWWA appreciates the state's early support, including more than $9 million awarded in August 2026 through the Secure Grant Program for 153 cybersecurity projects. This was an important step. However, one-time grants cannot by themselves support continuing monitoring, licensing, testing, training, maintenance, and specialized assistance. Sustainable compliance will require recurring support. New York State AWWA respectfully recommends the legislature take the following actions. Provide recurring funding for both implementation and operations funding should be should cover eligible capital improvements as well as ongoing monitoring software and licensing testing training maintenance documentation and specialized professional services programs should use streamlined applications reasonable local match requirements and predictable funding cycles prioritize systems with limited financial and technical capacity state support should account for utilities customer not only for customers utility-based staffing existing infrastructure fiscal fiscal capacity but also the level of risk not simply the size of an individual product project compliance should not force utilities to choose between cyber security and other public health invest investments that are essential expand accessible technical assistance shared or regional access to professionals who understand both cyber security and water sector operational technology could could expand access to specialized expertise, reduce duplication, and help more utilities use limited public funding effectively. Assistance should include assessments, procurement support, implementation planning, incident response exercises, and workforce training. Use existing processes to identify implementation needs, direct DOH and DEC to draw on regulatory oversight, state grant programs and confidential utility input to brief the legislature on common costs and barriers Report findings in aggregate so future funding reflects demonstrated need without exposing sensitive information I about out of time but I got one more recommendation for you Protect sensitive information and maintain utility involvement Cybersecurity plans network details, vulnerability assessments, and incident information must be protected from unnecessary public disclosure. Utilities should remain directly involved as guidance and programs are refined, working with state and trusted partners such as CISA, EPA, and the American Water Works Association. New York's water and wastewater utilities understand the seriousness of cyber threat and their responsibility to protect the communities we serve. They're prepared to do this work, but durable security depends on more than a compliance deadline. It requires sustained investment, specialized expertise, practical guidance, and a long-term partnership between the state and its utilities. We ask the legislature to support recurring funding, accessible technical assistance, appropriate procurement tools, protection of sensitive information, and aggregate reporting on implementation costs with continued utility input these actions can turn regulatory requirements into measurable risk reduction and lasting operational resilience thank you for the opportunity to testify new york state awwa work looks forward to working with the legislature state agencies and our utility partners on effective implementation i appreciate any questions you have that was a lot no thank you would you like to go first well actually no it's

Yes, certainly. Statewide, the investment is appreciated, and it certainly goes a long way to helping with that initial implementation. As we've heard today, a lot of the funding went towards initial implementation. I'm sorry, for the initial assessments, but the implementation that's going to follow is going to be expensive. And then, as I've outlined in my testimony, it's the recurring costs that are going to be a major factor. In some cases, as I mentioned, the annual costs in just a single year will outstrip the implementation costs. Those ongoing subscriptions, the contracts for outside contractors who can assist with this technical knowledge that a lot of the smaller utilities do not have on staff, that's all going to be critical and that's going to be recurring. And the requirements as technology continues to improve, we expect the regulations are going to evolve with time. So those costs are only going to increase on top of the additional requirements when it comes to, you know, standards for water quality, infrastructure management, all of these increasing costs that water utilities are facing. This is yet another expense that we have to manage and balance with everything else that we're required to do.

So I will say, putting on my SCWA hat for a moment, and I am responsible for a lot of our grant applications, the process for the secure grant was extremely simple. And that was very much appreciated as you compare it to a water infrastructure grant, which requires environmental reviews, it requires engineering reports, and a lot of information that we need to provide to the state for them to assess the viability of a project. These grants were very simple. CWA applied for an assessment grant because that two-month window was a very short time span in order to have a timely assessment ready to go. So it was, I will say, it was a very simple process, which is very appreciated, but it was a very short window of time.

I would certainly recurring funding. It's why I put it first. But also with the understanding that it should not necessarily be based on an application, a competitive grant. It needs to look at the size of the municipality, and not necessarily the size of the project itself, but the number of people that are being served and the technical capabilities of the water provider. So, you know, as we talk about very large water providers like New York City or SCWA, which is a very close second to New York City with 1.2 million people to their 10. We have a sophisticated IT department that understands a lot of this. We have dedicated cybersecurity personnel, which we're very proud of, and that's great. Even we still need assistance with this, and we need to do assessments and assistance with the implementation. When you're talking about utilities that are very small and they're operating with only a few operators who have very little expertise on the IT side, they may understand operational technology, that is something that is significant. But I would also conversely say that for the larger utilities, there may be a philosophy change that's happening right now, which is moving over a lot of this from operational technology, which traditionally may have been operated by the operations side, and IT was not necessarily involved in that. And now because the cybersecurity requirements are becoming more stringent, we have to move that expertise over to IT. So even in that, there's a lot of ongoing costs that are going to be tied to this. So certainly it's the recurring costs.

A specific reform I can follow up with you and I can talk to the folks at EWRA to see if they have something specifically But generally speaking as I mentioned you know having lowest bidder requirements on some of this may not provide the expertise necessary for some of this. Because as I said, it's a very specialized type of person that you need. You need someone who doesn't just understand IT and cybersecurity. You need someone who understands operational technology and, you know, public water processes. They need to understand what it means to take some of these systems offline for a prolonged period of time to make an upgrade. If they don't have that expertise, they're going to come in, they're going to make recommendations that are just not going to be practical. And, you know, that could lead to delays or wasted resources. So, yeah, I think that, you know, that's definitely what I would say.

Senator Bacher, or?

Thank you.

So operational technology is, as I said, differentiated from information technology. And I will say, you know, I am not in the IT field. I won't pretend to be an expert. But in talking with the IT staff at the Suffolk County Water Authority, you know, they have mentioned that it's a very different philosophy when it comes to IT versus OT. With IT, you know, you want to get the latest firmware updates. You want to have your technology as patched and updated as quickly as possible. With OT, you're dealing with legacy systems that may no longer be supported. And you need to have certain technical steps in place to create an acceptable level of risk because you can't just take your system offline to do widespread updates of firmware. That's not something that you can do. So you need to be looking at things like air gapping, ensuring that these OT systems are not on any internet-based network or they have to have secure networks. So that's the kind of expertise that, you know, an operator of a small system may not fully understand. And having an outside consultant who does that is critical but there a limited number of people Yeah it kind of been a common theme right So I smaller they may not have the expertise to do that So speaking of that the new regulations taking effect beginning in January 2027

We're talking about a wide range of groups, and obviously from the more sophisticated, larger utilities. A lot of these regulations are already aligned with best practices. So in that case, yes, we can certainly, you know, certainly a lot of these things are already things that you have been or should be doing already. But when we start talking about the smaller utilities, it's going to be more of a challenge because they may not be as up to date. and they may not have a full understanding, which is where the partnership with the state can really be effective for providing the guidelines that it's clear of what the expectations are. And that's also going to be going into the future. As these technologies change, clear guidance to the utilities to let them know, here's what the expectations are going to be and here are your implementation guidelines so that we're not taking steps that will be outdated by the time they actually come online or they're not going to meet the requirements. So having this understanding as far in advance as possible is going to be helpful. So thank you for that.

Again, it depends. We're dealing with a different range of how utilities operate. In talking with some of the water providers in Nassau County, our neighboring Nassau County, which there's a large number of smaller water providers in Nassau County, and they do not have any IT staff in-house. So everything is contracted out. They have outside consultants, and many of the consultants are operating for many different water districts. One of the things that is a concern is that if we see a widespread sort of attack that could affect multiple people, you've got the same contractors having to respond to multiple systems at once. So it's the, you know, just having the amount of expertise out there I think could be a real concern.

I guess the hamstrung – we're not hamstrung. in many superpowers. I guess that's my first question. Yeah, I would say I can't speak to any specific incident that but this is a concern that you know, we want to be sure that we're thinking about this for the future. Well, correct. So I think as we get as the attacks get more sophisticated, and it's not listen, it's not going to get any better. And then that's unfortunate. But as the attacks get more sophisticated, in greater frequency, we're going to need talent to do that. Certainly. And that would be the motivation to change. Yes, yes, I agree with that.

Well, thank you. I really want to say thank you to all of our panelists who were here today, but specifically to both of you right in front of us. You have shown us that there are gaps that we need to close and things that we are doing right, things that we can be doing better. things that we can look into and honestly be even more of a leading state for the rest of the nation. So thank you for that. And I appreciate your expertise on this topic. And again, thank you to each of our witnesses for their participation and their testimony today. And of course, to all our senators who joined us here, to my two co-chairs, Senator Bacher and Senator Ryan. It's been an honor to serve this public hearing, both of you. to all of our team members behind us and next to us. Thank you for all your efforts to put this public hearing together. And, of course, to all of you who provided your time, expertise, and support. We also had written testimony being presented by New York State Association of Counties, New York Conference of Mayors, and the Association of Towns. Thank you for their written testimony. And, of course, this is, again, an important step to better understand the threats that confront us, and this information will allow us to continue to lead the way. in protecting our state infrastructure, municipalities, and water resources. Again, thank you to everyone who came in today and for the apparent work that we're doing to keep New Yorkers safe. This concludes our joint hearing of the local government, Cities 1 and Cities 2 public hearing. Thank you. Thank you.