EPA Allocates $11.75 Million to Fortify Water Infrastructure Against Cyber and Climate Threats

The U.S. Environmental Protection Agency announced $11.75 million in grant funding on August 31, targeting ten midsize and large drinking-water systems for resilience upgrades against cyberattacks and extreme weather. The funding flows through the Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability grant program, awarded to public water systems serving populations of 10,000 or more.

What's funded, by component

Per the EPA release, awardees can deploy capital across four hardware-anchored tracks: SCADA and pump-control modernization, PLC replacement, backup generators, and unspecified "other resilience upgrades." Each line item maps to a documented failure mode.

PLC replacement addresses legacy controllers running unsupported firmware, a known latency and error-rate liability when patches lag disclosed CVEs. Backup generators address uptime under grid-loss conditions driven by wildfires, hurricanes, earthquakes, and flooding. The fourth bucket absorbs site-specific work: instrumentation hardening, network segmentation, physical access controls.

The grant threshold (10,000+ population served) excludes most small utilities. Midsize and large systems carry higher throughput and a larger consequence radius per outage, which is the program's implicit prioritization logic. Small-system risk is not zero; it is addressed through other channels.

Operational signals to monitor

The program competes awards through a Notice of Funding Opportunity. Federal disbursement follows legal and administrative review before funds move. Three measurable checkpoints worth tracking:

• Award announcement dates per recipient once the NOFO cycle closes.
• Specific deliverables: SCADA platform versions, PLC families being replaced, generator capacity ratings, authentication protocols deployed.
• Post-deployment metrics: error rates in pump-control loops, authentication enforcement coverage, mean time to recovery under simulated attack, unplanned outage hours per quarter.

EPA maintains parallel technical assistance channels — the Strengthening Water Infrastructure for Tomorrow (SWIFT) initiative for natural hazards, plus free cybersecurity assessments, training, and planning tools — that operate independent of grant cycles. Utilities should not gate resilience work on award timelines; the bottleneck is always administrative throughput, not capital availability.

The agency reported attacks this year against more than 100 drinking water and wastewater systems across 12 states. That figure is the baseline against which any funded upgrade program should be measured. A program that improves posture at ten systems does not, by itself, move the sector-level risk curve.