THE BLUF
Two consecutive weeks with no new federal advisories targeting the water sector. Let me be blunt about what that means: it means nothing good, and it means nothing bad. It means you have no excuse left for not catching up on deferred security work. The scraped data from CISA, EPA, and WaterISAC for the seven days ending today shows zero new CVEs, zero new threat actor campaigns, and zero new flash reports relevant to water and wastewater systems. The standing threat posture — nation-state pre-positioning, persistent ransomware targeting of municipal infrastructure — has not changed. What has changed is the calendar. We are now firmly inside the six-month window before the December 2026 AWIA recertification deadline for Risk and Resilience Assessments and Emergency Response Plans. If you are a medium-sized system (3,301–49,999 population), your recertified RRA is due June 30, 2026, and your updated ERP is due December 31, 2026. Do not let quiet threat weeks lull you into quiet compliance weeks. Use this time to run the drills, close the gaps, and get your documentation audit-ready before the next crisis steals every hour you have.
THREAT INTELLIGENCE
No New Water-Sector Threat Reporting Published in the Past 7 Days
A review of CISA's Cybersecurity Alerts & Advisories page, EPA's Cybersecurity for the Water Sector portal, and WaterISAC's public feed confirms no new water-sector-specific threat advisories, alerts, or incident notifications were released between May 10 and May 17, 2026.
Standing nation-state threat posture is unchanged. PRC-affiliated and Iranian-linked actors remain assessed as pre-positioned in U.S. critical infrastructure networks, including water. No new indicators of compromise (IOCs) or tactics, techniques, and procedures (TTPs) were publicly released this cycle.
Ransomware risk to water utilities remains persistent. No new named ransomware campaigns targeting the sector were publicly reported this week. That said, ransomware operators do not take weeks off — they wait for you to.
CIRCIA reminder: Under the Cyber Incident Reporting for Critical Infrastructure Act, covered entities — including water systems — are legally required to report qualifying cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. If you haven't briefed your leadership and legal counsel on these obligations, do it now, not during a breach.
EPA's free cybersecurity programs remain open and undersubscribed. The Cybersecurity Technical Assistance Program and the Cybersecurity Evaluation Program are available at no cost. Enrollment requires formal webform registration through EPA's portal — not a phone call. EPA Cybersecurity for the Water Sector
THE AUDIT-READY COMPLIANCE LOG
No New ICS Advisories or CVEs Relevant to Water Sector Published in the Past 7 Days
CISA's ICS Advisories page shows no new water-sector-relevant advisories published between May 10 and May 17, 2026. Operators should continue remediating the spring 2026 ICS advisory backlog.
AWIA Recertification — Mark Your Calendar Now:
Population 50,000–99,999: Recertified RRAs were due December 31, 2025, and updated ERPs are due June 30, 2026.
Population 3,301–49,999: Recertified RRAs are due June 30, 2026, and updated ERPs are due December 31, 2026.
If you have not started your recertification documentation, you are already behind. EPA expects updated assessments that reflect your current threat landscape — including cyber threats to OT environments. A copy-paste of your 2021 submission will not survive scrutiny.
Standing compliance actions:
Confirm all spring 2026 CISA ICS advisories have been reconciled against your OT asset inventory
Verify compensating controls remain in place for any unpatched SCADA, PLC, or HMI systems
Document every mitigation action with dates, responsible personnel, and evidence — auditors want receipts, not intentions
Subscribe to The CIP Briefing to read the rest.
Become a premium subscriber to unlock the full CYA Log, specific vulnerability mitigation steps, and the complete Action Plan.
Upgrade