The Grant Program Built to Secure Drinking Water From Hackers Has Never Been Funded

A water utility runs on operational technology most residents never think about: pumps, valves, and dosing systems, often reachable over the same internet connection as the front-office email.▸ In May 2024, EPA's enforcement alert put a number on how exposed that machinery is: more than 70% of the systems it had inspected since September 2023 were violating basic federal cybersecurity and resilience rules — default passwords never changed, shared logins, no plan for cutting off a former employee's access. Congress had already tried to fix this with money. Two grant programs, built for exactly this problem, still haven't been funded.

The Infrastructure Investment and Jobs Act added two Safe Drinking Water Act provisions in 2021 built specifically around this problem.▸ Section 1459F authorizes $50 million a year, FY2022 through FY2026, for grants to water systems serving 10,000 or more people to reduce cybersecurity vulnerabilities and improve resilience to natural hazards. Section 1459G authorizes $10 million a year over the same window for a companion technology program open to smaller and disadvantaged systems. Together that's $60 million a year, five years running, aimed at exactly the gap the EPA's own inspectors kept finding. Per the Congressional Research Service's June 2025 report, "Congress has not provided appropriations for this program" — for either one. Not partial funding, not a smaller pilot: zero dollars, for both programs, in every year they've existed.

Two months after CRS published that finding, EPA announced $9 million available under a different program — the Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability grant — covering both natural-hazard and cybersecurity resilience projects.▸ It is real money, but it isn't described by EPA as funding either SDWA provision Congress built for this, and it carries the same population floor as §1459F: systems serving fewer than 10,000 people don't qualify. Per that same CRS report, 80.6% of the nation's roughly 49,500 community water systems serve 3,300 people or fewer — the systems with the least capacity to hire a security specialist on their own are also the ones locked out of both the authorized-but-unfunded grant and the one pot of cyber money that actually went out the door.

Money isn't the only constraint.▸ In 2024, the Cyber Readiness Institute (CRI), with the Foundation for Defense of Democracies' Center on Cyber and Technology Innovation and sponsorship from Microsoft, launched a pilot to find out whether free cybersecurity coaching could move the needle where grant dollars hadn't. CRI and CCTI staff pitched the program — at no cost to utilities — to more than 1,000 water and wastewater systems through conferences, webinars, and phone calls.

Of the more than 1,000 utilities contacted, 113 formally expressed interest, 72 actually began the program, and only 43 completed it — 38% of everyone who'd said yes, per Microsoft.▸ The dropout wasn't about cost; the program was free. It also wasn't evenly distributed: utilities paired with a free, CRI-certified cyber coach finished at more than triple the rate of those left to work through the material alone — 77% versus 23%, Cybersecurity Dive reported of Microsoft's fuller results. Utilities that did complete the program still had to train their own staff — 551 employees nationwide ended up certified — and the ones who finished told researchers what got in the way for the ones who didn't: "limited staff time and capacity." As Jennifer Lyn Walker, director of infrastructure cyber defense at the Water Information Sharing and Analysis Center, put it, the results show utilities "were ready, willing, and able to make the necessary time and effort to work toward securing their utilities" — when someone showed up to help them do it. Free training alone wasn't that help; a coach, in person, was.

Figures in this piece come from three independent chains: a Congressional Research Service legislative analysis (grant authorizations and appropriations), a direct EPA enforcement alert and grant announcement (inspection and funding figures), and Microsoft's own reporting on a CRI-run pilot, cross-checked against Cybersecurity Dive's independent coverage of the same results (participation and completion figures). None of the three measures the same thing, and they aren't meant to be summed — each is cited to the document that actually contains it.