Author: kylefuller

Consumer Confidence Reports (CCR)

Posted on by kylefuller

Community waterworks must distribute an annual drinking water quality report, known as the CCR, to their customers and to the Office of Drinking Water, by July 1st each year.  Updated guidance on optional electronic delivery can be found in the CCR Electronic Delivery Guidelines and updated guidance on CCR Preparation can be found in the Preparation Guidelines.  The Office of Drinking Water will review draft CCRs sent to field offices before May 1.

The deadline for wholesalers to provide their CCR information to their consecutive waterworks is April 1st each year.

Each Community Waterworks must certify to the Office of Drinking Water how and when the CCR was distributed.  Certifications must be submitted to the Office of Drinking Water by October 1st each year.  Here is the link to the CCR certification form

For more information, visit our CCR webpage here.

ALERT from EPA: U.S. Water Systems should Strengthen Cybersecurity in light of Middle East Activity

Posted on by kylefuller

The U.S. Environmental Protection Agency (EPA) is issuing this alert to encourage water system owners and operators across the country to take deliberate and meaningful steps to strengthen cybersecurity in light of activities in the middle east and the potential for U.S. critical infrastructure to be targeted. Iranian government–affiliated and aligned cyber actors have previously demonstrated the ability to exploit internet‑exposed operational technology devices at U.S. water and wastewater systems, in some cases forcing temporary reversion to manual operations and causing operational impacts. EPA urges utilities to adopt a heightened security posture and promptly report suspicious activity to CISA and the FBI.

Mitigations

All drinking water and wastewater systems are strongly encouraged to implement the following mitigations immediately to enhance resilience against low-level cyberattacks:

  • Reduce Operational Technology Exposure to the Public-Facing Internet
  • Replace All Default Passwords on Operational Technology Devices with Strong, Unique Passwords
  • Implement Multifactor Authentication for Remote Access to Operational Technology Devices

Systems that outsource technology support may need to consult with their service providers for assistance with these mitigations.

In addition to these immediate actions, drinking water and wastewater systems are encouraged to adopt the actions outlined in the CISA, EPA, and FBI Top Cyber Actions for Securing Water Systems Fact Sheet to further reduce cyber risk and improve resilience against malicious cyber activity.

 

 

CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems – 2/25/26

Posted on by kylefuller

CISA and partners have observed malicious cyber actors targeting and compromising Cisco SD-WAN systems of organizations, globally. These actors have been observed exploiting a previously undisclosed authentication bypass vulnerability, CVE-2026-20127, for initial access before escalating privileges using CVE-2022-20775 and establishing long-term persistence in Cisco SD-WAN systems.

Click here to visit a link to the CISA alert.

Late Reporting of Monitoring Results

Posted on by kylefuller
Reminder: Waterworks are required to submit monitoring results to ODW by the 10th of the month following the month during which the sample result was received, or the 10th of the month following the end of the monitoring period, whichever is shorter. (See 12VAC5-590-530 A of the Waterworks Regulations.) Laboratory reports are considered to be reported to ODW when they are successfully received in ODW’s Safe Drinking Water Information System (SDWIS) database. Laboratories are required to report sampling results through the Compliance Monitoring Data Portal (CMDP). Other attempted methods of reporting sampling results are not valid for compliance with the Waterworks Regulations.
To help prevent waterworks from receiving a Notice of Alleged Violation from ODW for late reporting, waterworks should communicate with their laboratory about the sample collection and reporting process. This includes engaging with the laboratory about when in the monitoring period samples should be taken so they can be analyzed and reported by the laboratory through CMDP prior to the deadline in the Waterworks Regulations. Ultimately, the waterworks is responsible for timely reporting.