Author: kylefuller

Consumer Confidence Reports (CCR)

Posted on by kylefuller

Community waterworks must distribute an annual drinking water quality report, known as the CCR, to their customers and to the Office of Drinking Water, by July 1st each year.  Updated guidance on optional electronic delivery can be found in the CCR Electronic Delivery Guidelines and updated guidance on CCR Preparation can be found in the Preparation Guidelines.  The Office of Drinking Water will review draft CCRs sent to field offices before May 1.

The deadline for wholesalers to provide their CCR information to their consecutive waterworks is April 1st each year.

Each Community Waterworks must certify to the Office of Drinking Water how and when the CCR was distributed.  Certifications must be submitted to the Office of Drinking Water by October 1st each year.  Here is the link to the CCR certification form

For more information, visit our CCR webpage here.

Joint Cybersecurity Advisory: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure to Cause Disruption

Posted on by kylefuller

Overview

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Environmental Protection Agency (EPA) are urgently warning U.S. organizations of ongoing cyber exploitation of internet-connected operational technology (OT) devices, including Rockwell Automation/Allen-Bradley-manufactured programmable logic controllers (PLCs), across multiple U.S. critical infrastructure sectors.

Recommended Actions

EPA recommends water and wastewater systems review the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) in this advisory for indications of current or historical activity on their networks, and apply the recommended immediate steps to prevent the attack:

  • Limit PLC exposure to the public-internet
  • Ensure PLCs are in run mode to prevent remote modification
  • Replace all default passwords on PLCs and OT with strong, unique passwords

Water systems are encouraged to review and implement the additional follow-up steps included in the advisory to further strengthen their cybersecurity posture.

Technical Assistance

If you have questions about any of the information in this alert, including assistance with the mitigation steps, submit a request to EPA’s Cybersecurity Technical Assistance Program for the Water Sector.

Report an Incident

Organizations are encouraged to report information concerning suspicious or criminal activity to FBI Internet Crime Complaint Center (IC3) at IC3.gov or to CISA via CISA’s Incident Reporting System.

Access Advisory Here

CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems – 2/25/26

Posted on by kylefuller

CISA and partners have observed malicious cyber actors targeting and compromising Cisco SD-WAN systems of organizations, globally. These actors have been observed exploiting a previously undisclosed authentication bypass vulnerability, CVE-2026-20127, for initial access before escalating privileges using CVE-2022-20775 and establishing long-term persistence in Cisco SD-WAN systems.

Click here to visit a link to the CISA alert.

Late Reporting of Monitoring Results

Posted on by kylefuller
Reminder: Waterworks are required to submit monitoring results to ODW by the 10th of the month following the month during which the sample result was received, or the 10th of the month following the end of the monitoring period, whichever is shorter. (See 12VAC5-590-530 A of the Waterworks Regulations.) Laboratory reports are considered to be reported to ODW when they are successfully received in ODW’s Safe Drinking Water Information System (SDWIS) database. Laboratories are required to report sampling results through the Compliance Monitoring Data Portal (CMDP). Other attempted methods of reporting sampling results are not valid for compliance with the Waterworks Regulations.
To help prevent waterworks from receiving a Notice of Alleged Violation from ODW for late reporting, waterworks should communicate with their laboratory about the sample collection and reporting process. This includes engaging with the laboratory about when in the monitoring period samples should be taken so they can be analyzed and reported by the laboratory through CMDP prior to the deadline in the Waterworks Regulations. Ultimately, the waterworks is responsible for timely reporting.