Author: kylefuller

Consumer Confidence Reports (CCR)

Posted on by kylefuller

All community waterworks are required to distribute a Consumer Confidence Report (CCR) to their customers, the CCR3 supports the goal of the SDWA “right-to-know” provisions so customers can make informed decisions about their drinking water. Beginning in 2027, communities serving 10,000 or more people will be distributed more frequently and communities serving 50,000 or more people will have access to the reports on a publicly available website. CCRs will also clarify information regarding lead levels and efforts to reduce lead in drinking water.

For more information, please visit our CCR webpage here.

Iranian Affiliated Cyber Actors Threat

Posted on by kylefuller

Overview

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Environmental Protection Agency (EPA) are urgently warning U.S. organizations of ongoing cyber exploitation of internet-connected operational technology (OT) devices, including Rockwell Automation/Allen-Bradley-manufactured programmable logic controllers (PLCs), across multiple U.S. critical infrastructure sectors.

Recommended Actions

EPA recommends water and wastewater systems review the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) in this advisory for indications of current or historical activity on their networks, and apply the recommended immediate steps to prevent the attack:

  • Limit PLC exposure to the public-internet
  • Ensure PLCs are in run mode to prevent remote modification
  • Replace all default passwords on PLCs and OT with strong, unique passwords

Water systems are encouraged to review and implement the additional follow-up steps included in the advisory to further strengthen their cybersecurity posture.

Technical Assistance

If you have questions about any of the information in this alert, including assistance with the mitigation steps, submit a request to EPA’s Cybersecurity Technical Assistance Program for the Water Sector.

Report an Incident

Organizations are encouraged to report information concerning suspicious or criminal activity to FBI Internet Crime Complaint Center (IC3) at IC3.gov or to CISA via CISA’s Incident Reporting System.

Access Advisory Here

CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems – 2/25/26

Posted on by kylefuller

CISA and partners have observed malicious cyber actors targeting and compromising Cisco SD-WAN systems of organizations, globally. These actors have been observed exploiting a previously undisclosed authentication bypass vulnerability, CVE-2026-20127, for initial access before escalating privileges using CVE-2022-20775 and establishing long-term persistence in Cisco SD-WAN systems.

Click here to visit a link to the CISA alert.

Late Reporting of Monitoring Results

Posted on by kylefuller
Reminder: Waterworks are required to submit monitoring results to ODW by the 10th of the month following the month during which the sample result was received, or the 10th of the month following the end of the monitoring period, whichever is shorter. (See 12VAC5-590-530 A of the Waterworks Regulations.) Laboratory reports are considered to be reported to ODW when they are successfully received in ODW’s Safe Drinking Water Information System (SDWIS) database. Laboratories are required to report sampling results through the Compliance Monitoring Data Portal (CMDP). Other attempted methods of reporting sampling results are not valid for compliance with the Waterworks Regulations.
To help prevent waterworks from receiving a Notice of Alleged Violation from ODW for late reporting, waterworks should communicate with their laboratory about the sample collection and reporting process. This includes engaging with the laboratory about when in the monitoring period samples should be taken so they can be analyzed and reported by the laboratory through CMDP prior to the deadline in the Waterworks Regulations. Ultimately, the waterworks is responsible for timely reporting.