Cyber Alert: Global Conflict Potential to Impact US Critical Infrastructure

EPA Cyber Alert: Iran Conflict is Increasing the Likelihood of Low-Level Cyberattacks Against US Networks

Note: The Water Quality Control Division is posting the following information out in partnership with the Environmental Protection Agency (EPA) .

The U.S. EPA is issuing this alert to inform water and wastewater system owners and operators of the need for increased vigilance for potential cyber activity in the United States due to the current geopolitical environment. The U.S. Department of Homeland Security (DHS) published a National Terrorism Advisory System Bulletin, indicating that low-level cyberattacks against U.S. networks by pro-Iranian hacktivists are likely, and cyber actors affiliated with the Iranian Government may conduct attacks against U.S. networks. Additionally, the Cybersecurity and Infrastructure Security Agency (CISA) published a fact sheet warning that Iranian-affiliated cyber actors may target U.S. devices and networks for near-term cyber operations.

Iranian-affiliated cyber actors have demonstrated the ability to exploit operational technology (OT) devices at U.S. water and wastewater systems, forcing many systems to revert to manual operations and resulting in operational impacts.

All drinking water and wastewater systems are strongly encouraged to implement the following mitigations immediately to enhance resilience against low-level cyberattacks:

• Reduce OT Exposure to the Public-Facing Internet
• Replace All Default Passwords on OT Devices with Strong, Unique Passwords
• Implement Multifactor Authentication for Remote Access to OT Devices

In addition to these immediate actions, drinking water and wastewater systems are encouraged to adopt the actions outlined in the CISA, EPA, and FBI Top Cyber Actions for Securing Water Systems Fact Sheet to further reduce cyber risk and improve resilience against malicious cyber activity.

The U.S. EPA requests that the Water Sector Coordinating Council (WSCC)/Government

Coordinating Council (GCC) review this advisory and pass it along to all water & wastewater entities that may be susceptible to this threat. Additionally, we encourage the EPA Regions share the advisory with the state primacy agencies and direct implementation utilities.

Water and wastewater system owners and operators should direct their IT/OT system

administrators to review this alert for further use and implementation. If you rely on third party vendors for technology support, then you are encouraged to contact them to confirm their awareness of this threat. Organizations are encouraged to report information concerning suspicious or criminal activity to FBI Internet Crime Complaint Center (IC3) at IC3.gov or to CISA via CISA’s Incident Reporting System. If you have questions about any of the information contained in this document, please contact the Water Infrastructure and Cyber Resilience Division, Cybersecurity Branch at watercyberta@epa.gov.

Stay Informed

If you are interested in subscribing to receive security alert notifications immediately upon release, please sign up using this form and select the topics that interest you. This topic is General - Security updates - Water and wastewater systems.

➽ WQCD Security Workgroup

Aqua Answers: Bag and Cartridge Filters in Surface Water Treatment

Dear Aqua Answers,

I’m the operator for a surface water treatment system that uses bag and cartridge filters, and I have a few questions!

___________________________________________________________________________

Question 1: What’s the difference between compliance filters and other bag or cartridge filters at my plant?

For suppliers of surface water or groundwater under the direct influence of surface water (SW/GWUDI), the treatment system must be designed to meet the requirements of Section 11.8 of Regulation 11, also known as the Surface Water Treatment Rule (SWTR). This rule requires the treatment process to remove specific levels of Giardia and Cryptosporidium to ensure public health protection.

One way to meet these requirements is by using bag or cartridge filtration. These filters use a straining process where water passes through a disposable bag or cartridge housed in a permanently installed filter housing. Each filter and housing combination used for compliance filtration must be approved by the Colorado Department of Public Health and Environment (the Department) through the alternative technology approval process. Typically, this approval is obtained by the filter manufacturer rather than through a site-specific approval.

Every installation of bag or cartridge filters at a public water system (PWS) must also be reviewed by the Department as part of a design submittal.

Additional filters, sometimes called “roughing filters” may be installed upstream of the compliance filters. These do not require separate Department alternative technology approval but usually still require review as part of the design submittal.

For more details on design requirements, see the State of Colorado Design Criteria for Potable Water Systems (DCPWS), Section 4.3.9.

Question 2: How do I know which cartridges or bags I should use in my compliance filters?

Many SW/GWUDI suppliers have been issued a Record of Approved Waterworks (RAW) that lists all the supplier’s approved treatment and storage facilities and water sources. To find your facility’s RAW, visit the Department’s RAW webpage and enter your PWSID or facility name.

If you don’t have a RAW, you can find this information in the approval letter issued by the Department for your filtration system, or you can contact the Engineering Section for assistance.

Your RAW (or approval letter) will specify the approved filter manufacturer, model number, and the Department’s alternative technology acceptance letter. You can find the acceptance letter on our drinking water alternative technology website.

Important: Many bag and cartridge filters on the market have not been approved by the Department. Using unapproved filters or filter/housing combinations for compliance filtration can result in a treatment technique violation or a significant deficiency noted during a sanitary survey—both of which would require the supplier to issue a public notice.

Question 3: I have a sanitary survey coming up. Is there anything I should know about my bag or cartridge filters?

Yes! Suppliers using alternative filtration technology must continuously meet the design, performance, and operation and maintenance requirements in Sections 4.3.9.6 – 4.3.9.8 of the DCPWS and in the Department’s acceptance letter for the specific filtration technology.

For bag and cartridge filtration systems, this typically includes:

• Not exceeding the maximum specified pressure differential.
• Keeping daily records of pressure differentials and filter change-outs. These records will be reviewed during the sanitary survey.
• Maintaining specific spare parts on-site, which may also be checked during the survey.

Be sure to review your RAW and acceptance letter to understand all conditions of approval and ensure you’re keeping the required records. Both your RAW conditions and site-specific records will be evaluated during the sanitary survey.

Question 4: I’m a contract operator managing multiple public water systems. Do the requirements for bag and cartridge filters differ by system type?

Yes, the requirements can vary based on system size and type (e.g., community, non-community, or transient systems). These differences may include NSF 61 certification, the number of redundant filters required, and other system-specific considerations. The DCPWS outlines these requirements in detail, but if you have any questions, please reach out to the Department’s Engineering Section for assistance.

Sincerely,

Aqua Answers

Being prepared for toxic algae season

As climate conditions continue to shift, Colorado has seen increasingly warm and nutrient-rich waters during the summer months — conditions that remain ideal for toxic algae to form in standing or slow-moving water. Toxic algae or harmful algae blooms (HABs) are made up of cyanobacteria, commonly known as blue-green algae. Although these organisms naturally occur in Colorado waters, they become a problem when they multiply rapidly, resulting in a dense cyanobacteria concentration or “bloom.” In drinking water sources, cyanobacteria blooms can cause the water to taste or smell bad. Taste and odor in drinking water is not regulated but creates customer concerns about water quality and safety. Most complaints that water utilities receive are about taste and odor, and these issues can last for prolonged periods. In addition to taste and odor problems, the blooms can become harmful and create a public health risk when they produce toxins. Removing toxins in a safe and cost-effective way can be a challenge for treatment facilities, and not all water providers are equipped to do so. 

Drinking water providers can contact the Water Quality Control Division at 303-692-3500 with questions about toxic algae. We can help water providers who experience taste and odor problems and toxins. This includes ideas about customer communication and steps that utilities can take to monitor and manage toxic algae and best treat their drinking water. If you detect microcystins above 0.3 μg/L and/or cylindrospermopsin above 0.7 μg/L (EPA’s cyanotoxin health advisory values), call the CDPHE 24-hour incident reporting hotline at 1-877-518-5608 so the division can provide you with immediate assistance.

We have resources to help drinking water providers and recreational water managers with toxic algae monitoring, response and public education and created a map to show recent toxic algae conditions for select waterbodies in the state. 

This 2019 AquaTalk article remains especially relevant today as cyanotoxins still pose a public health concern, even without being formally regulated. While EPA is continuing to evaluate the need for national regulation, the core takeaways from past events like Salem, Oregon’s microcystin advisory remain vital reminders for proactive communication, monitoring, and response. Whether you manage a public drinking water system or recreate on Colorado lakes and reservoirs, this piece offers timeless lessons for navigating toxic algae season safely.

Program Manager Message: An Open Letter to the Drinking Water Community - An Opportunity to Say THANK YOU!!!!

Hello everyone, 

In the May 2008 issue of Aqua Talk we ran an open letter of thanks to the drinking water community after the waterborne disease outbreak in Alamosa, Colorado. We have not had a waterborne disease outbreak at a public water system in Colorado in the 17 years since. We thought it would be a good time to rerun this article as a reminder of what happened and how the water utility community came together in response. We have had some disease outbreaks from drinking water, but they have happened in buildings or other situations that did not involve regulated systems. The Alamosa event was the first use of the Colorado Water and Wastewater Response Network (Co-WARN), which has been used many times since 2008 by utilities in need, and those needs have been met by other utilities. So, I say again - THANK YOU!

Article from May 2008: 

In March, the Water Quality Control Division in conjunction with numerous emergency response agencies and city of Alamosa officials were deeply involved in responding to a waterborne disease outbreak within the community. While a definitive identification of the cause has not yet been determined and investigative activities are ongoing, I want to take this opportunity and use this forum to tell everyone involved...Thank you!!

The city of Alamosa and the division could not have accomplished what they did without the assistance and dedication of all the agencies, groups and individuals involved with this response. The request for resources was placed to public water systems though our COWARN network, and the response was overwhelming and immediate. As new resource needs were identified, requests were made, and the resource materialized. Events and circumstances constantly evolved, and the response of the drinking water community was unwavering.

The boil/bottled water order was in place for 23 days and had an impact on the entire community of approximately 9,000 citizens. A staggering amount of work was accomplished within those 23 days including the following:

• An evaluation of the distribution system, including a review of potential cross­ connections.
• A multi-staged systematic disinfection and flushing of the storage tanks and entire 49 miles of distribution piping.
• Extensive monitoring for a number of water quality parameters throughout the distribution system including Salmonella, total coliform, Giardia, cryptosporidium, arsenic, lead and copper, and chlorine residuals.
• The Consumer Protection Division worked with restaurants and other businesses to keep many of them operating during the event.
• Bottled water and bulk water was distributed to residents.
• Communications personnel made substantial public notice efforts with the media to keep people informed.

The drinking water community should be proud of its response.

➽Ron Falco, P.E. Safe Drinking Water Program Manager

Coaches Classroom: How to Take a Water/Wastewater Operator Certification Exam?

Did you know that to become certified as a water/wastewater professional in Colorado or to take an exam to obtain a higher certification, you will work with a company called Professional Service Industry (PSI)?

As mentioned in previous Aqua Talk articles (4/2/25 article, 10/30/24 article), to become a certified water professional, you will first determine which certification you need and then work within the Colorado Certified Water Professionals (CCWP) portal to submit an examination application. Once CCWP approves the exam application, applicants have 100 days to sit for and pass the exam. If an applicant doesn’t pass the exam, they may schedule a re-test at any time, however, the operator must wait 30 days to retake the exam.

Notes on working within PSI’s website

After you receive your application approval from the folks at CCWP, you will receive an email from PSI letting you know that you can now create a login and schedule your exam. You can follow the link and instructions provided in the email. Once you have logged in, select “New Booking” if you need to schedule your exam or “Reschedule” if you need to move the date you originally planned to sit for the exam. 

This will take you to a list of tests you are eligible to schedule based on your exam application through CCWP. 

What if I have issues with my PSI account? 

PSI customer service is best accessed through their “Contact Us” email form. To access this, click on the “Contact Us” icon in the upper right-hand corner of the screen. Be sure to provide the correct email address and phone number for them to reach you and a clear explanation of the issue you are encountering.  You can also visit their Quick Start Guide website, which offers specific information on how to navigate their platform. 

Additional tips and good information: 

• Where/how do I take an exam: You can either go to a testing center (Find a Testing Center) or use PSI’s remote proctoring option (PSI Online Proctoring Compatibility Check) to take your certification exam. Be sure to know the rules and expectations before you choose which option is best for you. More information can be found on CCWP’s website or in PSI’s Candidate Handbook for Colorado. 
• Plan accordingly! Winter weather can greatly impact travel to test centers, and PSI may not issue refunds due to inclement weather. Consider contacting PSI to verify your test center is open before you travel. 
• The CCWP exam application fee is $50; the PSI examination fee is $104 per exam attempt. All payment for the exams is managed through the PSI portal. 
• Formula sheets - Please note there are two formula sheets, one for water and one for wastewater. It's the test-taker’s responsibility to be sure that the proctor gives them the correct formula sheet.
• Test takers cannot leave the testing site with notes or scratch paper.
• CCWP is happy to help all operators as they become certified and advance in their profession. However, the CCWP staff does not have access to PSI's system nor can we help with remotely proctored tech support.

What resources are available to help me study for my exam? 

PSI does a great job at proctoring exams for Colorado’s certified water professionals, but they don’t provide the testing materials. CCWP contracts with Water Professionals International (WPI) to write and standardize exams. So, to study, we recommend visiting WPI’s  Examination Study Resources website. Here you can  access important information that will help you plan your studying process: 

• Need-to-Know Criteria
• Formula/Conversion Tables
• Exam References
• Study Guides
• Sample Exam Questions

Once you know what information you need to study and how the questions will be asked, you can form a study plan that is right for you! Below are some examples of helpful resources. This is by no means an exhaustive list. We recommend that you mix a variety of study materials! 

1. Textbooks 
• Sacramento State Drinking Water Manuals
• New Mexico Water System Operator Certification Study Manual
• American Water Works Association - Operator Cert and Training Textbooks 
• USA Bluebook Water/Wastewater Training Books (textbooks, flash cards, and math-specific offerings)  
2. Courses 
• Technical Assistance providers in Colorado that offer in-person and online exam preparation: 
• Colorado Rural Water Association 
• Indigo Water Group 
• Rural Communities Assistance Corporation 
• Other prep courses 
• American Water College Exam Prep courses 
• AWWA Remote eLearning Options
3. Other resources 
• Water Sifu - online training resources with videos and podcast-style training
• AWWA OpCert Exam Prep App  - flashcard style sample test questions that immediately display the correct answers and explanations, including formulas/equations 
• Water Wise Pro - Company offering online training via Zoom,  study guides, and helpful podcasts for operators  
• Kentucky Energy and Environment Cabinet - Water Certification Test Prep Materials 
• Michigan Department of Environment, Great Lakes, and Energy - Exam Study Guides with practice tests and answer keys 

Please don't ever hesitate to reach out to our coaches! 

➽ Kyra Gregory, Drinking Water Training Specialist 

PFAS Rule and CCR Revisions: Update on Stakeholder Engagement on Rulemaking

In Spring 2024, EPA finalized the Per- and Polyfluoroalkyl Substances (PFAS) Rule and Consumer Confidence Report (CCR) Rule Revisions. The PFAs Rule will protect public health by requiring ongoing monitoring of “forever chemicals” beginning in 2027 and setting health-based limits starting in 2029. The CCR Rule Revisions modernize the content and delivery methods for all community systems and increases the frequency and accessibility of water quality reports for consumers served by larger systems beginning in 2027. 

In August 2024, the division launched a stakeholder engagement process in support of a rulemaking hearing before the Water Quality Control Commission to adopt these federal rules into the Colorado Primary Drinking Water Regulations (Regulation 11). Between August 2024 and January 2025, we held a total of seven stakeholder meetings and two workgroup meetings in support of the stakeholder process. We appreciate the significant contributions from water providers, environmental organizations, and members of the public. This collaboration is essential for developing effective and sustainable regulations that address the specific needs of our state.

Through the stakeholder process, we have:

• Developed Draft Regulatory Language: The feedback received from stakeholders has directly informed the development of draft language for the upcoming PFAS Rule and CCR Rule Revisions. 
• Created PFAS Rule Resources: To aid water providers in navigating the complex requirements, we have developed a PFAS Rule page with guidance and a frequently asked questions document, an initial monitoring compliance check worksheet to help understand the timing requirements for monitoring, and are in the process of developing tools to allow submission of UCMR 5 PFAS data for use in meeting initial monitoring requirements.
• Updated CCR Content: While most content changes under the CCR Rule Revisions are not required until 2027, there are a few changes to CCRs distributed in 2025 required under the Lead and Copper Rule Revisions. The division has updated CCR draft templates for 2025 to capture the language and content required to be included in CCRs.

Looking ahead, the next major milestone is the rulemaking process before the commission. This is a crucial stage where the commission will review the draft regulations, consider public input, and ultimately make a decision on whether to adopt these rules into Regulation 11.

Important Note: There has been some recent developments at the federal level. EPA has been granted abeyances by the DC Circuit Court concerning lawsuits regarding the federal PFAS Rule. These abeyances were granted to allow the new administration time to review the rule and the plaintiff’s petition to the Court. On May 14, 2025, EPA announced that it was considering delaying compliance with the PFAS standards but no specific mention was made about the testing requirements. We are actively monitoring this situation and will provide updates as they become available. None of this impacts the CCR rule. 

We recognize that navigating these regulations can be complex. Therefore, we are committed to keeping you informed throughout the process. We will provide updates on the rulemaking process and opportunities for public comment.

How to Stay Informed:

• Visit the Division's Engagement Website and sign up for notifications
• Attend Commission Meetings: Commission meetings are open to the public, and your participation is encouraged. For more information about upcoming meetings and hearings please visit the commission's website.

We believe that everyone plays a vital role in shaping water policy. By staying engaged, we can collectively work towards ensuring clean and safe drinking water for all Coloradans.

➽ Bryan Pilson Technical, Regulatory Implementation, and Coordination Unit Manager

CDPHE, EPA, & Wigwam Partnership for PFAS Treatment

Resources: 

For more information please visit 

• CDPHE PFAS Proarjects Website
• WQCD Grant Website

The Colorado Department of Public Health and Environment (CDPHE) is excited to highlight Wigwam Mutual Water Company’s PFAS pilot project as an excellent example of the Division’s culture of health initiatives. Wigwam is a small public water system, located in El Paso, County just south of Colorado Springs, that serves approximately 1,300 people. Their source water is drawn from the Fountain Creek alluvial aquifer and through pro-active testing the public water system detected elevated levels of certain PFAS in its drinking water. The test results came back above the established EPA Maximum Contaminant Level (MCL) of 4.0 parts per trillion (ppt) for Perfluorooctanoic acid (PFOA) and perfluorooctanesulfonic acid (PFOS). To address this emerging contaminant issue, CDPHE provided the community with point-of-use treatment to reduce PFAS levels to below the MCL while working towards the implementation of a more permanent treatment solution. This effort was promoted to ensure the community was provided with safe drinking water during the next planning and design phases of the project. 

Last year, CDPHE awarded Wigwam a $300,000 grant to pilot PFAS treatment technologies through the Emerging Contaminants in Small for Disadvantaged Communities (EC/SDC) grant program. This project has been a collaborative approach with direct assistance from the CDPHE, PFAS team and Engineering staff, the Environmental Protection Agency (EPA), and the EPA’s Office of Research and Development (ORD). Wigwam is planning to conduct pilot testing with Granulated Activated Carbon (GAC), Anion Exchange (AIX), and a new emerging technology, namely Electrocoagulation (EC). This innovative pilot project will compare the different treatment technologies and assist Wigwam in determining if the new EC technology is feasible and able to effectively treat PFAS in its drinking water. This collaborative approach will help ensure that this community has the best information to help them find a viable treatment solution to address this water quality challenge. After the study, EPA and CDPHE will utilize the treatment piloting results to provide an assessment of the treatment options for communities in order to effectively remove PFAS and other contaminants with reasonable and sustainable costs. 

CDPHE is excited to promote the partnership between EPA ORD and Wigwam to assist in this effort.

➽ Sierra Mitchell, PFAS Program Coordinator