With respect to cybersecurity, some of the recommended actions include:
- Basic practices for responding to technology failures, being able to operate plants manually in times of need.
- Take basic cybersecurity steps and maintain them, such as password security including routines to change them periodically and removing credentials when employees leave or retire.
- Educate employees about cybersecurity and understand incident reporting requirements.
- Conduct training on how to spot ransomware emails.
- Hold cyber event exercises.
- Advocate for cybersecurity awareness and practices up and down and all across your water system.
We greatly encourage your utility and any associated technology resources that may be located in other agencies such as billing to take steps in these action areas. It’s important to assess the threats and vulnerabilities specific to your utility and its technology assets. After the vulnerabilities are identified and assessed for severity, it’s important to take action to close down those vulnerabilities. This is not necessarily easy, but we can connect you to resources for assistance. This threat is very serious. There have been successful cyberattacks on Colorado utilities over the last few years, including a successful ransomware attack in May 2024. At a minimum, a successful attack can create an immediate crisis at a utility that costs a great deal of time and money. But more serious problems that jeopardize drinking water quality and public health could happen too. We urge you to take steps now and into the future to both prevent attacks on your utility and be prepared to respond if an attack does occur.
Thank you.
➽ Ron Falco, P.E. Safe Drinking Water Program Manager
