EPA Distributes $11.75 Million to Harden Water Infrastructure Against Cyber and Climate Threats

On August 31, 2026, the Environmental Protection Agency distributed $11.75 million across ten municipal water systems, marking the first payout from a federal grant program designed to harden utility infrastructure against a dual threat. The funding targets midsize and large drinking water systems serving at least 10,000 residents, providing capital to address vulnerabilities that range from physical climate impacts to digital intrusions.[1][3]

The allocations reflect the converging risks facing modern water infrastructure. As utilities have digitized their operations to improve efficiency, they have simultaneously expanded their exposure to cyberattacks. At the same time, aging physical assets are increasingly tested by extreme weather events, forcing municipalities to defend their systems on two entirely different fronts.[1][2][4]

The City of San Diego and the City of Bloomington, Indiana, received the largest individual awards at $2.375 million each. In San Diego, the capital will finance the replacement of programmable logic controllers—the specialized industrial computers that manage the physical processes of water treatment and distribution. Drew Kleis, San Diego's Public Utilities Director, stated that the federal investment will help the city "modernize critical control systems, strengthen our infrastructure against natural hazards and cybersecurity threats, and ensure we can continue providing safe, reliable water to our community."[1][2][3]

Bloomington's funding will similarly address both physical and digital vulnerabilities. The Indiana municipality plans to use its grant for facility upgrades, the installation of backup generators, and improvements to its Supervisory Control and Data Acquisition (SCADA) systems. SCADA networks act as the central nervous system for water utilities, allowing operators to monitor flow rates and chemical levels remotely, but they also represent a primary vector for unauthorized access if not properly secured.[3][4]

The scale of the digital threat is substantial. A 2024 review by the U.S. Government Accountability Office found that nearly 170,000 water systems across the United States face some level of cyber risk. Unlike the heavily regulated energy grid, the water sector consists of thousands of fragmented, locally managed districts that often lack the dedicated cybersecurity budgets required to defend against sophisticated actors.[4]

Physical resilience remains equally critical, particularly in regions prone to natural disasters. Denver Water secured $1.125 million to upgrade dam infrastructure, a project designed to reduce flood risk and improve operational reliability. Alan Salazar, CEO and Manager of Denver Water, noted that the funding will strengthen critical infrastructure at two key storage reservoirs, protecting source water supplies from the downstream impacts of wildfires.[1][2]

In Florida, where hurricane resilience is a persistent operational requirement, two municipalities received targeted funding. The City of Orange City was awarded $1.06 million to upgrade stormwater infrastructure and install generators, while the City of Lake City received $189,875 to modernize its pump control systems and defend against cyber threats.[1]

The financial mechanism enabling these upgrades is the Midsize and Large Drinking Water System Infrastructure Resilience and Sustainability Program. The Association of Metropolitan Water Agencies (AMWA) originally conceived the framework in 2009 as a method to help utilities prepare for climate change, later expanding the concept to encompass cybersecurity. Congress formally authorized the program in 2021, allocating $50 million annually through fiscal year 2026.[1][2][5]

The distribution of these initial grants arrives at a critical juncture for the program's future. The original five-year legislative authorization is scheduled to expire at the end of September 2026. Dan Hartnett, Interim CEO of AMWA, characterized the grants as an essential intervention, emphasizing that "whether protecting against droughts, floods, extreme storms, or cyber criminals, drinking water systems must ensure their infrastructure can withstand these threats."[2]

Legislative efforts to extend the funding are currently underway. A broader water infrastructure bill approved by the Senate Environment and Public Works Committee in July 2026 includes a proposal to reauthorize the resilience program, albeit at a slightly reduced level of $40 million annually through 2030. A separate reauthorization measure is under consideration in the House of Representatives.[2][6]

For municipal operators, the federal grants represent a shift from reactive patching to proactive system hardening. By coupling physical infrastructure upgrades with digital security enhancements, the EPA program acknowledges that a compromised SCADA system and a flooded pump station ultimately yield the same result: a disruption of essential services.[1][4]

The trajectory of utility management suggests that these dual-purpose investments will become standard operating procedure. As the September 2026 expiration date approaches, the focus now shifts to Congress and the pending reauthorization bills, which will determine whether this federal funding stream remains a permanent fixture in the effort to secure the nation's water supply.[2][6]