{"resourceId":"insideepa-naruc-draft-wrro-water-cybersecurity-resolution-2026","versions":[{"version":"external-32a67e06b4ee63f9bdd4f59e2d74ce2f56ee63835b51a214951cef746c0a3c7d","resource":{"id":"insideepa-naruc-draft-wrro-water-cybersecurity-resolution-2026","title":"InsideEPA: NARUC draft resolution would urge Congress to create an EPA-backed WRRO for water cybersecurity","organization":"National Association of Regulatory Utility Commissioners (NARUC) (as reported)","sector":"Water utility cybersecurity regulation and policy","geography":"United States (state utility regulators)","publishedAt":"InsideEPA Daily News, 4 Nov 2026","publicationDate":"2026-11-04","eventDate":null,"sourceName":"InsideEPA / Inside Washington Publishers","sourceLabel":"Subscription trade news teaser","sourceUrl":"https://insideepa.com/daily-news/utility-regulators-tee-call-expand-epa-s-water-cybersecurity-authority","evidenceClass":"independent-reporting","outcomeClass":"emerging","topics":["governance-procurement","data-security","infrastructure"],"finding":"On 4 Nov 2026 InsideEPA reported that a NARUC draft resolution scheduled for approval at the 8–11 Nov 2026 annual meeting would call on Congress to create a Water Risk and Resilience Organization (WRRO) under EPA oversight to set minimum cybersecurity requirements for water systems, and to expand cybersecurity resources after federal cuts. The publicly visible teaser also links the proposal to heightened stakes from geopolitical conflict. Full article text is paywalled; the official NARUC draft PDF could not be retrieved from pubs.naruc.org during this run.","sledRelevance":"If adopted, a NARUC call for WRRO-style minimum cyber requirements would reshape how state commissions and municipal water utilities plan OT security investment, training eligibility and compliance evidence—directly relevant to SLED water and wastewater OT programs.","evidence":"Paywalled Independent reporting teaser dated 4 Nov 2026. Core WRRO/EPA/Nov 8–11 facts appear above the login. NARUC's public resolutions list confirms a Nov 4, 2026 4:52 PM draft packet for the annual meeting, but the PDF itself returned empty/blocked to automated fetch. Related H.R. 2594 (WRRO Establishment Act) and AWWA's Aug 2026 support letter were inspected as corroborating context, not as substitutes for the full InsideEPA article.","architectureImplications":"Points utilities toward auditable minimum cyber controls (asset inventory, remote access, segmentation) rather than optional guidance; AI/OT tooling would need to map to those requirements.","governanceImplications":"State regulator association signalling congressional action creates a near-term policy window (vote 8–11 Nov) that utilities and vendors should track before treating WRRO language as settled.","securityPrivacyImplications":"Focus is sector-wide minimum cybersecurity requirements for water systems; details of controls are not in the teaser.","caveats":"Paywalled source; draft may change before the Board vote; teaser does not quote full resolved text; not an AI-product evaluation.","streamIds":["utility-management"],"roles":{"sales":"Sales framing: state regulators are teeing up a call for EPA-backed minimum water cyber requirements via a WRRO. Ask water clients whether their OT baseline would meet emerging minimums and what evidence their commission expects. A bounded offer is a WRRO/AWIA readiness gap assessment. Do not claim the resolution has passed; the vote is scheduled 8–11 Nov and our full-text access was paywalled.","engineering":"Engineering framing: prepare for requirements centred on OT remote access, asset visibility and recoverable operations rather than novel AI. Map current PLC/HMI exposure, MFA, segmentation and logging to NIST SP 1800-45 patterns. Proof of value is a scored control gap list, not an AI demo.","delivery":"Delivery framing: owners are the utility CISO/OT lead and, for regulated utilities, the commission liaison. Track the NARUC vote outcome, then brief boards. Proposed acceptance criteria are a documented control baseline and a board paper on likely WRRO impacts. Risks are acting on draft language that changes, or ignoring the vote window."},"roleDetails":{"sales":{"customerProblem":"Water utilities face rising OT attacks without a clear, sector-wide minimum cyber requirement set.","stakeholders":["State commission staff","Utility general manager","OT/SCADA lead","EPA/ primacy agency liaison"],"discoveryQuestions":["What OT remote-access controls exist today?","Does leadership track NARUC resolutions?","Is there a written cyber investment roadmap?"],"valueHypothesis":"A readiness assessment against likely WRRO themes can prioritise OT fixes before mandates firm up.","potentialEngagement":"Water OT baseline and WRRO/AWIA readiness workshop.","unsupportedClaims":["Resolution already adopted","Specific control text from the draft","Funding already appropriated"]},"engineering":{"fit":"Community water and wastewater systems preparing for stronger federal/state cyber expectations.","architectureIntegration":"Inventory internet-facing PLCs/HMIs, MFA remote access, segmentation, logging—aligned to NIST water OT guidance.","prerequisites":["Asset inventory","Network diagrams","Incident-response contacts"],"constraints":["Draft status until Board vote","Paywalled reporting detail","Small-system capacity"],"security":"Prioritise removing exposed OT services and enforcing MFA before any AI detection add-ons.","proofOfValue":["Scored gap list vs NIST SP 1800-45 themes","Count of internet-facing OT assets reduced","Tabletop of remote-access compromise"]},"delivery":{"work":"Monitor NARUC vote, map controls, brief board, sequence OT hardening.","dependencies":["Commission/policy updates","OT vendor access windows","Possible grant programs"],"ownership":"OT lead with executive sponsor.","skillsAdoption":"Operator training on secure remote access and incident reporting.","governanceCheckpoints":["Post-vote policy brief","Board cyber investment decision","Annual control retest"],"acceptanceCriteria":["Proposed: written baseline control inventory","Proposed: board brief within two weeks of NARUC outcome","Proposed: remediation backlog ranked"],"risks":["Draft changes after vote prep","Over-building to unadopted text","Neglecting basics for AI tools"]}},"retrievedAt":"2026-11-05T22:08:36-06:00","enrichedAt":"2026-11-05T22:14:19-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Expanded federal cyber resources and training eligibility, if enacted later, would matter most for small systems with limited OT staff.","procurementImplications":"Prospective minimum requirements would affect how boards justify OT security and monitoring procurements.","operatingModelImplications":"Shifts water cyber from voluntary best practice toward potential mandatory minimums under an EPA-supervised organization.","sourceVerification":{"responseId":"p1.html","openedUrl":"https://insideepa.com/daily-news/utility-regulators-tee-call-expand-epa-s-water-cybersecurity-authority","referenceExcerpt":"NARUC says Congress should create a rule-setting Water Risk and Resilience Organization (WRRO) under EPA’s watch","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}