{"resourceId":"naruc-2026-annual-wc1-water-cyber-ex1-saferai-passed-committees","versions":[{"version":"external-7e932d4bae7c3053a4149360ca31669fca15668c51f34b00cc05a950b980de0f","resource":{"id":"naruc-2026-annual-wc1-water-cyber-ex1-saferai-passed-committees","title":"NARUC water-cybersecurity resolution (WC-1) and EPRI SAFERai.power AI-governance resolution (EX-1) clear committees; Board vote set for 11 Nov","organization":"National Association of Regulatory Utility Commissioners (NARUC)","sector":"State utility regulation: water/wastewater cybersecurity and electric-utility AI governance","geography":"United States (all state commissions); meeting in San Juan, Puerto Rico","publishedAt":"2026-11-10 (5:00 PM version of the committee-passed resolutions packet)","publicationDate":"2026-11-10","eventDate":"2026-11-09","sourceName":"NARUC resolutions packet (PDF)","sourceLabel":"Resolutions passed by the standing committees and submitted for NARUC Board consideration","sourceUrl":"https://pubs.naruc.org/pub/CB4F9BA2-A3B4-4337-90D3-45DBEC8A8748","evidenceClass":"public-sector-association","outcomeClass":"emerging","topics":["governance-procurement","data-security","infrastructure"],"finding":"NARUC's 10 Nov packet lists resolutions that passed the standing committees at the 2026 Annual Meeting. WC-1 (water cybersecurity), sponsored by Commissioner Bange, was sponsored by the Committee on Water on 9 Nov. It supports minimum cybersecurity requirements for all drinking water and wastewater operators while preserving state authority. It urges Congress to reauthorize and fund CISA, to require utilities to share cyber-attack information exempt from FOIA, and to authorize an EPA-created, non-governmental Water Risk and Resilience Organization (WRRO) to set minimum requirements. Its findings: about 50,000 community water systems, only 11% under commission jurisdiction; attacks on utilities in at least 12 states in July–August 2026; CISA has lost about a third of its staff since 2025 and stopped six free assessments in September 2026. EX-1, passed by the Executive Committee on 8 Nov, commends EPRI's SAFERai.power initiative (risk framework, assessment protocols, playbooks, toolkit) and supports state-regulator participation. The Board adoption lines are still blank; the Board meets 11 Nov.","sledRelevance":"Follow-up to the archived 3 Nov draft: both resolutions have now cleared committee and go to the Board. If adopted, state regulators formally back minimum water-cyber requirements and an EPRI-led approach to assessing utility AI by consequence and autonomy. Utilities and their partners should expect commissions to ask about both.","evidence":"Primary association document. The figures (50,000 systems, 11%, 12 states, CISA staffing) are the resolution's own findings, not separately sourced in the text. No vote count. Packet says resolutions are not NARUC policy until the Board passes them and may change.","architectureImplications":"A WRRO standard would likely set baseline OT controls (segmentation, credentials, monitoring) for water systems that are not regulated by commissions today. SAFERai.power's consequence-and-autonomy scoring implies utilities should document where each AI tool sits between advisory and control.","governanceImplications":"Commissions are positioning to oversee utility AI through a common industry framework rather than bespoke rules, and to push water-cyber minimums through a federal, sector-expert body.","securityPrivacyImplications":"Mandatory, FOIA-exempt sharing of attack information would change disclosure practice for public utilities subject to state open-records laws; the loss of free CISA assessments shifts cost to utilities.","caveats":"Not yet adopted; text could change at the Board. NARUC resolutions are advocacy and carry no regulatory force. WC-1 addresses Congress; EX-1 concerns electric utilities only.","streamIds":["utility-management"],"roles":{"sales":"Sales framing: state regulators are about to formalise two asks that land on utility leaders: minimum cybersecurity for every water system, and a structured way to judge AI by consequence and autonomy. Until the Board votes on 11 Nov these are positions, not rules. A bounded offer is a readiness review: map current water-cyber controls against likely minimums and inventory AI tools against SAFERai-style risk criteria, so commission questions can be answered from evidence rather than assurances.","engineering":"Engineering framing: treat WC-1 as a signal that baseline OT controls will become expected, not optional, for water systems: asset inventory, segmentation, removal of internet-exposed PLCs, credential management and logging. For electric utilities, EX-1 points to recording each AI use case's operational context, consequence and autonomy level. Neither resolution specifies technical controls, so any mapping is interpretation and should be revisited once EPRI publishes its assessment tools.","delivery":"Delivery framing: run a short gap assessment for water-cyber basics and an AI use-case register for electric operations, each owned by a named executive. Proposed acceptance criteria are a complete OT asset list, documented remediation priorities, and every AI tool recorded with owner, autonomy level and override. Watch the 11 Nov Board outcome and adjust scope if text changes. Budget for assessments that CISA no longer provides free."},"roleDetails":{"sales":{"customerProblem":"Utilities face rising regulator expectations on water cybersecurity and AI governance without settled rules or free federal assessments.","stakeholders":["Utility CEO/general manager","State commission staff","OT security lead","Chief information officer","Water system operators"],"discoveryQuestions":["Which of your water systems fall under commission jurisdiction?","Which CISA assessments did you rely on before September 2026?","Do you maintain an inventory of AI tools with autonomy and consequence ratings?","Who would answer a commission data request on cyber posture today?"],"valueHypothesis":"A readiness review could shorten response time to commission inquiries and identify the highest-priority control gaps before any minimum standard is set.","potentialEngagement":"Four-to-six-week water-cyber baseline and AI use-case register aligned to WC-1 and EX-1 themes.","unsupportedClaims":["That NARUC has adopted either resolution (Board vote pending at time of inspection)","That a WRRO or minimum standard exists or has a timeline","That SAFERai.power tools are published or validated"]},"engineering":{"fit":"Commission-regulated water and electric utilities, and municipal systems likely to face future federal minimums.","architectureIntegration":"Map OT asset inventory and network segmentation to likely baseline controls; link AI register entries to systems of record and control points.","prerequisites":["OT asset inventory","Network diagrams","List of AI tools in use"],"constraints":["Resolution text non-binding and subject to change","EX-1 covers electric utilities only","State open-records laws may conflict with proposed FOIA exemption"],"security":"Prioritise removal of internet-exposed controllers and default credentials, the attack pattern cited in the 12-state incidents.","proofOfValue":["Gap list traced to specific resolution findings","AI register reviewed by an operator for accuracy","Re-check scope after the Board vote"]},"delivery":{"work":"Baseline water-cyber controls and build an AI use-case register with autonomy and consequence ratings.","dependencies":["Board outcome on 11 Nov","EPRI SAFERai.power materials","Utility OT and IT staff time"],"ownership":"Utility executive for compliance with OT security lead.","skillsAdoption":"Brief commission liaisons and operators on what the resolutions ask and do not ask.","governanceCheckpoints":["Confirm adopted text after Board vote","Executive sign-off on remediation priorities","Legal review of disclosure implications"],"acceptanceCriteria":["100% of OT assets inventoried","All AI tools registered with owner and override","Remediation plan approved by leadership"],"risks":["Text changes at Board","Over-investing before standards exist","Records-law conflicts"]}},"retrievedAt":"2026-11-10T21:57:00.067885-06:00","enrichedAt":"2026-11-10T22:03:27.938369-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Small water systems lacking staff are the stated concern; the end of free CISA assessments increases dependence on state programmes and WaterISAC.","procurementImplications":"Utilities may need to budget for assessments that CISA used to provide at no charge.","operatingModelImplications":"Regulated water and electric utilities should prepare to report cyber posture and AI risk assessments to commissions in a common format.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://pubs.naruc.org/pub/CB4F9BA2-A3B4-4337-90D3-45DBEC8A8748","referenceExcerpt":"Sponsored by the Committee on Water on November 9, 2026.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}