From the Utility Management edition of November 5, 2026
InsideEPA: NARUC draft resolution would urge Congress to create an EPA-backed WRRO for water cybersecurity
National Association of Regulatory Utility Commissioners (NARUC) (as reported) · Water utility cybersecurity regulation and policy · United States (state utility regulators)
- Publisher
- InsideEPA / Inside Washington Publishers
- Original publication
- InsideEPA Daily News, 4 Nov 2026
- Source retrieved
- 2026-11-06
What happened
On 4 Nov 2026 InsideEPA reported that a NARUC draft resolution scheduled for approval at the 8–11 Nov 2026 annual meeting would call on Congress to create a Water Risk and Resilience Organization (WRRO) under EPA oversight to set minimum cybersecurity requirements for water systems, and to expand cybersecurity resources after federal cuts. The publicly visible teaser also links the proposal to heightened stakes from geopolitical conflict. Full article text is paywalled; the official NARUC draft PDF could not be retrieved from pubs.naruc.org during this run.
Why it matters
If adopted, a NARUC call for WRRO-style minimum cyber requirements would reshape how state commissions and municipal water utilities plan OT security investment, training eligibility and compliance evidence—directly relevant to SLED water and wastewater OT programs.
Evidence and measured results
Paywalled Independent reporting teaser dated 4 Nov 2026. Core WRRO/EPA/Nov 8–11 facts appear above the login. NARUC's public resolutions list confirms a Nov 4, 2026 4:52 PM draft packet for the annual meeting, but the PDF itself returned empty/blocked to automated fetch. Related H.R. 2594 (WRRO Establishment Act) and AWWA's Aug 2026 support letter were inspected as corroborating context, not as substitutes for the full InsideEPA article.
Limitations and uncertainty
Paywalled source; draft may change before the Board vote; teaser does not quote full resolved text; not an AI-product evaluation.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Water utilities face rising OT attacks without a clear, sector-wide minimum cyber requirement set.
- Stakeholders
- State commission staff
- Utility general manager
- OT/SCADA lead
- EPA/ primacy agency liaison
- Discovery questions
- What OT remote-access controls exist today?
- Does leadership track NARUC resolutions?
- Is there a written cyber investment roadmap?
- Value hypothesis
- A readiness assessment against likely WRRO themes can prioritise OT fixes before mandates firm up.
- Potential engagement
- Water OT baseline and WRRO/AWIA readiness workshop.
- Unsupported claims
- Resolution already adopted
- Specific control text from the draft
- Funding already appropriated
Pre-sales engineering
Role takeaway
- Fit
- Community water and wastewater systems preparing for stronger federal/state cyber expectations.
- Architecture and integration
- Inventory internet-facing PLCs/HMIs, MFA remote access, segmentation, logging—aligned to NIST water OT guidance.
- Prerequisites
- Asset inventory
- Network diagrams
- Incident-response contacts
- Constraints
- Draft status until Board vote
- Paywalled reporting detail
- Small-system capacity
- Security
- Prioritise removing exposed OT services and enforcing MFA before any AI detection add-ons.
- Proof of value
- Scored gap list vs NIST SP 1800-45 themes
- Count of internet-facing OT assets reduced
- Tabletop of remote-access compromise
Delivery
Role takeaway
- Work
- Monitor NARUC vote, map controls, brief board, sequence OT hardening.
- Dependencies
- Commission/policy updates
- OT vendor access windows
- Possible grant programs
- Ownership
- OT lead with executive sponsor.
- Skills and adoption
- Operator training on secure remote access and incident reporting.
- Governance checkpoints
- Post-vote policy brief
- Board cyber investment decision
- Annual control retest
- Acceptance criteria
- Proposed: written baseline control inventory
- Proposed: board brief within two weeks of NARUC outcome
- Proposed: remediation backlog ranked
- Risks
- Draft changes after vote prep
- Over-building to unadopted text
- Neglecting basics for AI tools
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Points utilities toward auditable minimum cyber controls (asset inventory, remote access, segmentation) rather than optional guidance; AI/OT tooling would need to map to those requirements.
Governance
Who approves, reviews and stays accountable for outcomes?
State regulator association signalling congressional action creates a near-term policy window (vote 8–11 Nov) that utilities and vendors should track before treating WRRO language as settled.
Security and privacy
What data, permissions and controls need testing?
Focus is sector-wide minimum cybersecurity requirements for water systems; details of controls are not in the teaser.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Expanded federal cyber resources and training eligibility, if enacted later, would matter most for small systems with limited OT staff.
Procurement
What should contracts, pricing and exit terms secure?
Prospective minimum requirements would affect how boards justify OT security and monitoring procurements.
Operating model
Which teams own the service once it runs?
Shifts water cyber from voluntary best practice toward potential mandatory minimums under an EPA-supervised organization.
Publication history
- 2026-11-05Utility Management · Issue 087 resources
Stable resource ID: insideepa-naruc-draft-wrro-water-cybersecurity-resolution-2026