From the Utility Management edition of November 10, 2026
NARUC water-cybersecurity resolution (WC-1) and EPRI SAFERai.power AI-governance resolution (EX-1) clear committees; Board vote set for 11 Nov
National Association of Regulatory Utility Commissioners (NARUC) · State utility regulation: water/wastewater cybersecurity and electric-utility AI governance · United States (all state commissions); meeting in San Juan, Puerto Rico
- Publisher
- NARUC resolutions packet (PDF)
- Original publication
- 2026-11-10 (5:00 PM version of the committee-passed resolutions packet)
- Source retrieved
- 2026-11-11
- Event date
- 2026-11-09
What happened
NARUC's 10 Nov packet lists resolutions that passed the standing committees at the 2026 Annual Meeting. WC-1 (water cybersecurity), sponsored by Commissioner Bange, was sponsored by the Committee on Water on 9 Nov. It supports minimum cybersecurity requirements for all drinking water and wastewater operators while preserving state authority. It urges Congress to reauthorize and fund CISA, to require utilities to share cyber-attack information exempt from FOIA, and to authorize an EPA-created, non-governmental Water Risk and Resilience Organization (WRRO) to set minimum requirements. Its findings: about 50,000 community water systems, only 11% under commission jurisdiction; attacks on utilities in at least 12 states in July–August 2026; CISA has lost about a third of its staff since 2025 and stopped six free assessments in September 2026. EX-1, passed by the Executive Committee on 8 Nov, commends EPRI's SAFERai.power initiative (risk framework, assessment protocols, playbooks, toolkit) and supports state-regulator participation. The Board adoption lines are still blank; the Board meets 11 Nov.
Why it matters
Follow-up to the archived 3 Nov draft: both resolutions have now cleared committee and go to the Board. If adopted, state regulators formally back minimum water-cyber requirements and an EPRI-led approach to assessing utility AI by consequence and autonomy. Utilities and their partners should expect commissions to ask about both.
Evidence and measured results
Primary association document. The figures (50,000 systems, 11%, 12 states, CISA staffing) are the resolution's own findings, not separately sourced in the text. No vote count. Packet says resolutions are not NARUC policy until the Board passes them and may change.
Limitations and uncertainty
Not yet adopted; text could change at the Board. NARUC resolutions are advocacy and carry no regulatory force. WC-1 addresses Congress; EX-1 concerns electric utilities only.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-10; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Utilities face rising regulator expectations on water cybersecurity and AI governance without settled rules or free federal assessments.
- Stakeholders
- Utility CEO/general manager
- State commission staff
- OT security lead
- Chief information officer
- Water system operators
- Discovery questions
- Which of your water systems fall under commission jurisdiction?
- Which CISA assessments did you rely on before September 2026?
- Do you maintain an inventory of AI tools with autonomy and consequence ratings?
- Who would answer a commission data request on cyber posture today?
- Value hypothesis
- A readiness review could shorten response time to commission inquiries and identify the highest-priority control gaps before any minimum standard is set.
- Potential engagement
- Four-to-six-week water-cyber baseline and AI use-case register aligned to WC-1 and EX-1 themes.
- Unsupported claims
- That NARUC has adopted either resolution (Board vote pending at time of inspection)
- That a WRRO or minimum standard exists or has a timeline
- That SAFERai.power tools are published or validated
Pre-sales engineering
Role takeaway
- Fit
- Commission-regulated water and electric utilities, and municipal systems likely to face future federal minimums.
- Architecture and integration
- Map OT asset inventory and network segmentation to likely baseline controls; link AI register entries to systems of record and control points.
- Prerequisites
- OT asset inventory
- Network diagrams
- List of AI tools in use
- Constraints
- Resolution text non-binding and subject to change
- EX-1 covers electric utilities only
- State open-records laws may conflict with proposed FOIA exemption
- Security
- Prioritise removal of internet-exposed controllers and default credentials, the attack pattern cited in the 12-state incidents.
- Proof of value
- Gap list traced to specific resolution findings
- AI register reviewed by an operator for accuracy
- Re-check scope after the Board vote
Delivery
Role takeaway
- Work
- Baseline water-cyber controls and build an AI use-case register with autonomy and consequence ratings.
- Dependencies
- Board outcome on 11 Nov
- EPRI SAFERai.power materials
- Utility OT and IT staff time
- Ownership
- Utility executive for compliance with OT security lead.
- Skills and adoption
- Brief commission liaisons and operators on what the resolutions ask and do not ask.
- Governance checkpoints
- Confirm adopted text after Board vote
- Executive sign-off on remediation priorities
- Legal review of disclosure implications
- Acceptance criteria
- 100% of OT assets inventoried
- All AI tools registered with owner and override
- Remediation plan approved by leadership
- Risks
- Text changes at Board
- Over-investing before standards exist
- Records-law conflicts
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
A WRRO standard would likely set baseline OT controls (segmentation, credentials, monitoring) for water systems that are not regulated by commissions today. SAFERai.power's consequence-and-autonomy scoring implies utilities should document where each AI tool sits between advisory and control.
Governance
Who approves, reviews and stays accountable for outcomes?
Commissions are positioning to oversee utility AI through a common industry framework rather than bespoke rules, and to push water-cyber minimums through a federal, sector-expert body.
Security and privacy
What data, permissions and controls need testing?
Mandatory, FOIA-exempt sharing of attack information would change disclosure practice for public utilities subject to state open-records laws; the loss of free CISA assessments shifts cost to utilities.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Small water systems lacking staff are the stated concern; the end of free CISA assessments increases dependence on state programmes and WaterISAC.
Procurement
What should contracts, pricing and exit terms secure?
Utilities may need to budget for assessments that CISA used to provide at no charge.
Operating model
Which teams own the service once it runs?
Regulated water and electric utilities should prepare to report cyber posture and AI risk assessments to commissions in a common format.
Publication history
- 2026-11-10Utility Management · Issue 126 resources
Stable resource ID: naruc-2026-annual-wc1-water-cyber-ex1-saferai-passed-committees