The Rhode Island Department of Environmental Management (DEM) is updating and modernizing its Rules and Regulations for the Operation and Maintenance of Wastewater Treatment Facilities to incorporate cybersecurity and resiliency into wastewater treatment facility operations and maintenance.
The amended regulation clarifies what constitutes a substantial cybersecurity incident, requiring both a risk management and an emergency response plan. The risk management plan must outline actions taken to manage the risk of substantial cyber incidents and identify a Risk & Resiliency Coordinator. The emergency response plan will include procedures and reporting requirements in the event of cyber incidents.
These updates, together with proposed cybersecurity planning language in several draft Rhode Island Pollution Discharge Elimination System (RIPDES) permits, aim to strengthen cyber resilience at wastewater treatment facilities in the state. The RIPDES permits are currently in public comment period.
DEM is also updating its website with cybersecurity resources and guidance for wastewater treatment facilities.
