Virginia is implementing a new law to increase transparency and communication between water systems and the Virginia Department of Health (DOH). The Virginia Legislature enacted SB 1408, also known as HB 2749, in April 2025 which became effective in July.
The law mandates that waterworks systems report critical equipment failures, malfunctions, and contaminant releases including those caused by cyber attacks to the Virginia DOH Office of Drinking Water. Water systems must report these anomalies no more than two hours after discovery and include information on non-critical equipment malfunctions in monthly operating reports.
The Virginia Department of Environmental Quality Wastewater Cybersecurity webpage provides resources for wastewater facilities related to cybersecurity assessments, planning, and training.
