Maryland General Assembly mandates cybersecurity education for water sector

In the heart of Maryland's legislative session, a new bill is making waves, aiming to fortify the state's defenses against a growing threat: cybersecurity attacks on water and wastewater systems. House Bill 1062, introduced on April 5, 2025, seeks to address the vulnerabilities in these critical infrastructures, which are essential for public health and safety.

As discussions unfolded in the state capitol, lawmakers emphasized the urgency of the bill, particularly in light of recent high-profile cyber incidents that have targeted similar systems across the nation. The bill proposes a comprehensive education campaign led by the Department of the Environment, in collaboration with the Department of Information Technology. This initiative aims to enlighten leaders in the water and wastewater sector about the economic advantages of investing in cybersecurity prevention rather than remediation after an attack.

Key provisions of House Bill 1062 include the establishment of dedicated positions within the Department of the Environment to oversee cybersecurity efforts, with funding allocated for three Administrator III positions and two Administrator II positions. Additionally, the bill mandates the inclusion of cybersecurity attack information on the department's "Know the Threats" website, ensuring that stakeholders are informed and prepared.

The bill also calls for tabletop exercises focused on water cybersecurity, a proactive measure to simulate potential cyber incidents and enhance response strategies. By working closely with federal agencies like the U.S. Environmental Protection Agency and the Department of Defense, Maryland aims to tap into resources that can bolster local community water systems against cyber threats.

However, the bill has not been without its critics. Some lawmakers have raised concerns about the potential costs associated with implementing these cybersecurity measures, questioning whether the state can afford the proposed budget allocations. Others argue that while the intent is commendable, the execution may face hurdles, particularly in ensuring that all stakeholders are adequately trained and equipped to handle cybersecurity challenges.

The implications of House Bill 1062 extend beyond mere compliance; they touch on the broader economic and social fabric of Maryland. By prioritizing cybersecurity in essential services, the state not only protects its infrastructure but also instills confidence in its residents regarding the safety of their water supply. Experts suggest that if passed, this bill could serve as a model for other states grappling with similar cybersecurity threats, potentially leading to a nationwide shift in how critical infrastructure is safeguarded.

As the legislative session progresses, all eyes will be on House Bill 1062, a pivotal step toward securing Maryland's water systems against the looming threat of cyberattacks. The outcome of this bill could very well shape the future of cybersecurity in public utilities, making it a topic of significant interest for policymakers and citizens alike.