October 2026 AWWA Water Utility Insider

The latest updates in U.S. legislative, regulatory actions

 Each quarter, AWWA prepares an overview of U.S. legislative and regulatory developments impacting the water sector. The fall 2026 edition provides a review of the recent and ongoing regulatory actions that impact the water sector. While not an exhaustive compilation, it covers many legislative and regulatory developments currently relevant to AWWA members.

New AWWA data center report coming next week

 Next week, AWWA will release Cooling the Cloud: Considerations for Water Utilities Evaluating Data Center Development, a new report produced in collaboration with Carollo Engineers. The report builds on AWWA’s 2025 publication, Cooling the Cloud: Water Utilities in a Data-Driven World, which covered how data centers affect water utilities and the communities they serve.

The new publication leverages the sector’s experience and existing AWWA guidance to support utilities as they consider potential impacts of proposed data center development on water resources, infrastructure, and system capacity, among other factors.

CISA holding session on building resilience in an era of accelerating threats

The Cybersecurity and Infrastructure Security Agency (CISA) will host “Preparing for Disruption,” a CISA Live! event discussing how frontline operators can build resilience during an era of accelerating threats. Across water systems, power grids, healthcare facilities, and transportation networks, digital disruptions are producing increasingly severe physical consequences. This interactive session helps frontline operators and executive decision-makers with hardening edge devices, maintaining minimum viable operations under compromise, and leveraging no-cost CISA tools and regional support.

CISA speakers include:

• Christine Serrano Glassner, chief external affairs officer
• Chris Butera, acting executive assistant director of the cybersecurity division
• Scott Breor, acting executive assistant director of the infrastructure security division

To attend, register for the event, which is scheduled for 2:30 p.m. ET Monday, Oct. 26.

States contemplate expanded cybersecurity requirements

At the ASDWA Fall Conference, Ben Montross, president of the Association of State Drinking Water Administrators (ASDWA), described 2026 as a year in which state drinking water programs were adapting to a wave of new regulatory requirements and programmatic changes. He characterized the current period as the "lull before the storm," noting that major compliance deadlines for both the U.S. Environmental Protection Agency’s (EPA) per- and polyfluoroalkyl substances (PFAS) rule and the Lead and Copper Rule Improvements (LCRI) will arrive in 2027.

Cybersecurity emerged as another area in which states are considering a larger role. Presentations highlighted the more than 381 public water systems identified by EPA as having internet-exposed IP addresses. EPA also reported that the number of systems receiving EPA cybersecurity assessments increased by more than 30% in 2026, a trend the agency attributed in part to state-led cybersecurity initiatives.

At least 10 states — including Arizona, Connecticut, Maryland, Minnesota, New Hampshire, New Mexico, Nevada, New York, Vermont, and Wyoming — have incorporated cybersecurity training requirements into operator certification programs. Several states are now moving beyond training requirements and toward direct cybersecurity obligations for water systems.

New York and Maryland are among the states implementing new cybersecurity requirements for systems serving more than 3,300 people. New York's program took effect on March 11. While certain provisions, including employee training and incident notification requirements, became effective immediately, utilities have until Jan. 1, to complete initial vulnerability assessments and satisfy other compliance obligations. Maryland is similarly advancing requirements applicable to larger public water systems as implementation of S.B. 871 proceeds.

For utilities already facing major compliance obligations under PFAS and lead service line regulations, expanding state cybersecurity requirements could represent another significant operational, governance, and budgetary challenge heading into 2027.

FEMA announces $400 million in funding for flood mitigation

The Federal Emergency Management Agency (FEMA) announced $400 million in available funding for the Flood Mitigation Assistance Grant Program in fiscal year 2026. The program funds projects that reduce or eliminate the risk of repetitive flood damage to buildings and structures insured by the National Flood Insurance Program. Funding is available for capability and capacity building activities, localized flood risk reduction projects, and individual flood mitigation projects. Each state is eligible to be the primary applicant, and sub applicants may include cities, counties, townships, special districts and Tribal Nations. The application period closes Feb. 26. View the opportunity on www.Grants.gov.

FEMA will host a webinar from 2-3:30 p.m. ET on Wednesday, Nov. 4, to assist with applications.