Understanding New York’s Drinking Water Cybersecurity Deadlines

New York’s drinking water cybersecurity requirements create specific deadlines for covered community water systems to identify, report, and address cybersecurity risks. For systems serving more than 3,300 people, the requirements include 24-hour cybersecurity incident reporting, 48-hour vulnerability reporting, and corrective action within 120 days for qualifying vulnerabilities. Covered systems must also review their Cybersecurity Vulnerability Analysis (CVA) annually and ensure certified drinking water operators complete cybersecurity training every three years.

These deadlines change how water system leaders need to think about cybersecurity. A vulnerability cannot simply be added to an IT team's backlog. A qualifying issue may trigger a regulatory reporting obligation, a defined remediation timeline, and a need to coordinate IT, operations, leadership, and the New York State Department of Health.

The regulation took effect in March 2026, with most requirements becoming effective January 1, 2027. Certain requirements, including incident reporting and operator cybersecurity training, took effect immediately.

Understanding the timeline is therefore an important part of preparing for New York drinking water cybersecurity compliance.

New York Drinking Water Cybersecurity Deadlines at a Glance

The most important requirements can be summarized as follows:

The New York State Department of Health provides a detailed cybersecurity requirements table with the responsible party, documentation requirements, and effective dates for each requirement.

The important distinction is that these are not all deadlines for the same activity. Some are incident-response deadlines, some are vulnerability-management deadlines, and others establish an ongoing governance cadence.

The 24-Hour Deadline: Cybersecurity Incident Reporting

The first clock starts when a covered water system determines that a qualifying cybersecurity incident has occurred.

Under Appendix 5-E, a covered water system must notify the Department of Health as soon as possible and no later than 24 hours after determining that a cybersecurity incident has occurred that has created or may create a public health hazard. The Department's summary also describes the reporting requirement in terms of incidents that may affect the system's ability to comply with Subpart 5-1 or may pose a public health risk.

What this means operationally

The 24-hour requirement is not simply an IT ticket deadline.

An organization needs to know:

• Who evaluates a suspected cybersecurity incident
• Who determines whether it meets the regulatory reporting threshold
• Who has authority to notify the Department
• How the incident is escalated internally
• What information must be collected
• How the incident is documented
• Who coordinates technical response and operational continuity

New York provides a cybersecurity incident reporting process for covered water systems. The Department notes that incident reports must be completed and submitted in one session and that the reporting process is designed to protect sensitive information.

Build the reporting decision before the incident

A common weakness in incident response is treating regulatory reporting as something to figure out after an event occurs.

A stronger process establishes the decision path in advance:

Alert or suspected incident → investigation → determine whether reporting criteria are met → notify responsible leadership → submit required report → contain and remediate → document lessons learned

The goal is not to assume every security alert is a reportable incident. The goal is to make sure the organization can make that determination quickly and consistently.

The 48-Hour Deadline: Cybersecurity Vulnerability Reporting

The second major deadline applies to qualifying cybersecurity vulnerabilities.

Covered water systems must notify the Department of Health within 48 hours of identifying a cybersecurity vulnerability that may affect the system's ability to comply with Subpart 5-1 or may pose a public health risk.

The vulnerability reporting requirement is particularly relevant to organizations that already conduct vulnerability scanning, security assessments, penetration testing, or other cybersecurity reviews.

Not every vulnerability is automatically reportable

The regulation focuses on vulnerabilities that meet the specified impact criteria. A routine software vulnerability does not automatically mean that a water system has a 48-hour reporting obligation.

The important operational question is whether the organization has a consistent process for determining when a vulnerability meets the regulatory threshold.

That process should consider factors such as:

• The affected cyber asset
• The asset's role in water system operations
• Whether the asset affects compliance with Subpart 5-1
• Potential public health implications
• Network exposure
• Existing compensating controls
• Ability to exploit the vulnerability
• Potential operational consequences

This is where cybersecurity risk management and regulatory compliance intersect.

The 120-Day Deadline: Corrective Action

Identifying and reporting a qualifying vulnerability starts another clock.

New York requires corrective action for qualifying vulnerabilities to start and/or be completed within 120 days of notification. The Department's requirements table also directs covered systems to consult with the Department within 30 days to identify mitigation steps.

Treat the 120 days as a remediation process, not a waiting period

A 120-day window should not become a reason to defer action until the deadline approaches.

Once a qualifying vulnerability is identified, establish:

• A responsible owner
• The affected asset
• The risk and operational impact
• The remediation approach
• Interim mitigation measures
• A target completion date
• Required approvals
• Validation requirements
• Documentation of the final resolution

In some environments, immediate remediation may not be practical. An operational technology system, for example, may require additional testing or a maintenance window before a security update can be deployed.

That does not eliminate the need to reduce the risk. Compensating controls, network segmentation, access restrictions, monitoring, or other mitigation measures may be appropriate while a permanent fix is planned.

Measure remediation progress

Instead of measuring cybersecurity performance by the number of vulnerabilities discovered, leadership can track indicators such as:

• Percentage of qualifying vulnerabilities with assigned owners
• Percentage with documented mitigation plans
• Percentage addressed within the required timeframe
• Number of overdue remediation actions
• Average time from identification to mitigation
• Number of recurring vulnerabilities
• Percentage of critical assets with current vulnerability assessments

These measures provide a clearer picture of whether cybersecurity risk is actually being reduced.

The Annual Deadline: Review the Cybersecurity Vulnerability Analysis

The Cybersecurity Vulnerability Analysis, or CVA, is not a one-time assessment.

New York requires covered water systems to review and update the CVA at least annually and when major water infrastructure changes could affect cybersecurity. The Department's requirements table also specifies submission to the Department every five years or within 30 days after qualifying major infrastructure changes.

Why the annual review matters

A water system's technology environment changes continuously.

New equipment is deployed. Network architecture changes. Vendors receive new access. Employees change roles. Applications are replaced. Remote access methods evolve. Microsoft 365 configurations change.

An outdated CVA can therefore provide a misleading picture of the organization's actual cybersecurity risk.

The annual review should consider:

• Changes to IT and OT assets
• New or retired systems
• Changes to network connectivity
• New vendor relationships
• Remote access changes
• Identity and access changes
• Newly identified vulnerabilities
• Changes to incident response capabilities
• Backup and recovery changes
• Previous remediation activities
• Changes to regulatory requirements

New York's cybersecurity guidance for public water systems provides additional resources and templates for conducting and maintaining the assessment.

Every Three Years: Operator Cybersecurity Training

Certified drinking water operators must complete at least one hour of cybersecurity training every three years. The training curriculum must be approved by the Department, and the Department's requirements table states that proof of training must be available upon request.

Training should change behavior, not just satisfy a requirement

One hour every three years establishes the regulatory minimum. Organizations can use that requirement as a foundation for broader security awareness.

Relevant topics can include:

• Protecting credentials
• Recognizing phishing
• Using multifactor authentication
• Reporting suspicious activity
• Secure remote access
• Handling removable media
• Recognizing unauthorized system changes
• Escalating cybersecurity incidents
• Protecting sensitive operational information

For water systems, cybersecurity training should reflect the systems employees actually use.

New York's cybersecurity guidance recognizes that water operations can depend on electronically operated equipment such as control systems, pumps, valves, and other technology.

The most useful training therefore connects cybersecurity behavior to operational responsibilities.

Every Five Years: Certification for Larger Water Systems

Water systems serving a combined wholesale and retail population of more than 50,000 people have additional requirements.

These systems must designate a qualified individual responsible for the cybersecurity program. That individual must certify every five years that the system has an active cybersecurity program developed in accordance with Appendix 5-E.

Larger systems also have annual governance requirements

The designated individual must provide a confidential written report to the system's governing body each year summarizing the cybersecurity program and significant cybersecurity risks. Larger systems must also monitor and log network activity.

This creates a formal governance cycle:

Annual risk review → cybersecurity program updates → governing body reporting → five-year certification

For larger water systems, cybersecurity therefore becomes an ongoing executive governance responsibility rather than an issue managed exclusively within IT.

How Microsoft 365 and Identity Security Fit Into the Timeline

Many water systems use Microsoft 365 for email, collaboration, identity, file storage, and other business functions.

Microsoft 365 security does not satisfy all of New York's drinking water cybersecurity requirements, but identity and business-system security can be an important part of the broader cybersecurity program.

Review identity controls as part of the CVA

Depending on the organization's environment, the assessment may include:

• Multifactor authentication
• Conditional access
• Privileged account controls
• Administrative account separation
• User access reviews
• Endpoint protection
• Email security
• Identity monitoring
• Security logging
• Remote access controls

The important question is not whether a particular Microsoft security feature is enabled. It is whether the organization's identity and access controls reduce the likelihood that compromised credentials can be used to reach systems that matter to water operations.

Do not stop at Microsoft 365

A water system's cybersecurity environment can extend well beyond its business applications.

The CVA and cybersecurity program should consider operational technology, SCADA, engineering workstations, network infrastructure, remote access, vendor connections, and other cyber assets.

New York's existing cybersecurity assessment materials distinguish between process control systems and business enterprise systems, reinforcing the importance of considering both environments.

The Deadlines Work Together

The most useful way to understand the regulation is as a connected cybersecurity lifecycle rather than five separate deadlines.

Consider a qualifying vulnerability discovered during an assessment:

Day 0: Identify vulnerability
Determine whether it meets the regulatory reporting criteria.

Within 48 hours: Report
Notify the Department if the vulnerability meets the applicable reporting threshold.

Within 30 days: Consult
Work with the Department to identify appropriate mitigation steps as required.

Within 120 days: Corrective action
Begin or complete corrective action.

Ongoing: Monitor and document
Track remediation and validate that the risk has been addressed.

Annually: Review the CVA
Incorporate changes and newly identified risks into the cybersecurity analysis.

Every three years: Train operators
Ensure required cybersecurity training remains current.

Every five years for larger systems: Certify
Maintain the required cybersecurity program certification and governance process.

This lifecycle makes one point clear: compliance depends on operational readiness before a vulnerability or incident occurs.

What Water Systems Should Do Now

For covered water systems preparing for New York drinking water cybersecurity compliance, the most useful first step is to map existing processes against the regulatory clock.

1. Identify who owns each deadline

Document the people responsible for:

• Incident assessment
• Vulnerability assessment
• Regulatory reporting
• Remediation
• Operator training
• CVA maintenance
• Executive governance

2. Test the 24-hour response process

Walk through a hypothetical cybersecurity incident and determine whether the organization can identify the appropriate decision-maker, determine whether reporting is required, and submit the required notification within 24 hours.

3. Test the 48-hour vulnerability process

Take a representative vulnerability and walk through the process from discovery to regulatory determination.

The objective is to establish how the organization distinguishes an ordinary vulnerability from one that triggers the reporting requirement.

4. Review the vulnerability backlog

Identify vulnerabilities affecting critical IT and OT assets and determine which require remediation, mitigation, or additional assessment.

5. Validate the CVA

Confirm that the CVA reflects the current environment, including recent technology, infrastructure, access, vendor, and network changes.

6. Review identity and access controls

For Microsoft 365 environments, review privileged access, multifactor authentication, administrative accounts, conditional access, and other identity controls that can reduce the risk of unauthorized access.

7. Test recovery

Confirm that the organization can restore critical systems and continue essential operations following a cybersecurity incident.

8. Establish the ongoing governance cadence

Put the annual CVA review, operator training, remediation tracking, incident-response exercises, and leadership reporting on a defined schedule.

Turning Compliance Deadlines Into Risk Reduction

The 24-hour, 48-hour, and 120-day requirements create clear points in the cybersecurity lifecycle, but the underlying objective is broader than meeting a deadline.

A useful cybersecurity program should make it possible to answer:

• What are our most important cyber assets?
• What are our highest-risk vulnerabilities?
• Who owns each material risk?
• How quickly can we identify a qualifying incident?
• Can we determine whether regulatory reporting is required?
• Can we report within the required timeframe?
• Can we mitigate or remediate material vulnerabilities within the required timeframe?
• Can we recover critical operations?
• Are employees and operators prepared to respond appropriately?
• Does leadership understand the organization's current cybersecurity risk?

The strongest compliance process is one that makes these answers easier to produce, document, and act on.

New York's official cybersecurity resources for public water systems include the regulation overview, reporting resources, program templates, cybersecurity assessment materials, and frequently asked questions.

FAQ

What are the New York drinking water cybersecurity deadlines?

The primary New York drinking water cybersecurity deadlines are 24 hours for reporting qualifying cybersecurity incidents, 48 hours for reporting qualifying cybersecurity vulnerabilities, and 120 days to begin or complete corrective action for reported vulnerabilities. Covered systems must also review their CVA annually and ensure certified drinking water operators complete one hour of cybersecurity training every three years.

What is the 24-hour cybersecurity reporting requirement for New York water systems?

Covered water systems must notify the New York Department of Health as soon as possible and no later than 24 hours after determining that a qualifying cybersecurity incident has occurred. The regulation addresses incidents that have created or may create a public health hazard, while the Department's guidance also describes impacts to compliance with Subpart 5-1 and potential public health risks.

What is the 48-hour cybersecurity vulnerability reporting requirement?

Covered water systems must report qualifying cybersecurity vulnerabilities to the New York Department of Health within 48 hours of identification. The requirement applies to vulnerabilities that may affect the system's ability to comply with Subpart 5-1 or may pose a public health risk.

How long does a New York water system have to fix a cybersecurity vulnerability?

For vulnerabilities that meet the regulation's reporting criteria, corrective action must start and/or be completed within 120 days of notification. The Department also requires the water system to consult with it within 30 days to identify mitigation steps.

How often must a New York water system update its Cybersecurity Vulnerability Analysis?

The Cybersecurity Vulnerability Analysis must be reviewed and updated at least annually and when major water infrastructure changes could affect cybersecurity. The Department's requirements table also specifies submission every five years and within 30 days after qualifying major infrastructure changes.

How often is cybersecurity training required for New York drinking water operators?

Certified drinking water operators must complete at least one hour of cybersecurity training every three years. The training curriculum must be approved by the New York Department of Health.

What additional cybersecurity requirements apply to water systems serving more than 50,000 people?

Water systems serving more than 50,000 people must designate a qualified individual responsible for the cybersecurity program. That individual must certify the program every five years, provide a confidential cybersecurity report to the governing body annually, and the system must monitor and log network activity.

When do New York drinking water cybersecurity requirements take effect?

Appendix 5-E became effective in March 2026. The New York Department of Health's requirements table identifies January 2027 as the effective date for the CVA review and cybersecurity program requirements, while cybersecurity incident reporting and operator training became effective immediately upon adoption.

Does the 24-hour deadline apply to every cybersecurity incident?

No. The regulation's reporting requirement applies to qualifying cybersecurity incidents that meet the criteria established by Appendix 5-E. Organizations should have a defined process for evaluating incidents against those criteria rather than assuming every security alert is reportable.

Does the 48-hour deadline apply to every cybersecurity vulnerability?

No. The 48-hour requirement applies to cybersecurity vulnerabilities that may affect the covered water system's ability to comply with Subpart 5-1 or identify a situation that may pose a public health risk. A vulnerability management process should therefore include a documented method for determining whether a finding meets the reporting threshold.

How should Microsoft 365 fit into New York drinking water cybersecurity compliance?

Microsoft 365 can be part of a water system's broader cybersecurity program, particularly for identity, access, email, endpoint, and collaboration security. However, Microsoft 365 does not address the full scope of the regulation. Water systems also need to consider operational technology, network infrastructure, remote access, control systems, and other cyber assets.

What should a water system do first to prepare for these cybersecurity deadlines?

Start by identifying which Appendix 5-E requirements apply, assigning ownership for each requirement, validating the IT and OT asset inventory, and reviewing the current Cybersecurity Vulnerability Analysis. Then test the organization's 24-hour incident reporting and 48-hour vulnerability reporting processes before an actual event occurs.

Where can water systems find the official New York cybersecurity requirements?

The New York Department of Health provides the official cybersecurity resources for public water systems, including the regulation overview, requirements table, reporting resources, cybersecurity program templates, and assessment materials. The Department also provides the official text of Appendix 5-E.