|
OHA Drinking Water Services
August 6, 2026
In this issue:
- Cybersecurity Alert & Actions for Water Systems
- Certification: Who's Your Operator in Direct Responsible Charge?
- Drinking Water State Revolving Fund (DWSRF)
- Lead & Copper Rule Improvements (LCRI)
- Plan Review Exemption for Water Main Extensions
- Training Opportunities
There have been recent reports of cyber-attacks around the country targeting programmable logic controllers (PLCs) at drinking water utilities resulting in boil water notices and sustained manual operations. Drinking water providers of any size utilizing operational technology (OT) and information technology (IT) systems are more susceptible to cybersecurity issues. Below are a few top cyber actions water providers can take to reduce cyber risk and improve resilience to cyberattacks. For additional information and resources, see the Cybersecurity & Infrastructure Security Agency’s (CISA) alertCybersecurity & Infrastructure Security Agency’s (CISA) alert.
What to do NOW:
- Disconnect the PLC from the public facing internet. Remote access for operational purposes should go through a VPN, firewall, or secure gateway device, not directly to the PLC.
- Enable password protection and change default passwords.
- Only allow remote access from known engineering laptops or other critical OT and IT assets.
- Ensure PLCs are installed, maintained, and operated using the manufacturer’s best practices and guidelines. Work with your IT team members and/or integrators who may have additional recommendations for your system.
Additional best practices:
- Develop and exercise your cybersecurity response plan to ensure all operators are familiar with roles and responsibilities.
- Create an inventory of OT and IT assets to help you understand what you need to protect and conduct regular cybersecurity assessments for free using EPA’s cybersecurity technical assistance and evaluation program.
- Backup OT and IT systems so your water system can recover in the event cybersecurity issues arise.
- Know how to report cybersecurity incidents. The Cybersecurity and Infrastructure Security Agency (CISA) along with the EPA and FBI work with water systems to respond to and recover from cybersecurity incidents. To report a cybersecurity incident, fill out a CISA cybersecurity incident report, call 888-282-0870, or email report@cisa.gov.
- Water systems are encouraged to report cyber incidents to their direct contact at OHA-Drinking Water Services. Normal business hours: info.drinkingwater@odhsoha.oregon.gov, 971-673-0405. For after hours (evenings, weekends, and holidays) emergencies, contact the on-call drinking water manager: 503-704-1174.
For questions, please reach out directly to DWS’s Emergency Response and Preparedness Coordinator, Chantal Wikstrom at chantal.t.wikstrom@oha.oregon.gov.
Do you know whether your water system's direct responsible charge (DRC) data is current?
Oregon Administrative Rule 333-061-0225 states that Community and Non-Transient Non-Community water systems must, at all times, employ, either directly or by contract, an operator to be in direct responsible charge (DRC) of every distribution system and water treatment plant. In addition, water systems must report the names of their DRCs to DWS within 30 days of all DRC changes.
Water systems should review their DRC data and list of operators regularly through Data Online, and when necessary, submit corrections to DWS.
Corrections can be made by submitting the DRC Designation Form or other operator updates to dws.opcert@odhsoha.oregon.gov
Oregon’s Drinking Water State Revolving Fund (DWSRF) provides low-cost loans to community and nonprofit non-community public water systems for planning, design, and construction of drinking water infrastructure improvements. All projects receive part of the loan as principal forgiveness.
Upcoming Application Deadlines:
How to Apply – Visit Drinking Water State Revolving Fund to view available funding programs. Business Oregon’s Regional Development Officers can assist eligible water systems with the best funding options in their area. OHA’s Circuit Rider Program offers up to 10 hours of free on-site technical assistance for populations under 10,000 – this includes assistance with funding applications. And if needed, the Rural Community Assistance Corporation (RCAC) can also provide technical assistance too.
Questions? Reach out to OHA-Drinking Water Services at dws.srf@odhsoha.oregon.gov.
Oregon Infrastructure Summit:
- The Oregon Infrastructure Summit convenes Oregon’s leaders to advance infrastructure policy, funding, partnerships, and project delivery strategies that strengthen communities and support long-term economic prosperity.
- Event Details:
In October 2024, the U.S. Environmental Protection Agency (EPA) released the final Lead and Copper Rule Improvements (LCRI). This represents the most significant update to federal lead and copper regulations since 1991.
Key Provisions of the LCRI
-
Lowered Lead Action Level: Starting November 1, 2027, the lead action level will be significantly reduced from 15 parts per billion (ppb) down to 10 ppb.
-
Baseline Inventory & Connector Materials: Water systems must update their initial 2024 service line inventories to establish a baseline inventory by November 1, 2027. This updated inventory must now incorporate service line connector materials (such as goosenecks and pigtails connecting the water main to the service line).
Resources
For questions, please reach out directly to Amy Word at amelia.a.word@oha.oregon.gov.
Community water systems may be able to apply for a plan review exemption for water main extensions. Water systems with a plan review exemption do not need to submit plans and fees for water main extension projects.
Overview of the Exemption
-
Qualify for the exemption: Your water system must have a current master plan that has been reviewed and approved by our office; have an engineer on staff or under contract; and must certify that you have the staff qualified to supervise the projects and that projects will be carried out in conformance with our rules.
-
Requesting the exemption: Your water system can send a letter via email to our office, detailing how your system meets those qualifications. The letter must be signed by the engineer of record for the water system. The engineer of record must be an engineer registered in Oregon.
-
Maintaining the exemption: Each year, a summary report is required. Specific details are required and found on our website.
Resources
For questions, please reach out directly to one of the plan review coordinators, Carrie Gentry at Carrie.L.Gentry@oha.oregon.gov or Rebecca Templin at Rebecca.A.Templin@oha.oregon.gov
Training Opportunities
Find information about free trainings, webinars and CEUs on the Operator Certification Training Opportunities web page at www.healthoregon.org/dwtraining.
You have received this message because you have subscribed to the Pipeline Newsletter group of the Drinking Water Services email list.
Access past issues of the newsletter on the DWS Pipeline web page.
Contact Drinking Water Services
info.drinkingwater@odhsoha.oregon.gov or 971-673-0405
See the Drinking Water Contacts web page for updated phone numbers and email addresses
|
