CISA Needs to Improve Collaboration to Enhance Cyber Resiliency in the Water and Wastewater Sector

Submitting OIG:

Report Description:

The Cybersecurity and Infrastructure Security Agency (CISA) had extensive products and services to manage risks and mitigate cybersecurity threats to critical water and wastewater infrastructure and increase its resiliency. However, CISA did not consistently collaborate with the Environmental Protection Agency and the Water and Wastewater Systems Sector to leverage and integrate its cybersecurity expertise with stakeholders’ water expertise.

Date Issued:

Wednesday, January 10, 2024

Agency Reviewed / Investigated:

Department of Homeland Security

Submitting OIG-Specific Report Number:

OIG-24-09

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

Additional Details Link:

https://www.oig.dhs.gov/sites/default/files/assets/2024-01/OIG-24-09-Jan24.pdf

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	No
We recommend the CISA Director establish and implement a written Memorandum of Understanding with EPA to fully document each agency’s roles and responsibilities and mechanisms for collaboration.
2	Open	No
We recommend the CISA Director develop and implement comprehensive policies and procedures regarding its collaboration with EPA and other Water and Wastewater Systems Sector stakeholders. These policies and procedures should address: • the Water Sector Liaison’s roles and responsibilities; • what information should be shared with stakeholders; • how often and when divisions should coordinate their communications; and • how best to facilitate information sharing about cyber threats, vulnerabilities, incidents, potential protective measures, and best practices, in both routine and urgent circumstances.
3	Open	No
We recommend the CISA Director have an agency-wide requirement to develop and implement standard operating procedures to improve regular communication among CISA divisions relevant to the Water and Wastewater Sector or other critical infrastructure Sectors and share that information and updates on projects, decisions, and lead roles and responsibilities related to the Water and Wastewater Systems Sector and other sectors as appropriate.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

We recommend the CISA Director establish and implement a written Memorandum of Understanding with EPA to fully document each agency’s roles and responsibilities and mechanisms for collaboration.

Open

We recommend the CISA Director develop and implement comprehensive policies and procedures regarding its collaboration with EPA and other Water and Wastewater Systems Sector stakeholders. These policies and procedures should address: • the Water Sector Liaison’s roles and responsibilities; • what information should be shared with stakeholders; • how often and when divisions should coordinate their communications; and • how best to facilitate information sharing about cyber threats, vulnerabilities, incidents, potential protective measures, and best practices, in both routine and urgent circumstances.

Open

We recommend the CISA Director have an agency-wide requirement to develop and implement standard operating procedures to improve regular communication among CISA divisions relevant to the Water and Wastewater Sector or other critical infrastructure Sectors and share that information and updates on projects, decisions, and lead roles and responsibilities related to the Water and Wastewater Systems Sector and other sectors as appropriate.

Search form

CISA Needs to Improve Collaboration to Enhance Cyber Resiliency in the Water and Wastewater Sector

Related Open Recommendations