# Free assistance for small water/wastewater utilities

**What this is:** contact points and no-cost programs that exist specifically so a utility with
"a few staff, no security team" (the audience `PHASED_ROLLOUT.md` is written for) doesn't have to
solve this alone. Everything below was pulled from a live source on 2026-08-03 — not recalled from
training — per this repo's own citation discipline (see README). **Re-verify before relying on
program availability or deadlines; government and nonprofit programs change.**

## Report an incident right now

**CISA, 24/7:** report@cisa.gov · **(888) 282-0870**
The federal 24/7 operations center for reporting cyber incidents and anomalous activity, regardless
of sector. [Reporting a Cyber Incident — CISA](https://www.cisa.gov/reporting-cyber-incident)

## Free technical assistance (not an emergency — ongoing help)

**EPA Cybersecurity Technical Assistance Program for the Water Sector.** Free expert help with
training, device security, account security, data security, vulnerability management, and policy —
explicitly covers utilities of any size, including small/rural systems without dedicated security
staff. Request via the online form; no phone/email intake listed, it's ticket-based.
[epa.gov/cyberwater](https://www.epa.gov/cyberwater/forms/cybersecurity-technical-assistance-program-water-sector)

**WaterISAC — free 12-month membership pilot (NRWA members, time-limited).** If your utility is an
NRWA member serving fewer than 10,000 people and is not already a WaterISAC member, a complimentary
12-month membership (cyber/physical threat alerts, twice-weekly security updates, incident
reporting and analysis) is available as a new-membership pilot running through the end of 2026.
Apply directly — don't assume it's still open by the time you read this.
[waterisac.org/nrwa](https://www.waterisac.org/nrwa)

**CISA's water-sector hub.** Starting point for the Cyber Essentials Toolkit (written for
non-technical leadership) and a joint CISA/FBI/EPA incident-response guide for this sector.
[cisa.gov/water](https://www.cisa.gov/water)

**AWWA (American Water Works Association).** No-cost Water Sector Cybersecurity Risk Management
Guidance, a self-assessment tool, and guidance specifically sized for small/rural systems.
[awwa.org/resource/cybersecurity-guidance](https://www.awwa.org/resource/cybersecurity-guidance/)

## Funding for the fixes themselves

Clean Water / Drinking Water State Revolving Funds and CISA's State and Local Cybersecurity Grant
Program are named, in CISA's own materials, as funding routes for exactly this kind of hardening
work — worth asking your state drinking-water primacy agency about before assuming Phases 1–3 have
to come out of an already-tight operating budget.

**Status caveat on SLCGP specifically (checked 2026-08-03):** the State and Local Cybersecurity
Grant Program's authorization **lapsed on 2026-01-30** (originally 2025-09-30, extended by
continuing resolution), and reauthorization is pending rather than settled. Several states were
still administering FY2026 rounds after that date, so the accurate description is
*lapsed-and-pending*, not *closed* — ask your state's administering agency whether a round is
actually open rather than assuming it either way. The State Revolving Funds are a separate
authority and are not affected by this.

---
*l0gic — Patrick Crosby, 2026-08-03. Verify current availability before relying on any program
above — this is a starting point, not a guarantee any of it is still open.*