Court Pauses Cybersecurity Rule for AWWA, NRWA Water Utility Members Following Legal Challenge

The U.S. Court of Appeals for the Eighth Circuit granted a request from the American Water Works Association (AWWA) and the National Rural Water Association (NRWA) to stop the U.S. Environmental Protection Agency’s Cybersecurity Rule from going into effect until the current case challenging the rule has been decided.

The Court’s decision applies to all AWWA and NRWA members in the United States. AWWA and NRWA requested that the court pause the rule during a legal challenge from three states so that their members would not have to undertake costly changes to their operations until the court decides if the rule is legally valid. The stay applies until further notice from the court.

“AWWA is pleased the court recognized the importance of halting the Cybersecurity Rule for our utility members as it reviews the legality of the rulemaking process,” said David LaFrance, AWWA chief executive officer. “AWWA strongly supports efforts to strengthen cybersecurity in the water sector, but the Sanitary Survey Program is not the right tool for the job. We are grateful our viewpoint will be heard by the court and look forward to working together with EPA and others on a smart path forward.”

“NRWA commends the court for issuing this stay preventing EPA from enforcing the Cybersecurity Rule until it’s determined if it has been lawfully implemented,” said Matthew Holmes, NRWA chief executive officer. “While NRWA fully supports efforts to strengthen cybersecurity in small communities across the country, enforcing this regulation is not the best way to help small and rural systems, and could have costly and unnecessary consequences.”

AWWA and NRWA joined Missouri, Arkansas, and Iowa in a legal challenge to the rule because of concerns about the legal process and legality of the rule, concerns that the rule may create additional cybersecurity vulnerabilities for members, and concerns that states do not have appropriate resources, laws, rules, or procedures in place to adhere to the rule requirements. Specifically, in the absence of a viable primacy agency implementation framework, water systems were at risk of violations for which they are unable to prepare. There is also the risk that the cybersecurity vulnerabilities of these systems would be publicly available because they are being done through sanitary surveys, which could be accessed by malicious actors.

The public wasn’t given the opportunity to comment about EPA’s proposed approach before the rule was issued. By granting a stay, the court has prevented these risks to members while it reviews the legality of EPA’s rulemaking process.

Established in 1881, the American Water Works Association is the largest nonprofit, scientific, and educational association dedicated to managing and treating water, the world’s most vital resource. With approximately 50,000 members, AWWA provides solutions to improve public health, protect the environment, strengthen the economy and enhance our quality of life. To learn more, visit


The National Rural Water Association is the largest public drinking water and sanitation utility organization representing the interests of more than 31,000 water and wastewater utilities nationwide. NRWA provides training and technical assistance through 50 affiliated state rural water associations dedicated to supporting and promoting the water and wastewater professionals that serve small communities across the U.S. NRWA and the state affiliates provide training on operator certification, financial sustainability, environmental compliance, utility management, and governance to more than 80,000 water professionals annually. To learn more, visit

July 2023