Virginia DEQ
Home MenuWastewater Cybersecurity
DEQ strongly encourages wastewater facilities to assess their cybersecurity practices and implement cybersecurity controls appropriate to the technologies they utilize. For facilities new to cybersecurity, simply implementing basic cybersecurity practices can greatly reduce their exposure to cyber-attacks that may threaten their facility(ies), billing/financial software, and/or other critical systems.
Cybersecurity Assessments
Wastewater facilities should conduct routine assessments of their cybersecurity measures in order to determine where controls are needed to address vulnerabilities. Resources pertaining to assessing cybersecurity can be found on EPA's cybersecurity assessment page.
Cybersecurity Planning
Wastewater facilities are encouraged to develop cybersecurity plans to prepare for, respond to, and recover from cybersecurity attacks. EPA maintains resources that can aid facilities in the development of cybersecurity plans.
Cybersecurity Training
For cybersecurity training resources including learning about: cybersecurity basics, how to conduct a cyber risk assessment, upcoming cybersecurity training, and requesting training, please visit EPA's Cybersecurity Training page.
Remote Facility Monitoring
In 2024, the Virginia General Assembly passed HB220 which amended Article 4 of Water Control Law to allow for remote facility monitoring by operators. A summary of the amendment is provided below.
"Where the facility is equipped with adequate technological capability, the Department shall credit remote monitoring of the facility by a licensed operator of the appropriate class as operator attendance toward recommended licensed operator attendance hours, provided that the owner submits and the Department approves a remote monitoring plan demonstrating that the facility possesses sufficient technology for the remote operator to adequately monitor the facility and manage onsite operators with a lower license class, mechanics, or other staff to operate the facility under the remote operator's direct supervision."