Protecting the security of Ontario's drinking water against cyberattacks

In the past year, there has been a growing threat of cybersecurity threats targeting municipal infrastructure, including drinking water systems. These threats can result in loss of data and compromise the ability of municipal utilities to provide clean and safe drinking water. Incidents in the U.S. and Canada have showed that:

• systems can be vulnerable
• measures must be taken to ensure that they are adequately protected.

To address this, the Ontario Ministry of the Environment, Conservation and Parks has now required that cybersecurity threats be effectively evaluated and mitigated for all municipal residential drinking water systems in Ontario.

This has been completed via an update to the Potential Hazardous Events for Municipal Residential Drinking Water Systems to Consider in the Drinking Water Quality Management Standard (DWQMS) Risk Assessment (“List of Potential Hazardous Events”).

All municipal residential drinking water systems in Ontario are managed by an operating authority accredited against the requirements of the DWQMS. Accreditation is issued by a third-party organization designated as an accreditation body in accordance with section 22 of the Safe Drinking Water Act, 2002.

A risk assessment must be conducted for all municipal residential drinking water systems as part of DWQMS requirements. The items described in the List of Potential Hazardous Events are required to be considered as part of a DWQMS risk assessment.

The items include:

• system security, including vandalism and terrorism
• failure of equipment used for water treatment
• algal blooms
• impacts of climate change