Governor Greg Abbott Enacts Mandatory Cybersecurity Standards for Texas Municipal Water Utilities

AUSTIN, Texas — Governor Greg Abbott signed Senate Bill 940 into law on Monday, creating the Texas Water Infrastructure Cyber Defense Command within the Texas Department of Information Resources (DIR) and appropriating $90 million to deploy automated intrusion prevention systems and isolated operational technology (OT) network architectures across 450 municipal water and wastewater treatment utilities.

The legislation responds to intelligence warnings regarding state-sponsored cyber intrusions targeting internet-connected supervisory control and data acquisition (SCADA) industrial control systems managing municipal chlorine dosing and water valve actuators.

Securing Drinking Water from Foreign Cyber Sabotage Municipal water systems in rural and mid-sized Texas communities often operate with limited IT staffing and legacy programmable logic controllers (PLCs) accessible via default passwords on public networks, making them prime targets for ransomware and state-backed sabotage.

"Clean, safe drinking water is vital to the survival of every Texas community and our state's economy," Governor Abbott said during the bill signing at the Texas Capitol. "Foreign adversaries are actively probing our municipal utility systems for cyber vulnerabilities. Senate Bill 940 establishes mandatory, military-grade cybersecurity defenses, ensuring that bad actors cannot manipulate chemical treatment processes or disrupt drinking water delivery for Texas families."

Mandatory Security Protocols and Automated Threat Monitoring Under Senate Bill 940:

• Air-Gapped Industrial Networks: Water utilities serving over 5,000 connections must physically or logically isolate chemical dosing SCADA networks from public internet connections.
• 24/7 Security Operations Center (SOC) Telemetry: Connecting municipal treatment telemetry to the state's centralized cybersecurity monitoring operations in Austin.
• State Cyber Incident Response Teams (CIRT): Authorizing rapid-deployment cyber incident response units from the Texas National Guard to assist utilities in the event of an attempted network breach.

Municipal water district managers and engineering associations praised the legislation, noting that state-funded security software upgrades relieve local property taxpayers of expensive cybersecurity compliance costs.