Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE) Grant Program is sponsored by New York State Environmental Facilities Corporation (EFC). This program provides grants to help communities affordably protect their drinking water and wastewater systems from cyber threats.

Small businesses specializing in cybersecurity for critical infrastructure, particularly water and wastewater systems, could apply to implement upgrades or conduct assessments.

# Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancement (SECURE) Program The New York State Environmental Facilities Corporation (EFC) is offering $2. 5 million dollars to strengthen cybersecurity readiness and resilience and support operational continuity for eligible water and wastewater systems across New York State.

The SECURE program will provide funding for projects that enhance cyber protections, modernize digital infrastructure and reduce vulnerabilities for critical drinking water and wastewater systems. This strategic initiative expands upon Governor Hochul’s commitment to safeguard essential services, improve risk management practices, and support communities meeting evolving cybersecurity expectations.

Funding is available for both cybersecurity assessments and implementation based on best practices and regulatory requirements. Based on the grant criteria for each program EFC will evaluate all project applications received by the due date of May 15, 2026 . Information provided with the application will not be shared with third parties.

The SECURE Assessment grant will assist eligible clean water and drinking water systems to evaluate their cybersecurity posture, identify vulnerabilities, and prioritize risk mitigation needs. A municipality may apply for up to $50,000 with a 0% match. • Assess system risks and vulnerabilities in accordance with NIST Cybersecurity Framework (NIST CSF) 2.

0 and the NIST Guide to Operational Technology (OT) • Evaluate vulnerabilities of industrial control systems (ICS), operational technologies (OT) and supervisory control and data control and data acquisition (SCADA) systems and define mitigation priorities. • Develop and/or validate OT Asset Inventory by identifying and documenting all in-scope OT assets.

• Determine any gaps in Confidentiality, Integrity, and Availability (CIA) protections. • Conduct a training and workforce needs assessment to identify operator training gaps and required cybersecurity competencies. • Develop new or review existing cybersecurity policies, procedures and roles, including inventory ownership and updating processes taken.

• Conduct readiness reviews for compliance with relevant DEC, DOH, and DPS regulations. SECURE Grants Summary Page 2 of 4 3/2026 • Third-party cybersecurity risk assessments and penetration testing • Network architecture reviews and asset inventories • Creation of system-specific cybersecurity implementation roadmaps • A written cybersecurity risk assessment report aligned with NIST Cybersecurity Framework (NIST CSF) 2.

0 • A list of prioritized vulnerabilities and remediation or mitigation strategies • A report identifying needs and next steps to comply with relevant DEC, DOH, and DPS regulations SECURE Implementation Grant The SECURE Implementation Grant will fund deployment and enhancement of cybersecurity controls, technologies, and response capabilities identified during the assessment phase.

The funded activities will be in response to a submitted cybersecurity assessment of the system. Completion of a prior assessment using a SECURE Assessment Grant is not required to apply; however a comparable assessment of the system’s cybersecurity needs must have been completed prior to applying for a SECURE Implementation Grant. A municipality may apply for up to 20% of net eligible costs, up to $100,000.

• Implement technical and administrative controls to protect system CIA. • Strengthen resilience and incident response capabilities for IT, OT, ICS and • Establish and maintain ongoing cybersecurity governance, monitoring, and maintenance processes. • Procurement and installation of security equipment (firewalls, network segmentation devices, access control systems, etc.).

• Development and implementation of Incident Response Plans (IRPs) and Continuity of Operations Plans (COOPs ). • Deployment of monitoring, alerting, and backup/recovery solutions. Subscription-based software products are not eligible under this program.

SECURE Grants Summary Page 3 of 4 3/2026 • Demonstrated progress toward compliance with DEC/DOH/DPS regulations. • Functional Incident Response and Continuity Plan in accordance with NIST Cybersecurity Framework (NIST CSF) 2. 0 • Documented evidence of implemented controls.

• Updated cybersecurity policies and standard operating procedures.

SECURE grants will be awarded to municipalities, defined as a county, city, town, village, district corporation, county or town improvement district, school district, Indian nation or tribe recognized by the state or the United States with a reservation wholly or partly within the boundaries of New York State, any public benefit corporation or public authority established pursuant to the laws of New York or any agency of the State that is empowered to construct and operate a water quality infrastructure project.

Applicants who would like to be considered for a SECURE Assessment or Implementation grant must submit a grant application to EFC no later than 5:00 p. m. , on May 15, 2026.

Information provided with the application will not be shared with third parties. Applicants who would like to be considered for a SECURE Implementation grant must submit the additional documentation listed below as part of their application: • Cybersecurity assessment of system addressing: o System risks and vulnerabilities in accordance with NIST Cybersecurity Framework (NIST CSF) 2. 0.

o Exposure of ICS/OT and SCADA systems and define mitigation priorities. o Gaps in CIA protection. o Compliance readiness report identifying needs and next steps to comply with relevant DEC, DOH, and DPS regulations.

Applications must be submitted using the online Application Form located on EFC’s Portal at https://portal. efc. ny.

gov . Applications that are submitted without all required information and documentation will be deemed incomplete and will not be processed. SECURE Grants Summary Page 4 of 4 3/2026 Please direct all questions about the SECURE grant program and application to: New York State Environmental Facilities Corporation Albany, New York 12207-2997 E-mail: SECURE@efc.

ny. gov