AWIA Deadline Passed: June 30, 2026 — Uncertified utilities in active EPA violation. Penalty clock is running. ◆ EPA Enforcement: 70% of inspected water utilities found in active violation ◆ Active Cyberattack: 12 states hit — Iranian actors targeting water system PLCs right now ◆ New York Water Utilities: Three new state cyber rules now in effect ◆ Wastewater Operators: 24-hour incident reporting now mandatory in NY ◆ Penalty Exposure: $71,545 per day per SDWA §1433 violation ◆ Federal Reporting: CIRCIA 72-hour incident rule anticipated — final rule pending ◆ AWIA Deadline Passed: June 30, 2026 — Uncertified utilities in active EPA violation. Penalty clock is running. ◆ EPA Enforcement: 70% of inspected water utilities found in active violation ◆ SCADA Alert: Iranian threat actors actively targeting water system PLCs ◆ New York Water Utilities: Three new state cyber rules now in effect ◆ Wastewater Operators: 24-hour incident reporting now mandatory in NY ◆ Penalty Exposure: $71,545 per day per SDWA §1433 violation ◆ Federal Reporting: CIRCIA 72-hour incident rule anticipated — final rule pending ◆

70% of water utilities are in EPA violation. We can fix that.

The compliance operating system for America's water systems — at the worst possible moment to be exposed. The AWIA deadline passed June 30. The penalty clock started July 1. Iranian-affiliated actors are actively targeting water system PLCs across 12 states right now. AWIA, EPA SDWA §1433, CISA OT, CIRCIA, and the state mandates — tracked, evidenced, certifiable from one dashboard.

→ KORVA Sentinel — See Plans → AWIA Bundle (RRA + ERP)
DUAL THREAT
Penalty clock running since July 1. Iranian-affiliated actors actively exploiting exposed PLCs — CISA AA26-097A. A Compliance Risk Snapshot shows where you're vulnerable on both fronts — regulatory and operational — before the next inspection or the next attack. → Get your Snapshot ($497)
$71,545
Per-day SDWA
penalty
26.6M
Americans
at risk
17
Federal & state
mandates tracked
RRA Recertification
Emergency Response Plan
SCADA Security
Incident Reporting
State Mandates
Wastewater Compliance
Vulnerability Assessment
EPA Inspection Ready

This is not
a drill.

The AWIA recertification deadline passed June 30, 2026. Penalty clocks started July 1 for every uncertified system — and there are thousands of them. Iranian-affiliated actors are actively exploiting exposed PLCs at water utilities across 12 states right now. New York and Indiana enacted parallel state mandates. The average small water utility has zero in-house cybersecurity capacity — and right now, that means two enforcement risks running simultaneously.

70%
Of inspected systems are in active SDWA §1433 violation
EPA's 2024 Enforcement Alert documented widespread incomplete RRAs, default passwords, shared credentials, and open internet ports across small and mid-size utilities.
Source · EPA Enforcement Alert 2024
$69K/day
SDWA civil penalty exposure per violation
EPA may pursue civil penalties up to $71,545 per day under SDWA §1414, plus criminal exposure under 18 U.S.C. §1001 for false certifications.
Source · 40 CFR §19 · EPA AWIA Materials
12
States under active cyberattack — and your utility is the target profile
CISA Advisory AA26-097A (July 2026) documents Iranian-affiliated actors exploiting internet-exposed PLCs in water systems across 12 states. Attack vectors: default credentials and open HMI ports — the exact gaps your RRA is supposed to document and close. If you haven't certified, you don't have a documented posture. That matters to EPA and to attackers.
Source · CISA Advisory AA26-097A · July 2026

KORVA Sentinel tracks AWIA §2013 cybersecurity compliance for U.S. community water systems — risk assessments, emergency response plans, incident reporting, and certification evidence across 17 federal and state mandates. Built for continuous AWIA compliance — and the active cyberattack campaign targeting water utilities across 12 states right now.

See the platform →

From chaos to certifiable evidence in three steps.

No security team required. No consultants on retainer. Built for the utility GM, the operations director, and the lone IT contractor who got handed the cyber file.

01
Subscribe

Configure your utility profile

Enter SDWA ID, population served, system class, and state. Sentinel auto-loads every requirement that applies — federal, state, and sector-specific — with deadlines pre-mapped to your compliance cycle.

02
Comply

Work the dashboard, not a binder

Status by requirement. Risk by domain. Evidence binder per control. AXIOM AI advisor explains regulator language in plain English. Templates, checklists, and SOPs auto-generated for your size class.

03
Certify

Produce the proof on demand

One-click certification packets. Inspector-ready files. CIRCIA-ready incident workflows with timestamped escalation. Annual review attestations and 5-year retention handled automatically.

Every mandate. Every deadline. One screen.

app.korva.systems · sentinel · tri-county-tx-0047
LIVE
Compliant
7
requirements met
Action Now
5
immediate
In Review
3
pending
Upcoming
2
90 days
Score
58%
posture
Compliance Posture
58 / 100
Requirement
Deadline
Status
Risk
Default Credential Elimination
Unitronics PLC-1, Micro850 PLCs · CISA AA26-097A
PAST DUE
ACTION NOW
CRITICAL
Emergency Response Plan (ERP)
Cyber incident section missing · Annual review overdue
PAST DUE
ACTION NOW
HIGH
Risk & Resilience Assessment (RRA)
AWIA §2013 · Deadline passed June 30, 2026 · Penalty clock running
PAST DUE
ACTION NOW
CRITICAL
RRA Recertification Submission
EPA filing · Not submitted · Active EPA violation since July 1
PAST DUE
ACTION NOW
CRITICAL
CIRCIA 72-Hour Incident Reporting
6 U.S.C. §681b · Reporting officer not designated
OCT 01 2026
UPCOMING
MEDIUM
OT/IT Network Segmentation
DMZ architecture documented · Next review Q1 2027
ONGOING
COMPLIANT
LOW
MFA & Remote Access Control
VPN + MFA active on all endpoints · Vendor access verified
ONGOING
COMPLIANT
LOW
— Actual product UI · Tri-County Water District #7 · AXIOM advisor embedded —

One system. Every mandate.

Sentinel maps the full regulatory topology — federal, state, sector, and insurer-driven — to your specific utility profile, then operationalizes the work.

5-year recertification, on autopilot.

Risk & Resilience Assessment and Emergency Response Plan tracking with deadline-aware certification workflow. Pre-mapped templates for systems under 50,000. EPA Administrator certification packet in minutes.

  • RRA template pre-populated for your size class
  • ERP must-update window tracked from RRA
  • Cyber, physical, chemical, financial scope
  • 5-year document retention, EPA-request ready
  • Signed certification with chain-of-authority
  • Wastewater (WWTP) voluntary parallel coverage
Authority · AWIA §2013 · SDWA §1433 · EPA Enforcement Alert 2024

Close the gaps EPA inspectors are finding.

Default password elimination. OT/IT segmentation. MFA on remote access. Asset inventory. ICS-CERT advisory tracking. Full WaterISAC Fundamentals coverage, mapped to your devices.

  • Device-by-device default credential remediation
  • Network segmentation architecture documentation
  • MFA enrollment tracking — staff & vendor
  • Asset inventory: PLCs, HMIs, RTUs, sensors
  • CISA Malcolm IDS integration guidance
  • 30-day patch cadence with audit log
Authority · CISA AA23-335A · AA26-097A · WaterISAC 12 Fundamentals · NIST CSF 2.0

72 hours. 24 hours. The clock starts whether you're ready.

Pre-built incident workflows with timestamped escalation, regulator-ready notice templates, and decision trees that walk you through "is this a covered incident?" in real time.

  • CIRCIA 72-hour covered incident workflow
  • Ransomware payment 24-hour separate report
  • NY DEC 24-hour oral / 30-day written
  • NY DOH 24-hour public health hazard
  • FBI IC3 + OFAC sanctions checklist
  • Forensic evidence with chain of custody
Authority · CIRCIA 2022 · 6 U.S.C. §681b · NY DEC · NY DOH

Your state's rules, plus the ones coming next.

New York's three-rule cyber stack. Indiana SEA 459. Texas TCEQ. New Jersey WQAA. Every active state mandate and every bill in committee — so you never get blindsided by a deadline.

  • NY DOH Appendix 5-E (community water >3,300)
  • NY DEC 6 NYCRR Parts 616/650/750 wastewater
  • NY PSC Part 1200 (water-works >50,001)
  • Indiana SEA 459 — annual CVA + biennial cert
  • Texas TCEQ 30 TAC §290.41 self-assessment
  • Legislative monitor — bills, drafts, comments
Authority · NYS DOH · NYS DEC · NYS PSC · IDEM · TCEQ

The compliance advisor on every question.

AXIOM is trained on the full federal and state water-cyber regulatory corpus — and on your specific utility profile. Ask anything in plain English. Get answers tied to your actual deadlines and your actual next move.

  • Plain-English explanation of any regulation
  • "What's at stake if I miss this deadline?"
  • Context-aware to your utility profile
  • Saves conversation history per requirement
  • Generates SOPs, policies, and templates
  • References federal & state statutes inline
Powered by · Anthropic · Claude

When EPA shows up, the file is ready.

Every artifact a regulator can ask for, organized, versioned, and producible in under five minutes. Asset inventories. Credential policies. Training records. Incident logs. Self-assessment forms. Certification packets.

  • Document version history with sign-off
  • 10-day NY PSC document production ready
  • 5-year retention auto-managed (AWIA)
  • Annual review attestation generator
  • Board / senior officer report exports
  • Audit packet — one-click compile & export
Authority · AWIA Retention · NY PSC Part 1200 · Indiana SEA 459

Your regulatory expert, on call.

Built on the full federal and state water-cyber regulatory corpus, and tuned to your utility's specific profile. AXIOM explains AWIA in plain English, walks you through the CIRCIA decision tree in real time, and drafts the SOPs you'd have paid a consultant $5,000 to write.

  • Plain-English regulation explainers
  • Context-aware to your utility
  • Generates policies, SOPs, templates
  • Inline statute references
AXIOM
SESSION · LIVE
YOU
The June 30 deadline passed and we're not certified. What's our exposure?
AXIOM
Tri-County Water District #7 is now in active SDWA §1433 violation. The June 30, 2026 deadline has passed — civil penalty exposure of $71,545/day began July 1. EPA's enforcement posture on AWIA has intensified, and the current cyberattack campaign hitting 12 states puts uncertified utilities in a dual exposure position. The fastest path is an expedited RRA and ERP with documented remediation intent. Want me to build the certification packet now?
Ask AXIOM about your compliance posture...
Built for every U.S. water system facing federal and state cyber mandates
AWIA§2013 SDWA§1433 / §1431 CISAOT & ICS CIRCIA2022 NISTCSF 2.0 AWWAG430-24
NY DOHAppendix 5-E NY DEC6 NYCRR 616/650/750 NY PSCPart 1200 IndianaSEA 459 TexasTCEQ §290 WaterISAC12 Fundamentals
"
We spent six weeks of staff time and $14K of consultant hours on the first cycle. With Sentinel, we did the second recertification in a single Saturday — and the inspector packet was already organized. This is what compliance was supposed to feel like.
— Utility General Manager Community Water System · 12,400 Population · Texas

Questions a utility GM actually asks.

If yours isn't here, ask AXIOM directly — or talk to a KORVA compliance lead.

My utility serves under 3,300. Does any of this apply to me?
AWIA §2013 only applies to community water systems serving more than 3,300, and most state cyber rules use the same threshold. But CISA OT guidance, EPA enforcement posture, insurer underwriting, and several state laws (Indiana SEA 459 covers smaller facilities) still touch you. KORVA Sentinel scopes the regulatory map to your specific profile.
We already paid a consultant for our RRA in 2021. Why do we need this?
AWIA requires recertification every 5 years. Your 2021 RRA expired this cycle. The second recertification deadline for systems serving 3,301–49,999 was June 30, 2026 — that date has now passed. If your system has not yet certified, you are in active EPA violation. KORVA can help you achieve certification now and document your remediation effort, which matters significantly in any enforcement conversation.
Is CIRCIA actually live yet?
Not as of May 2026. CISA's final rule is expected Q4 2026. But the smart move is to build your reporting workflows now — not after the rule drops with a 72-hour clock attached. Sentinel pre-builds the workflows so when CIRCIA goes final, you flip a switch instead of building a process under deadline pressure.
We're in New York. How does Sentinel handle the three new state rules?
NY DOH Appendix 5-E (drinking water, effective March 11, 2026, full compliance January 1, 2027), NY DEC 6 NYCRR Parts 616/650/750 (wastewater, effective March 26, 2026), and NY PSC Part 1200 (covered utilities, effective June 1, 2026) are each separately tracked in Sentinel with their distinct deadlines, reporting windows, and certification cycles.
What happens if EPA inspects us tomorrow?
If you're a Sentinel subscriber: the inspector-ready file is already organized. Asset inventory, credential policy, training records, RRA, ERP, certification — all producible in under five minutes. EPA's 2024 Enforcement Alert specifically called out the absence of these artifacts in the 70%+ of utilities found in violation.
How is this different from hiring a managed cyber service?
Managed cyber services deliver controls. Sentinel delivers defensible evidence of controls. Most utilities have at least some controls in place — what they lack is the documentation, certification packet, and audit trail that proves it to a regulator or insurer. Sentinel is built for that gap.
June 30, 2026 · DEADLINE PASSED — Violation exposure is active

Built for America's water authority — community, non-community, and the systems Washington forgot.

The penalty clock is running.
12 states are under active attack.
Get compliant now.

→ Check My Compliance Status → See Pricing