Committee debates cybersecurity language for smart meters; agency urges council‑driven guidance not permit conditions
Get AI-powered insights, summaries, and transcripts
Sign Up Free
Summary
Witnesses urged the committee to place nonbinding cybersecurity guidance for smart metering under the Cyber Advisory Council and the secretary's duties rather than in permit conditions. Testimony emphasized meters monitor exterior pipe vibrations, not in‑home activity, and warned that technology and standards (NIST) evolve quickly.
The Natural Resources & Energy committee on Feb. 24 heard technical testimony on S‑213, a bill that includes language on smart metering and cybersecurity for public water systems. Denise Riley, representing the Agency of Digital Services, told the committee she recommends placing cybersecurity guidance with the Cyber Advisory Council and under the secretary’s duties rather than embedding technical cybersecurity conditions in permitting.
Riley said the Cyber Advisory Council—created by statute and comprised of representatives from critical infrastructure sectors—meets regularly, issues annual reports and provides a nonregulatory forum for sector best practices. "The council meets, at this point, we're meeting every other month because we've broken up into subcommittees," Riley said, describing how the council gathers sector input and issues recommendations.
On smart meters, Riley said the devices used by water systems typically monitor external pipe vibrations and flow to detect leaks, and do not observe in‑home usage or connect to treatment plant operational technology. "It's monitoring the water distribution in the pipes, and it's monitoring for sound in the pipes," she said, adding that meter data syncs to a town account and does not touch the operating system of the water treatment facility.
Riley urged the bill avoid highly specific technology definitions (for example, distinguishing wired from wireless meters) so the statute does not rapidly become obsolete as standards evolve: "Technology is advancing at a rapid rate ... that's a high risk to being super specific in bill language when it comes to technology." She recommended that the Cyber Advisory Council issue nonbinding guidance for public water systems "upon the request of the secretary," and the committee debated whether statutory wording should use ‘request’ rather than ‘allow’ to avoid creating unclear lines of authority.
Bridal Redmond, director of the Drinking Water [Grower] Protection Division, told the committee she supported placing aspirational guidance in the secretary's authority under 16 72 as a non‑rulemaking, advisory approach. Testimony also pointed to federal grant funding (referred to in testimony as SSMGP) that can help municipalities conduct cyber assessments and adopt council recommendations.
Committee members and witnesses discussed alternative statutory placements (permit conditions under 1675/1672 versus a new subsection under 16 72 or Title 30 for electric/gas utilities) and flagged potential complications for electric and gas utilities because of federal cybersecurity requirements. Committee members also noted wording edits remain in progress, including replacing the term "electric company" with "utility distribution service organization."
No vote on the cybersecurity language was recorded; the committee continued to request drafting edits and clarifications.