The audit asks how exposed the country's water and wastewater systems are to cyber attack, and what the federal government is doing about it; the cases below trace a single problem through four stages. At the operator end, improving cybersecurity is voluntary while delivering clean and safe water is not, so it loses the contest for money, and what investment there is runs into skills gaps and equipment too old to patch. The tool the agency gives systems for assessing their own risk has never been peer reviewed, so the sector's picture of itself rests on an untested instrument. Above that, no sector-wide risk assessment has been made at all, leaving federal action without a risk-informed strategy to aim it. And nobody knows the true extent of what has already happened, because incident reporting is still being designed - and the rules as drafted would exempt most of the sector from it. About 170,000 water and wastewater systems make up the US water sector. Cyber incidents over the past five years have already disrupted system operations. The national incident-reporting rules being developed would exempt almost 80 percent of those systems. A water infrastructure act requires drinking-water systems to assess risk and resilience and to maintain emergency response plans. Homeland-security and critical-infrastructure statutes, with a national protection plan and a presidential security memorandum, assign responsibility for the sector. A separate act on cyber incident reporting for critical infrastructure is the basis for the reporting rules still being written. The sector has made limited investment in cybersecurity: systems put funding first toward their regulatory duty to deliver clean and safe water. Improving cybersecurity is voluntary, so it competes for money against obligations that are not. Federal and non-federal bodies issue alerts and advisories, run outreach, fund research and distribute best practice - activity not steered by any assessment of where the risk actually sits. The self-assessment tool offered to water systems has never been peer reviewed. Workforce skills gaps and technology too old to update easily slow protection at the operator end. No comprehensive sector-wide risk assessment exists, and no risk-informed strategy guides federal action. The full extent of incidents and their consequences is unknown, because reporting is not yet required. The reporting rules under development would leave almost 80 percent of systems outside them. Federal agencies 'reported challenges such as workforce skills gaps and older technologies that are difficult to update with cybersecurity protections. Further, the sector has made limited investments in cybersecurity protections because water systems prioritize funding to meet regulatory requirements for clean and safe water, while improving cybersecurity is voluntary.' Guidance that asks rather than requires, set against duties that do require, with the gap widened by the Human capital and the ageing Assets available to close it. To help drinking water systems conduct risk and resilience assessments and develop emergency response plans, as required, the agency developed a Vulnerability Self-Assessment Tool. 'However, EPA has not had VSAT peer reviewed to ensure the tool provides systems with sound and credible information.' A Product released into the sector without the Testing that would establish it, so the sector's picture of its own risk rests on an unverified instrument. The agency 'has not conducted a comprehensive sector-wide risk assessment or used a risk-informed strategy to guide its actions to improve the water sector's level of cybersecurity'. The audit office had previously found that a risk-informed strategy improves the effectiveness of agency efforts to build critical-infrastructure cybersecurity programmes. A Goal-setting absence upstream of everything else: without the assessment there is no Design basis for choosing what to do first. 'Cybersecurity incidents in the U.S. over the past 5 years have disrupted water and wastewater system operations. However, the full extent of such incidents and their consequences are unknown because national level cybersecurity incident reporting requirements are under development, and water and wastewater systems have not yet been required to report incidents to the federal government.' Officials add that the national-level requirements as drafted 'would exempt almost 80 percent of water and wastewater systems from reporting'. Incident management with no Reporting obligation behind it, which leaves the regulator without the evidence its own strategy would need.