New York issued 18 cybersecurity RFPs in October 2026 alone, against a 12-month monthly average of roughly 2.8, a 535% spike that shows up across 12 distinct agencies, from water utilities in Ogdensburg and Cortland to Niagara and Westchester counties, Nassau Community College, the Niagara Frontier Transportation Authority, and the state's own Office of Homeland Security. The breadth rules out a data artifact. What it looks like, in procurement terms, is a compliance countdown.
The countdown started on March 11, 2026, when Governor Hochul signed Appendix 5-E (10 NYCRR Part 5), the first mandatory, enforceable cybersecurity framework for public water and wastewater systems in the United States. The regulation covers roughly 318 New York water systems serving more than 3,300 people. By January 1, 2027, those systems must have cybersecurity vulnerability assessments completed, incident response plans written, operator training underway, and operational technology segmented from administrative IT networks. For most of these utilities, small municipal water authorities with no prior federal cybersecurity compliance history, none of that existed eight months ago.
The mechanism linking a March regulation to an October RFP wave is specific. The state's SECURE program (Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements), funded through a state appropriation and administered by the Environmental Facilities Corporation, made its inaugural $9 million in grants to 153 local water projects on August 3, 2026. The grants come in two sizes: $50,000 for vulnerability assessments and $100,000 for implementation upgrades. EFC delivered grant agreements to recipients before the end of September. Once a utility has a signed grant agreement obligating state dollars toward a specific compliance purchase, it must issue an RFP. That sequence, regulation in March, grants in August, agreements in September, RFPs in October, is the procurement pipeline now showing up in the data.
Separately, federal dollars have been moving through a different channel. New York's Division of Homeland Security and Emergency Services holds an $8.9 million active award under the federal State and Local Cybersecurity Grant Program, jointly administered by FEMA and CISA, running through December 2028, plus a newer $2.9 million award that started in September 2025. In February 2026, $9 million from that federal program went to 161 New York counties, municipalities, school districts, and public authorities to deploy multi-factor authentication, a separate initiative from the water-system compliance chain, but one that seeded cybersecurity procurement relationships across the same local governments now responding to Appendix 5-E. The LGEG (Local Government Efficiency Grant) program, a state appropriation renewed in 2026 at $8 million, funds broader collaborative technology projects among local governments, including cybersecurity, though it operates independently of the water compliance mandate.
The two policies driving October's surge are distinct and should be read as such. Appendix 5-E is a regulatory obligation with a hard legal deadline. The SECURE grant program is state money specifically designed to make that obligation affordable, with grant amounts calibrated to the two procurement types the regulation requires. Acting Chief Cyber Officer Michaela Lee cited a surge in cyberattacks targeting water systems nationwide as the impetus for the rulemaking, and the regulation's drafters at DEC and DOH designed the SECURE program in parallel, explicitly so that localities would have funding ready when the mandate kicked in.
What the October data shows is that design working as intended, at scale, under time pressure. A utility that received a SECURE assessment grant in August and signed its EFC agreement in September has roughly 90 days to issue an RFP, select a vendor, complete the vulnerability analysis, and have findings in hand before compliance documentation is due. For systems that received implementation grants rather than assessment grants, the timeline is tighter still: implementation work cannot start until an assessment is complete.
For residents of the 318 covered service areas, the practical stakes are concrete. Water and wastewater systems have become frequent ransomware targets nationally, and New York's regulation is designed specifically to close the gap between operational technology networks, the SCADA systems controlling pumps, valves, and treatment processes, and the administrative IT systems that have historically provided attackers a lateral path in. The OT/IT segmentation requirement is the technically demanding piece; it is also the most expensive, which is why the $100,000 implementation grant exists.
The next signal to watch is January 1, 2027 itself. The regulation's authors have not publicly specified enforcement consequences for systems that miss the deadline, but the state's posture, first-in-nation rules, paired grant program, explicit national-model framing, suggests inspections and enforcement guidance will follow shortly after the deadline passes. Systems that have not issued RFPs by now are running out of runway to procure, assess, and implement before the calendar turns.
