What was announced
On 20 October 2026, Accenture, Dragos and the SANS Institute announced the Community Cyber Resilience Foundation, a nonprofit aimed at OT security for under-resourced US water, wastewater, electric and natural gas utilities (Accenture newsroom). The three partners commit roughly $10 million in funding and services. The first phase covers up to 500 utilities, and applications go through ccrfoundation.org, according to the Accenture release. We have not opened that site, so treat the application route as vendor-stated.
SecurityWeek (coverage dated 21 October) and The Record (report) carry the same core facts.
Who is eligible
US-based utilities with under $100 million in annual revenue. The partners say that covers more than 50,000 organisations, or over 97% of US utilities. That figure is the companies’ own estimate; both press reports note it is not independently verified.
What participants get
Per the Accenture release:
- Dragos: the Dragos Platform and related services for asset visibility and threat detection. This builds on the Dragos Community Defense Program, which the release says already gives more than 100 utilities free platform access.
- Elastic: the primary log storage and query engine inside the platform.
- Accenture: deployment services, including configuration, integration and ongoing support.
- SANS: ICS/OT training so staff can run the tooling themselves.
- Hardware: foundation funding for the equipment needed to run the platform.
- Peer network: a community of utilities sharing operational experience.
The practical point is the hardware and integration line. For a small water utility, the barrier to passive OT monitoring is rarely the licence alone. It is the sensor, the SPAN or TAP feed, the person who can build it, and the person who will read the alerts. Bundling those is the interesting part of this offer. That is our assessment, not a claim from the partners.
Why now
The Accenture release cites a recent surge in attacks on more than 100 US water systems across over a dozen states. Neither SecurityWeek nor The Record details those attacks, so we cannot characterise them here. The Record adds that federal efforts to improve utility cybersecurity have stalled, leaving states to build their own frameworks, and that the National Rural Water Association launched a separate programme with five managed detection and response providers after attacks on water utilities in July. We did not open sources on that separate programme.
SecurityWeek also notes the launch follows Accenture’s agreement, four months earlier, to acquire a majority stake in Dragos. We did not independently verify that deal.
Open questions
The sources disagree or are silent on several things practitioners will care about:
- Duration. The Record says there is no time limit on participation. SecurityWeek says the announcement does not say how long free support lasts. Until the foundation publishes terms, assume nothing.
- Funding split. SecurityWeek notes the split between cash and services is not stated.
- Selection. SecurityWeek reports no details on how utilities are selected and no timeline beyond phase one. The Record says phase one may expand depending on success.
- Government role. The Accenture release mentions none, and The Record states no federal or state agencies are part of the programme.
- Vendor lock-in. All participants land on one vendor’s platform. The sources do not say what happens to data or deployments if a utility leaves. This is our question, not a reported issue.
What this means for small operators
If you are a qualifying utility, the sensible move is to ask for written terms before applying: data ownership, who has remote access to the sensors, what Accenture can see, and what happens at the end of support. Monitoring without response capacity just produces alerts, so pair any deployment with an incident plan and a named owner.
If you are not eligible, the baseline work still applies and costs far less: an asset inventory, remote access that needs MFA, and no direct internet exposure of PLCs or HMIs.
We will update this piece when the foundation publishes programme terms.