In March, the U.S. Environmental Protection Agency proposed a new rule to require states to audit the cybersecurity of water systems. It was short-lived. Three states — Arkansas, Missouri and Iowa — sued, accusing the agency of overstepping its authority and a federal appeals court promptly suspended the rule.