Water utilities depend on operational technology to run treatment plants, pumping stations, reservoirs and distribution networks. These systems were designed first for safety and reliability. Cybersecurity must therefore be managed as part of the same operational obligation: keeping essential water services safe and available.

Connectivity brings real value through remote support, telemetry, analytics and enterprise integration. It also creates trusted pathways into systems that were not designed for today’s threat environment. A utility can pass an audit and still be unable to isolate a compromised connection, sustain operations without central visibility or restore a critical configuration with confidence.

For leaders, the central question is not whether every attack can be prevented. It is whether the service can continue safely when prevention fails.

Treat Cyber Risk as Operational Risk

A cyber event in water operations can affect process visibility, control integrity, equipment availability, safety, environmental performance and recovery. The objective is therefore not simply to protect a network. It is to protect an operational outcome.

Investment decisions should reflect service consequence, asset criticality and recovery dependency, not technical severity alone. This shifts attention from isolated vulnerabilities to the pathways that could interrupt water service.

Five pathways deserve sustained attention:

IT-to-OT movement through shared identities, endpoints or services.

Remote access that is exposed, weakly authenticated or left open longer than required.

Supplier access and software trust that are not fully governed or attributable.

Legacy OT, insecure protocols and incomplete asset or architecture records.

Shared accounts and excessive privilege that weaken accountability.

Figure 1. A cyber incident becomes a service event through a chain of trusted pathways.

Build Resilience Around Service Continuity

A practical resilience model starts with the water service that must continue. Governance, controls and evidence exist to support that outcome, rather than operate as a parallel security programme.

• Service continuity: define the services, customers and processes that must remain safe and available.
• Operating model: connect leadership, operations, engineering, cybersecurity, asset management and suppliers.
• Control layer: manage identity, segmentation, monitoring, remote access and recovery.
• Evidence layer: maintain current inventories, architectures, dependencies, logs, backups and ownership.
• Test and learn: exercise isolation, restoration, incident response and degraded operation, then improve the design.

Prove Isolation and Recovery

Documentation is necessary, but it is not proof. Leaders should be able to answer five questions with current evidence:

• Which water services must continue during a cyber incident?
• Which OT assets, enabling systems and trusted connections support them?
• Who can isolate a compromised pathway, and under what authority?
• Can operations continue safely in local, manual or degraded mode?
• Can systems be restored from trusted configurations, and has restoration been tested?

Move from Facts to Design to Proof

A disciplined transformation can be organized across three horizons:

Stabilize. Validate critical assets and connections, reduce uncontrolled privilege and supplier access, close unnecessary exposure, and confirm that isolation and recovery work.

Industrialize. Implement repeatable segmentation, passive monitoring, supplier governance, incident playbooks, security-operations integration and cross-functional exercises.

Optimize. Automate evidence, integrate lifecycle and vulnerability decisions, simplify platforms and establish continuous assurance across sites.

Figure 3. Stabilize first, industrialize second and optimize only when supported by evidence.

Measure Outcomes, Not Activity

A useful resilience scorecard connects security activity with operational readiness. Measures should cover critical-asset visibility, trusted connections, privileged access, supplier access duration, containment time, isolation-test success, manual-mode readiness, restoration success, unsupported components and repeat findings.

Every measure should be assessed against the utility’s own baseline. A control that improves a dashboard while making safe operation or recovery harder is not a successful outcome.

A Practical Leadership Agenda

• Start with the essential water service, not the security product.
• Map the assets, enabling systems, trusted connections and suppliers on which that service depends.
• Make decision rights explicit for isolation, operational change and risk acceptance.
• Test degraded operation and restoration from trusted configurations.
• Simplify tools and site variation only where resilience is maintained or improved.
• Use exercises, incidents and recovery tests as the evidence base for continuous improvement.

Cyber resilience is not measured by the number of controls deployed. It is measured by what a utility can still do when trust fails: protect the vital service, contain impact, continue safely and recover with confidence.

Selected References

[1] National Institute of Standards and Technology. SP 800-82 Rev. 3, Guide to Operational Technology Security. September 2023.

[2] National Institute of Standards and Technology. Cybersecurity Framework 2.0. February 2024.

[3] Cybersecurity and Infrastructure Security Agency. Water and Wastewater Cybersecurity.

[4] Australian Signals Directorate. Principles of Operational Technology Cyber Security. October 2024.

[5] American Water Works Association. Water Sector Cybersecurity Risk Management Guidance and Assessment Tool.

[6] U.S. Environmental Protection Agency. Securing the Future of Water: Addressing Cyber Threats Today. July 2025.