Cybersecurity in Water & Wastewater: Getting the Fundamentals Right

Below is a summary of cybersecurity actions. Download our full thought leadership article for a detailed breakdown of each control area, practical implementation considerations, and guidance tailored specifically to water and wastewater operational environments.

Ransomware attacks against municipalities continue at a steady pace — and water and wastewater utilities are increasingly becoming targets of nation-state threats aimed at infiltrating operational systems and causing real-world harm. Federal indictments tied directly to SCADA and public water systems underscore a critical truth: this is no longer theoretical risk. It is operational reality.

As regulatory scrutiny increases from agencies such as the EPA, DHS, and FBI, utilities are facing growing pressure to strengthen cybersecurity planning. Yet most successful attacks are not the result of highly

sophisticated tactics. They stem from missing fundamentals — phishing, credential misuse, weak access controls, and poorly segmented systems.

Guidance from the EPA, American Water Works Association (AWWA), and WaterISAC consistently points to the same starting place: focus on foundational controls before pursuing advanced maturity models. For most utilities, especially smaller or resource-constrained systems, progress begins not with “best-in-class” frameworks, but with practical, defensible steps that immediately reduce risk and operational consequences.

The fundamentals include:

· Clear cybersecurity ownership and accountability

· Regular training focused on phishing and social engineering

· Asset awareness across SCADA and OT environments

· Strong access control and credential discipline

· Purposeful IT/OT network separation

· Tested backups and recovery procedures

· Basic monitoring and logging visibility

· Vendor and third-party access controls

· HR-driven insider risk management

· A defined and exercised incident response plan

These are not advanced practices — they are baseline expectations. When implemented consistently, they meaningfully reduce attack paths, limit operational disruption, and build a foundation for long-term maturity.

For utilities, cybersecurity must be treated the same way we treat safety and reliability: as a routine operational requirement. The goal is not perfection overnight. The goal is to start where you are, prioritize high-value controls, and build steady momentum.