Water security has been a growing conversation for years. What’s different now is that we’re no longer talking about hypothetical risks, we’re responding to real ones.
Cyberattacks have disrupted operational systems at water facilities across multiple U.S. states. Federal agencies have confirmed these aren’t isolated incidents. Federal agencies have reported cyber incidents affecting water facilities in multiple U.S. states and have warned of continued activity by sophisticated threat actors.
Utilities that understand the landscape and take measured, informed steps are well-positioned to protect their operations, communities and people.
Why Water Utilities Are in the Spotlight
Water and wastewater utilities haven’t traditionally been at the center of cybersecurity conversations. For most of the past decade, the bulk of security investment flowed toward energy, finance and defense. That is changing and for the right reasons.
Here are three factors that make the water sector uniquely important to protect:
The stakes are immediate and visible: When water service is disrupted, the effects are felt right away, by hospitals, fire departments, businesses and families. Communities simply can’t absorb prolonged outages, which makes continuity of service one of the most important responsibilities a utility leader carries.
Legacy systems in today’s environment: Many utilities connected industrial control systems directly to the internet to manage sprawling service areas. Those systems weren’t initially designed with today’s threat landscape in mind. Modernizing them doesn’t have to be overwhelming, but it does need to be intentional.
Attention from adversaries is growing: Government and industry reporting has documented cyber threats and incidents involving water utilities in several regions.
The Regulatory Framework: What AWIA Provides
America’s Water Infrastructure Act (AWIA) gives utilities a clear starting point. Under Section 2013, community water systems serving more than 3,300 people are required to develop and certify two documents with the EPA:
- Risk and Resilience Assessment (RRA): A structured look at where your utility is most exposed (across physical security, cyber systems, chemical storage and operational technology) and how those exposures stack up against real-world threats.
- Emergency Response Plan (ERP): A practical playbook that defines exactly how an organization responds when something goes wrong, whether that’s a cyberattack, a physical breach or a supply disruption.
Both require recertification every five years, but the utilities that get the most value from this process are the ones that treat it as a living discipline. Keeping assessments current, reviewing access points regularly and stress-testing response plans can help utilities evaluate and update their security posture as the threat landscape evolves.
Where to Start: Five Actions That Make a Real Difference
A comprehensive security overhaul takes time, but meaningful risk reduction does not have to wait. The following actions can be initiated without delay.
1. Audit and Remove Unnecessary Internet Exposure
Every programmable logic controller (PLC), human-machine interface (HMI), and remote terminal unit (RTU) should be reviewed. Any interface that does not require public internet access should be removed from exposure immediately. Where remote access is operationally necessary, encrypted connections and can help utilities evaluate and update their security posture as the threat landscape evolves.
2. Eliminate Default Credentials Across All Field Assets
Default credentials on cellular modems and industrial routers are publicly known. Replacing factory-default passwords across every field device is an important foundational action that can help limit exposure associated with default credentials.
3. Enforce Strict IT/OT Network Separation
Administrative networks covering billing systems, email and staff connectivity must be fully isolated from the operational technology networks that govern SCADA systems, chemical dosing and pump controls. A compromised endpoint on the administrative side should have no technical pathway to plant floor systems.
4. Conduct Physical Security Reviews at Remote Sites
Physical and cybersecurity are inseparable in practice. Perimeter fencing, access controls, intrusion detection systems and camera coverage at pump stations, water towers and chemical storage facilities are integral components of a complete security posture.
5. Train and Exercise Manual Operations Capability
When SCADA systems are taken offline due to an intrusion or a deliberate isolation decision, operations staff must be capable of maintaining service manually. That level of readiness requires regular, structured field exercises and cannot be sustained through documented procedures alone.
These five actions may not be a complete security program, but they are the starting point of one. Together, these steps can support efforts to identify and manage exposure and develop a more comprehensive security program over time.
Next Step: TRC Can Help
Building a security program that holds up under real-world conditions takes more than the right framework, it takes experienced partners who understand the operational demands of running a water system day to day. Our consultants bring decades of hands-on experience across physical and cybersecurity disciplines, including AWIA compliance work spanning multiple certification cycles.
Whether you are approaching your first certification, preparing for recertification or looking to strengthen your program in between, we are ready to meet you where you are. Reach out to begin the conversation.
