Board briefing · Decision-maker perspective · Published: September 30, 2026
Table of Contents
Key Takeaways
- The baseline is already written down. The joint CISA–EPA–FBI fact sheet “Top Cyber Actions for Securing Water Systems” lists eight actions: reduce internet exposure, assess regularly, change default passwords immediately, inventory OT/IT assets, exercise incident response and recovery plans, back up OT/IT systems, reduce vulnerability exposure, train staff [1].
- The threat is not hypothetical. In a 30 July 2026 alert, CISA reported a significant increase in actors targeting water-sector PLCs — attackers changed passwords to lock operators out, changed IP addresses to disconnect equipment, and triggered boil water notices and sustained manual operation [2].
- Internet-exposed HMIs are a scanned-for weakness. EPA and CISA warn that exposed HMIs let outsiders read screens, maps and event logs, and make changes that disrupt water and wastewater operations [3].
- The regulatory picture is messier than most board packs suggest. EPA’s March 2023 interpretive memorandum would have required states to evaluate ICS/OT cybersecurity during sanitary surveys; EPA withdrew it in October 2023 after litigation [5]. The pressure behind it has not gone away, but the federal hook currently isn’t there — don’t build a program on a memo that may not survive the next court date.
- IEC 62443 gives boards a shared vocabulary: split OT into zones and conduits, assign each a target security level (SL 1–4), apply the seven foundational requirement families in proportion to risk [4].
- All five moves below can start this quarter with existing staff and a modest budget, and each one leaves a check a board can actually verify.
Why This Reached the Board Agenda
Water and wastewater utilities run operational technology — SCADA servers, PLCs, RTUs, dosing controls, and the sensor networks feeding them — right next to business IT. Federal guidance is blunt about the result: these OT and IT systems are too often vulnerable, and a compromise can disrupt service with knock-on effects on public health [1].
Three things pushed the topic from the engine room to the boardroom.
First, the attackers simplified their playbook. CISA’s July 2026 alert describes a marked increase in activity against water-sector PLCs. Intruders modified device passwords to lock out operators and changed IP addresses to cut equipment off, and utilities ended up issuing boil water notices and running manually for days. The alert stresses that entities of every size are being hit, including those with mature security programs, and urges operators to get publicly exposed PLCs and other OT off the internet as soon as they can [2].
Second, the attack surface is searchable. EPA and CISA routinely find internet-exposed HMIs through public scanning platforms. Without protective controls, those HMIs let uninvited users view the operator interface, distribution maps, event logs and security settings — and change things with the potential to disrupt treatment [3]. An HMI reachable from the open internet is a control-room door with the latch taken off.
Third, the regulatory floor. Here the story is less tidy than it was sold. EPA’s March 2023 interpretive memorandum directed states to evaluate whether an ICS or other OT used in a surveyed public water system had adequate cybersecurity, and to require correction of significant deficiencies [5]. Then came litigation from states and trade associations, and EPA rescinded the memo that October [5]. So the federal requirement boards were bracing for never took effect — and that is exactly why it is a poor excuse to wait. Utilities in states that kept asking the questions, insurers, and customers upstream in the supply chain are all still asking. Cybersecurity posture is drifting from voluntary program toward inspection outcome, memo or no memo.
The First Five Moves
These five sequence the joint federal guidance [1] into something a mid-sized utility can start on Monday. The order is deliberate: you cannot protect, segment or rehearse around assets you have never enumerated.
| Step | Action | Board-level check |
|---|---|---|
| 1. Inventory | Enumerate every OT/IT asset: controllers, HMIs, RTUs, sensors, historians, links [1] | A named owner and a current list exist — with internet-facing devices flagged |
| 2. Segment | Separate OT from IT and from the internet using zones, conduits and a DMZ [1][4] | A network diagram exists; traffic paths between office and plant cross documented firewalls |
| 3. Remote access | Eliminate exposed PLCs/HMIs; route all remote access through controlled, monitored gateways [1][2][3] | No control device is reachable from the public internet; every remote session maps to a named person |
| 4. Patch & harden | Reduce vulnerability exposure: change default credentials, patch or compensate, back up OT/IT systems [1] | A risk-ranked patch and backup calendar exists, including devices that can only be patched at outages |
| 5. Respond & rehearse | Develop and exercise cybersecurity incident response and recovery plans [1] | A tabletop exercise has been held; manual-operation procedures are written and drilled |
Move 1 — Build the Asset Inventory
Segmentation, monitoring and response all assume you know what exists. The joint guidance puts OT/IT asset inventory among the top actions for a reason [1]. For most utilities this is a discovery exercise, not a purchase: walk the plant and the remote sites, list every controller, HMI, RTU, radio link, dosing pump controller and networked instrument, and record firmware, who owns the credentials, and network reachability. Flag anything reachable from the public internet — that flag is the input to Move 3 [1][2].
The CISA alert adds a detail worth circling: cellular modems installed by operators, vendors and integrators often sit outside the inventory because nothing scans for them [2]. They are also exactly how a pump station ends up on the open internet.
Move 2 — Segment the Network: Zones and Conduits
The architecture standard here is IEC 62443, the international series for industrial automation and control system security. Its core model partitions the environment into zones (assets sharing security requirements) joined by conduits (controlled communication channels), assigns each zone a target security level from SL 1 to SL 4, and then applies controls from seven foundational requirement families: identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability [4]. In plant terms: controls, SCADA servers and business systems stop sharing one flat network; traffic between them crosses firewalls and a DMZ; field-device networks are separated from the SCADA server network [1][4]. The standard is risk-based by design, so a small utility applies the same logic at a smaller scale instead of buying its way to an enterprise program [4].
Move 3 — Take Control of Remote Access
Remote access is where inventory and segmentation get quietly undone: a vendor support tunnel, a cellular modem on a pump station, an HMI with a port-forwarded router. CISA’s 2026 alert makes removing publicly exposed PLCs and other OT from the internet its central recommendation [2]; the EPA–CISA fact sheet says the same about HMIs, which scanning platforms find and outsiders can manipulate [3]. The corrective pattern is consistent across federal guidance: no control device directly reachable from the public internet, all remote sessions through monitored and credentialed gateways, multi-factor authentication on every path, and every session attributable to a named person with a stated purpose [1][2][3].
Move 4 — Patch, Harden and Back Up
Water OT cannot be patched like office IT. Dosing trains and disinfection systems run continuously, and some legacy controllers will never take modern firmware. The guidance therefore pairs two actions: reduce exposure to vulnerabilities (default passwords changed immediately, unused services closed, patches applied on a risk-ranked schedule) and back up OT/IT systems so that ransomware or a corrupted controller is a restore job rather than a rebuild from memory [1]. Where patching is impossible, compensating controls — tighter segmentation, restricted protocols, closer monitoring — carry the risk until replacement gets budgeted.
Move 5 — Rehearse the Response
The last move is the one boards skip most often. Develop and exercise incident response and recovery plans [1]: who declares the incident, who puts the plant on manual, who notifies regulators and the public, how systems come back from the backups made in Move 4. A tabletop that walks through loss of SCADA will surface gaps — paper procedures, missing spares, a contact tree nobody has tested — that cost hours to fix now and days to discover mid-event [1].
What to Demand From Suppliers
Every one of these five moves ends at an interface a supplier controls: a sensor with a service port, a transmitter with an undocumented protocol, an analyzer whose laptop tool ships with a fixed password. Procurement should ask instrument and system vendors for the same evidence utilities are learning to produce internally — documented network behavior, credential management, firmware update paths, and data interfaces that make inventory and monitoring easier instead of harder.
Digital-output instrumentation helps here in a concrete way. Transmitters and sensors that expose measurements over standard industrial protocols such as Modbus RTU/TCP can be enumerated, monitored and segmented with the same tools as the rest of the plant. No proprietary middleware, no opaque side channel. When you evaluate suppliers, favor the ones whose documentation reads like “documentation you can hand to your auditor”: published communication behavior, defined credential practices, specifications stable enough to design around. Shanghai ChiMay’s multi-parameter water quality sensing line, for example, documents Modbus RTU/TCP integration for both RS-485 and Ethernet connectivity as the standard path from sensor to plant control and data platforms [6] — the kind of specification a utility team can fold straight into its zone-and-conduit design [4].
The Bottom Line
No single product secures a water system. A sequence does. Inventory what exists, partition it, close the remote-access doors, keep and back up the software estate, and rehearse the bad day. All five moves come out of joint federal guidance [1], line up with the IEC 62443 architecture the industry is converging on [4], and answer questions utilities are being asked with increasing regularity [2][3][5]. Boards that fund them this quarter will be measurably ahead of both the threat curve and the paperwork.
References
- CISA (with EPA and FBI) — “Top Cyber Actions for Securing Water Systems” (joint fact sheet, February 2024): the eight priority cyber actions for Water and Wastewater Systems sector entities, including OT/IT asset inventory, reducing internet exposure, backups and incident response exercises. https://cisa.gov/resources-tools/resources/top-cyber-actions-securing-water-systems
- CISA — Alert, 30 July 2026: “CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs”: significant increase in attacks on water-sector PLCs, including password changes, lockouts, boil water notices and sustained manual operations. https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
- EPA and CISA — Joint Fact Sheet (December 2024): “Internet-Exposed Human Machine Interfaces”: risks of publicly discoverable HMIs in water and wastewater systems, including viewing screens, maps, logs and security settings and making disruptive changes. https://www.epa.gov/system/files/documents/2024-12/joint-factsheet-epa-cisa-internet-exposed-human-machine-interfaces-508c.pdf
- OPC Foundation — “Secure Deployment of Industrial Communication Protocols: A Risk-Management-Based Approach” (white paper, PDF): overview of IEC 62443 as the international IACS cybersecurity framework — zones and conduits, Security Levels 1–4, and the seven foundational requirements. https://opcfoundation.org/wp-content/uploads/2026/04/Secure-Deployment-of-Industrial-Communication-Protocols-A-Risk-Management-Based-Approach-PI-FCG-OPCF-ODVA-v01.00.pdf
- ASDWA — “EPA Releases Interpretative Memorandum Addressing Cybersecurity in Sanitary Surveys” (March 2023), and EPA — “Withdrawal of Cybersecurity Memorandum of March 3, 2023” (October 2023): the memo interpreting sanitary-survey requirements to cover ICS/OT cybersecurity, and its later rescission following State of Missouri, et al v. U.S. EPA. https://www.asdwa.org/?p=25754 ; https://www.epa.gov/system/files/documents/2023-10/action-memo_rescinding-cyber-memo_october-2023.pdf
- Shanghai ChiMay — “4-in-1 Multi-Parameter Sensor: Complete Technology Deep Dive” (technical overview): 4-in-1 multi-parameter sensor with Modbus RTU digital communication for integration with plant control and data platforms. https://chimaytech.net/ru?p=30795
About the author: Written by the Shanghai ChiMay Technical Editorial Team — the editorial group draws on the company’s systems-integration practice in digital water quality instrumentation and its interoperability with SCADA and plant data platforms.
