For nearly two decades, the cybersecurity community has produced frameworks, standards, guidance documents, best practices, assessments, alerts, roadmaps, maturity models, and incident analyses for critical infrastructure. The water sector is no exception. From federal agencies and industry associations to utilities themselves, the message has been remarkably consistent: segment networks, implement multifactor authentication, manage remote access, patch systems, train personnel, monitor activity, and prepare for incidents.

Yet water sector cybersecurity incidents continue to occur.

The uncomfortable truth is that little remains to be said about what utilities should do. The challenge is no longer a lack of guidance. The challenge is executing the fundamentals in complex environments with aging infrastructure, constrained budgets, competing priorities, and decades of accumulated technical debt. As a result, everything that needs to be said has largely already been said. What remains is the difficult work of implementation, change management, and consistent continuous improvement.

Why the Water Sector Matters Most

Water is not simply another critical infrastructure sector. It is a foundational lifeline upon which nearly every other sector depends. Reliable water and wastewater services support healthcare, emergency services, energy production, manufacturing, food processing, agriculture, and public health. A significant disruption can create cascading impacts across communities and economies.

Unlike many infrastructure sectors, water systems also occupy a unique position where cyber compromise can produce immediate physical consequences. Manipulated pumps, altered chemical dosing processes, spoofed sensor data, or disrupted treatment operations can directly affect public safety and confidence. The interconnected nature of water infrastructure means that cyber incidents can quickly become operational, environmental, and societal incidents.

The sector's importance makes the cybersecurity challenge obvious. The persistence of the challenge makes the discussion more complicated.

The Story We Have Seen Repeatedly

Consider a small-to-medium sized utility. We’ll call it “The District.”

The District is not unusual. In many respects, it looks like hundreds of water utilities across North America. It has formal cybersecurity policies, an incident response plan, dedicated operators, and trusted technology vendors. On paper, the organization appears to possess the building blocks of a cybersecurity program.

However, a closer look reveals several familiar vulnerabilities:

• Incident response documentation exists but is not regularly tested through exercises.
• Remote access pathways are present without comprehensive MFA enforcement.
• Vendor connections remain largely unmonitored.
• Critical backups are controlled by third parties rather than the utility itself.
• PLCs and workstations retain unnecessary services and weak configurations.
• Cybersecurity awareness training is inconsistent or absent.

None of these findings are novel. In fact, most appear repeatedly in federal assessments, ransomware investigations, risk and vulnerability assessments, and public guidance.

What makes The District example valuable is that it demonstrates a common reality: cybersecurity failures in the water sector are rarely caused by unknown threats. They are more often caused by known weaknesses that persist for years.

Legacy Infrastructure Impacts the Conversation

As digital modernization accelerates, utilities are connecting historically isolated systems to enterprise networks, cloud services, cellular gateways, and remote monitoring platforms. Connectivity is expanding faster than many organizations can secure it.

One reason “the fundamentals” remain difficult is that water utilities operate differently than modern IT environments. Water systems depend on legacy PLCs, RTUs, fieldbus protocols, and operating systems that were never designed with cybersecurity in mind. Many cannot support modern security features. Patching often requires operational outages, extensive testing, or vendor coordination. In some cases, upgrades risk disrupting treatment processes more than the vulnerabilities they address.

This reality explains why advice that sounds simple on paper often becomes difficult in practice. The challenge is less about understanding cybersecurity and more about applying it safely within operational constraints.

Another recurring challenge is what might be called the system integrator paradox. Many utilities depend heavily on trusted vendors and integrators for PLC programming, SCADA maintenance, remote support, and backup management. Over time, these relationships can create unintended dependencies. Utilities may discover that vendors possess the sole accurate copy of configuration files, maintain persistent remote-access pathways, or control critical recovery processes. A utility may technically own its infrastructure while lacking practical ownership of the information and capabilities necessary to recover it following a cyber incident.

Again, this is not a new discovery. However, when an attack occurs, a dependency that seemed operationally convenient can quickly become a resilience challenge. While the sector has likewise been discussing the supply chain and vendor risk for years, the issue persists because addressing it requires changing longstanding operational practices.

The Gap Between Knowledge and Execution

The water sector does not suffer from a shortage of cybersecurity frameworks.

NIST, CISA, EPA, AWWA, state regulators, insurers, auditors, consultants, and vendors have all contributed guidance. Utilities are frequently told what to do. The problem is that knowing and doing are not the same thing.

Many organizations maintain policies that exist primarily as documents rather than operational practices. Incident response plans are written but not exercised. Governance structures are established but not regularly evaluated with standardized metrics. Cybersecurity responsibilities are defined but not enforced. The result is a "paper versus practice" gap where maturity appears greater than it may be.

This challenge becomes even more difficult in environments where IT and OT remain organizationally separated. Corporate cybersecurity programs often focus on traditional enterprise risks while operational technology systems receive limited visibility or executive attention. The sector does not need another framework to explain these issues. It needs sustained operational discipline to address them.

Which leads to the elephant in the room: If there is one area that deserves more attention, it is the intersection between cybersecurity and engineering.

This is where concepts such as Consequence-Driven Cyber-Informed Engineering (CCE), physical fail-safes, hydraulic storage capacity, and "Time-to-Critical-State" become valuable. These approaches acknowledge that prevention is not perfect and instead focus on limiting consequences. Elevated storage tanks, mechanical relief valves, hardwired interlocks, overflow protections, and manual operating procedures become forms of cyber

resilience, not just operational reliability. This overlap reinforces the realization that secure by design was always the point.

The Fundamental Controls Still Matter

There is no evidence that the fundamentals have become less important. If anything, growing connectivity has made them more important than ever. Despite the emergence of sophisticated threat actors, ransomware groups, and nation-state activity, most successful attacks still exploit familiar weaknesses.

For water utilities, cybersecurity success does not come from buying more technology. It comes from prioritization. Threat modeling, consequence-based analysis, identification of critical assets, focused implementation of MFA and segmentation, controlled vendor access, offline backups, and documented manual operating procedures often deliver greater resilience than expensive tools implemented without a clear strategy.

The water sector does not need another reminder that MFA matters or that networks should be segmented. It already knows. What is missing are short-term priorities that lead to long-term security.

Security by Design Is Also Fundamental

For utility leaders, this means making cybersecurity a governance issue rather than exclusively an IT issue. It is a commitment to integrating cybersecurity into infrastructure planning, architecture, procurement, operations, maintenance, and engineering decisions from the outset rather than bolting it on later.

For engineers, it means designing systems that fail safely even when cyber protections are bypassed. For vendors, it means delivering products that are secure by default rather than leaving customers to remediate known weaknesses after deployment. For operators, it means practicing manual operations and incident response with the same rigor applied to safety drills.

Consider the following three things to prioritize for long term resilience:

1. Perform Consequence-Driven Criticality Mapping

• Target High-Consequence Assets First: Rather than attempting to apply deep cybersecurity tools across every network node equally, utilities must perform a consequence-driven risk assessment such as Idaho National Laboratory's Consequence-Driven Cyber-Informed Engineering (CCE). This identifies "crown jewels" (such as main SCADA servers, Programmable Logic Controller (PLC) dosing logic, and Remote Terminal Units (RTUs)) where a cyber compromise could cause direct physical equipment damage, water contamination, or total loss of view and control.
• Acknowledge Legacy Hardware Constraints: Legacy OT components often run unsupported operating systems, lack error logging, or cannot accept security patches without invalidating vendor warranties or risking process downtime. Framing risk around physical operational impact, rather than purely software vulnerabilities, allows operators to prioritize where compensating engineering controls are urgently needed.

2. Architect Defensive Boundaries

• Implement Architectural Isolation: Because legacy fieldbus protocols (e.g., SNMPv1/v2, Modbus, DNP3) transmit data in cleartext without authentication, security must be engineered around the network perimeter. Utilities should implement network segmentation, stateful firewalls, and an OT Demilitarized Zone (DMZ) configuration to isolate enterprise IT from critical control segments.
• Engineer Non-Digital "Safety Belts": Secure by Design assumes digital control layers can eventually be bypassed or compromised. Utilities must inspect, maintain, and "engineer in" or require mechanical fail-safes, such as physical pressure relief valves, check valves, burst discs, overflow weirs, and hardwired interlocks that physically prevent catastrophic over-pressurization or chemical over-dosing regardless of compromised logic.

3. Enforce "Secure by Demand" Procurement & Resolve Third-Party Technical Debt

• Demand Secure-by-Default Standards for Upgrades: When procuring new hardware, skid systems, or software updates, utilities must shift the cybersecurity burden to vendors through "Secure by Demand" specifications. Require vendors to deliver hardened products out-of-the-box, eliminating default factory passwords, mandating multi-factor authentication (MFA) capabilities, and providing a Software Bills of Materials (SBOM).
• Remediate Vendor Dependencies & Remote Access Gaps: Technical debt frequently accumulates through third-party system integrators who maintain uncontrolled, persistent remote connections or hold exclusive copies of PLC program logic. Utilities must eliminate "always-on" vendor remote access in favor of time-limited, monitored sessions and establish local, offsite, immutable backups of all PLC logic, SCADA configurations, and system images to ensure independent recovery.

The most resilient utilities increasingly recognize that cybersecurity is not solely a technology problem. It is a systems engineering problem. Digital controls can fail. Networks can be breached. Credentials can be stolen. The goal is not perfection. The goal is to reduce both the likelihood and severity of operational consequences.