Water & Wastewater Assessment Deliverables

A report that connects findings to operations

The written scope defines the facilities, methods, records and outputs. The examples below illustrate the contents to agree; they are not a client report or an unconditional package.

System and responsibility map

Identify treatment and remote sites, supporting IT services, engineering access, vendor connections and who owns each part of the scope. Record dependencies that matter to pumping, treatment, monitoring or recovery without publishing sensitive architecture.

Findings with traceable evidence

For each agreed finding, record the observed condition, source and date of the supporting record, affected operational dependency and remaining uncertainty. Identify whether the conclusion comes from configuration review, interviews, records or authorized validation.

Corrective-action register

Include an assigned owner, practical next step, agreed priority and the evidence needed to evaluate the correction. Separate recommendations from implementation work and retain untested areas.

Recovery and incident-readiness record

Document the selected function's configuration, software, communications, backup and vendor dependencies. Record any exercise or approved test, its result, limitations and further work. List preservation responsibilities and gaps in relevant logs or time sources.

Two useful reporting levels

Management receives the operating consequences and decisions. Restricted technical detail supports the operators, engineering and security staff responsible for corrective work. Handling and retention follow the agreed requirements.

What the deliverables do not establish

A technical report is not, by itself, a complete AWIA risk and resilience assessment, emergency plan, state certification or guarantee of regulatory acceptance. The engagement identifies its contribution and the responsible parties for the remaining work.

Prepare for the assessment · Water & Wastewater Cybersecurity Assessment