A practical guide for operators, engineering and security teams
Prepare for a Water & Wastewater Cybersecurity Assessment
Prepare water-system boundaries, responsible people, records and operating safeguards for a scoped cybersecurity assessment.
Define the system and decision first
Record whether the scope concerns drinking-water treatment and distribution, wastewater collection and treatment, industrial water systems or a defined combination. Identify the facility owner, operator, remote sites and the people responsible for engineering, IT and cybersecurity.
Describe the decision: an initial assessment, an unresolved finding, a vendor connection, a planned change or a recovery question. Bring existing assessment summaries and action lists so new work can address a useful gap.
Prepare a controlled record list
- Available plant and remote-site network diagrams and asset records.
- Engineering workstation, historian, telemetry and vendor-access inventories.
- Account approvals, remote-access records and relevant network configurations.
- Backup inventories, restoration records and key software or vendor dependencies.
- Existing incident and emergency-plan responsibilities, exercise records and open actions.
The assessment team agrees which records are necessary and how they will be exchanged. This is a preparation list, not a request to upload sensitive material through a public form.
Set the operating safeguards
Identify sensitive equipment, allowed methods, maintenance windows, the person who can stop work and recovery arrangements. Operations and engineering approve active validation in writing. A laboratory or representative system may be the appropriate option.
Keep regulatory measures separate
Population served, service connections and treatment-plant design flow are different measures. Confirm the applicable program with the responsible owner and advisers. A technical cybersecurity review is one defined workstream, not automatically the whole risk assessment, emergency plan or certification.
Agree what the assessment will deliver
Set the facilities, evidence, report audience, limits, action owners and proposed follow-up before work begins. See the Water & Wastewater Assessment Deliverables guide.