Inside the pack
An evidence checklist with owners
Water: connect remote access, treatment dependencies, monitoring and recovery records to RRA and ERP questions.
A practical guide for operators, engineering and security teams
Prepare for a Water & Wastewater Cybersecurity Assessment
Prepare water-system boundaries, responsible people, records and operating safeguards for a scoped cybersecurity assessment.
Preview the AWIA cyber evidence pack
Read this preview without registering. The examples are fictional and do not contain client records.
Inside the pack
Scope and action worksheets
Record the process boundary, approved methods, exclusions, stop conditions, recovery support and corrective owner. Fill the PDF locally after downloading it.
Example evidence record
Question: Can a vendor account reach assets beyond its support task?
Evidence: Account approval, access-group membership, jump-host rules and a dated firewall configuration.
Limit: Configuration review alone does not prove actual reachability.
Next step: Assign an owner and agree an operations-approved verification method. Record the relevant RRA scenario and ERP dependency.
Get the fillable planning pack
Five-page PDF with fillable scope and action worksheets. Download it after a successful request.
Your email and selected pack go to GDF. No callback or marketing subscription is requested. Keep completed worksheets in your own records.
Define the system and decision first
Record whether the scope concerns drinking-water treatment and distribution, wastewater collection and treatment, industrial water systems or a defined combination. Identify the facility owner, operator, remote sites and the people responsible for engineering, IT and cybersecurity.
Describe the decision: an initial assessment, an unresolved finding, a vendor connection, a planned change or a recovery question. Bring existing assessment summaries and action lists so new work can address a useful gap.
Prepare a controlled record list
- Available plant and remote-site network diagrams and asset records.
- Engineering workstation, historian, telemetry and vendor-access inventories.
- Account approvals, remote-access records and relevant network configurations.
- Backup inventories, restoration records and key software or vendor dependencies.
- Existing incident and emergency-plan responsibilities, exercise records and open actions.
The assessment team agrees which records are necessary and how they will be exchanged. This is a preparation list, not a request to upload sensitive material through a public form.
Set the operating safeguards
Identify sensitive equipment, allowed methods, maintenance windows, the person who can stop work and recovery arrangements. Operations and engineering approve active validation in writing. A laboratory or representative system may be the appropriate option.
Keep regulatory measures separate
Population served, service connections and treatment-plant design flow are different measures. Confirm the applicable program with the responsible owner and advisers. A technical cybersecurity review is one defined workstream, not automatically the whole risk assessment, emergency plan or certification.
Agree what the assessment will deliver
Set the facilities, evidence, report audience, limits, action owners and proposed follow-up before work begins. See the Water & Wastewater Assessment Deliverables guide.
OT assessment planning library
Download the four sector packs and 50-state companion, or create a workbook set for your states, ownership and operating scope.
Technical review: Joseph Caruso, Founder, CEO and CTO. Reviewed .