Drinking Water, Wastewater and Industrial Water OT Security
A treatment plant cannot pause disinfection while someone runs a scan, and the remote telemetry, vendor support links and SCADA servers that keep it running are exactly where an intruder looks first. GDF establishes which of those connections can reach treatment and distribution controls, and documents the cyber evidence your AWIA plans and state filings rely on. We start from records and passive evidence, and any active check is approved by operations, scheduled in a window they choose and stopped on their word.
Scope the utility
Drinking water treatment and distribution, wastewater collection and treatment, and industrial process water run different equipment under different rules and different people. We agree on the facility, the operating question and the person who can authorize the work before anything else, then follow the dependencies that matter: source, treatment, disinfection, storage, pumping and distribution for drinking water, and lift stations, treatment processes and discharge control records for wastewater. The work can cover a whole system, one vendor connection, a planned controls change or a single recovery question.
Lift stations, tanks, wells and booster pumps, and the radio, cellular and network links that carry their data back to the plant.
Every support account, gateway and remote tool, who switches it on, what it reaches and whether anyone can see when it was used.
The configurations, software, licenses and people needed to bring a selected SCADA function back after an incident.
Under Section 1433 of the Safe Drinking Water Act, as amended by AWIA Section 2013, community water systems serving more than 3,300 people prepare or revise a risk and resilience assessment and an emergency response plan and certify both to EPA, with the emergency response plan certified no later than six months after the risk and resilience assessment. In EPA's current cycle the last published deadlines fall on June 30, 2026 for the assessment and December 31, 2026 for the plan, for systems serving 3,301 to 49,999 people that certified their assessment on the final due date. Wastewater systems are not required to certify either document to EPA. Your system's own dates are on EPA's AWIA Section 2013 requirements page.
Within the agreed scope we document the cyber scenarios that could affect treatment or distribution, the remote access dependencies, the safeguards already in place, the monitoring gaps and the restoration needs. Each finding is tagged for the assessment, the plan or both, with an evidence owner, so the cyber work drops into the wider resilience effort as one clearly labelled contribution. If a certification date is close, call (800) 868-8189 with the deadline and we will say what can be assembled before it.
New York runs two programs with different coverage and dates. The Department of Health's Appendix 5-E applies to community water systems serving more than 3,300 people, which have until January 1, 2027 to comply, including a cybersecurity vulnerability analysis; its operator training and incident reporting sections took effect on adoption, and systems serving more than 50,000 people must also designate a qualified cybersecurity lead.
For wastewater, the Department of Environmental Conservation's wastewater cybersecurity program requires every publicly owned treatment works to have an emergency response plan and cybersecurity controls by March 11, 2027, with the first annual certification of compliance due March 28, 2027. Network monitoring and logging apply only to the larger plants, at the 10 MGD design flow threshold in the SPDES permit, and incident reporting by SPDES permittees has applied since March 26, 2026.
Running a New York system and unsure which set applies to you? Start with the New York utility cybersecurity and privacy planning guide and bring the open questions to the scoping call.
Every AWIA, DOH or DEC engagement starts with a written scope that names the cybersecurity work, the evidence it will produce and where that evidence goes in the wider assessment, plan or certification. Your engineers, your planning consultant and the official who signs can each see exactly which part GDF supplies, which keeps the filing coherent and the deadline realistic.
Each option has its own systems, methods and deliverables, and the operating safeguards are agreed before any of them begins.
Understand the system and its exposure
Plant and remote site dependencies, control networks, engineering access, vendor connections, logging and recovery records, reviewed with the operators who run them. You receive a findings report, an action register and the technical material your planning work needs.
Resolve a finding or recovery question
A selected support connection, network boundary, account change or restoration step, examined against the records and any validation you approve, with the results, the evidence and the next actions.
Keep the review current as systems change
A calendar of site change reviews, vendor access checks, open findings, incident records and recovery exercises, with facilities, dates and deliverables fixed in advance.
We review architecture, asset and configuration records with engineering, operations and IT, and find where business services touch the control environment, then check whether the intended boundaries are backed by configuration and authorized validation. Each finding states the observed condition, the supporting evidence, the treatment dependency it affects and what still needs confirming, because a device inventory alone never explains the risk to a process. The water and wastewater assessment deliverables guide shows how a finished review is organized.
Remote support keeps many plants running, and it is also the route we examine most closely. We establish which vendor accounts, gateways and support tools exist, who authorizes their use, and how access is restricted, recorded and removed, with shared credentials, persistent sessions and undocumented connections called out plainly. If a vendor connection is live today and nobody can say what it reaches, call (800) 868-8189 and we will check that path first.
Interviews, existing records, configuration review and approved passive evidence come first. Operations and engineering name the sensitive equipment, the maintenance windows, the stop work contact and the recovery arrangements, and each active technique is approved for its target, method, timing and conditions. Concerns that do not belong on production equipment are validated on a laboratory or representative system, and anything left untested is listed in the report.
A backup record is a promise until someone restores from it. We review the configurations, software versions, licenses, communications, vendor support and people needed to recover a selected function, and agree a representative recovery exercise where operations allow. We also check what an incident would demand: access and change records, synchronized time, isolation decisions and preservation duties, so short lived records are fixed while there is still time. When restoration evidence is the open question, utility audit support and forensic readiness takes the work further.
The system and responsibility map covers the plant, remote sites, supporting business services, vendors and owners in the review. Access and dependency findings cover network boundaries, engineering workstations, telemetry, support accounts and the services operation depends on. The corrective action register records the evidence, the operational implication, the owner and the proposed validation for each action, and the recovery review shows what was tested and what was not. Leadership receives a decision summary; engineering receives the restricted detail. The water and wastewater assessment manual sets out the full method.
A water board, a state regulator and an insurer may all read the same report, so every finding carries its source, its date and the method that produced it, the standard GDF examiners hold to when they testify in federal and state courts. See the full team credentials.
The first conversation is free and starts the scope with you. Request it now.
For water facilities in New York and New Jersey, we identify whether NY PSC or NJ BPU requirements apply alongside the drinking water or wastewater scope and who owns that evidence. The New York and New Jersey planning notes and official sources set out the split, and site access, maintenance windows and specialist availability are agreed before anything is scheduled.
Bring your system list and your next deadline to a free first call. Start here.
Free planning guide
The preparation guide covers the system boundaries, owners, records and operating limits a water or wastewater assessment will ask about. The AWIA planning pack helps you assign evidence owners and connect cyber findings to the risk and resilience assessment and emergency response plan, and the remote access checklist walks through every vendor and telemetry path before the first call.
Boundaries, owners, records and safeguards to settle before scoping.
Format: PDF, also readable online.
Evidence owners for the RRA and ERP, a fillable planning pack, and a checklist for vendor and telemetry access.
Format: three PDFs.
Download the Water SCADA AWIA Planning Pack (PDF)
Read the water remote access checklist online, or browse the OT security review checklist and the full library of preparation packages.
Water utilities in New York and New Jersey can start from a state preparation set. The New York utility preparation pack (ZIP) keeps utility oversight, DFS applicability and private information questions apart, and the New Jersey utility preparation pack (ZIP) gathers water, wastewater, electric and gas utility facts; the New Jersey OT audit planning page lists its contents. You can also preview the water planning guide online before downloading anything.
To scope this work for your environment, request a free consultation with a senior specialist.
Frequently asked
Yes. The scope names each system, its responsible entity and its authorized boundary, and records their dependencies and regulatory requirements separately so neither gets lost in the other.
It is an assessment of the agreed environment, access, dependencies and recovery. Where a penetration test fits, we scope it separately with a specifically authorized target and method, usually on a representative system rather than live treatment controls.
Yes. We review the existing work for coverage, currency and open findings, then focus new effort on the gaps, such as a vendor connection, a correction or a recovery dependency, rather than repeating what was done.
The cyber workstream supplies the scenarios, dependencies, safeguards, gaps and restoration needs your risk and resilience assessment and emergency response plan draw on, each tagged with an evidence owner so your planning team can place it.
General facility and scope information only. Security plans, credentials, architecture and incident evidence move through a controlled exchange that we arrange once handling requirements are set.
Tell us the facility type, the general location, your role and any certification or compliance date the work must meet. On the first call a senior practitioner identifies which federal and state requirements reach your system, recommends where the assessment should start and sets out the schedule and the price, and the consultation is free. For an active incident, call the 24/7 hotline.
Assessment scope
Share your organization and preferred reply method. We review the request, discuss the technical lead and the reporting needs of your water system, then agree on the scope before work starts. The first consultation is free.
No network diagrams, credentials or detailed vulnerabilities are needed here. Secure exchange is arranged separately.
Active OT incident? Call (800) 868-8189 for 24/7 intake.
Technical review: Joseph Caruso, Founder, CEO and CTO. Reviewed .
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .