CyberShield Advisory
Cybersecurity and compliance advisory. Know your risks. Fix what matters first. NIST CSF 2.0, HIPAA, C2M2, M365, vCISO. Free cybersecurity assessment. cybershieldadvisory.com
Risk observatory / Education CenterBusiness context → better questions → action
One-page guide / NIST CSF 2.0

Cybersecurity Basics for Small Water and Wastewater Utilities

Harris Ejiofor, CISM – CyberShield Advisory

Small water and wastewater systems run with lean teams but serve whole communities. A one-page guide to the basics that protect operations and public trust.

Why small systems are a target

Water and wastewater utilities often run with a handful of staff, older equipment and remote sites. Attackers know that, and they know a community depends on the service. You do not need a large budget to make your utility much harder to attack. These basics come first.

The basics

  1. Take operations off the open internet. Control screens and devices should not be reachable directly from the internet. If someone must connect remotely, use one secure route.
  2. Change every default password. Equipment often ships with a factory password. Replace it, and use different strong passwords for different systems.
  3. Require a second sign-in step for email, remote access and any account with administrator rights.
  4. Keep a list of what you have. Every computer, controller and connection at the plant and remote sites, and who supports each one.
  5. Separate office and operations networks, so a problem with billing or email cannot spread to treatment and pumping.
  6. Back up and practise restoring. Keep a copy of key systems and settings offline, and test that you can bring them back.
  7. Be ready to run by hand. Written manual procedures, paper copies of key contacts and a yearly practice run.
  8. Train your people. Staff should recognize suspicious emails and know who to tell, quickly and without blame.

Your planning obligations

Under America's Water Infrastructure Act of 2018, community water systems serving more than 3,300 people must complete a risk and resilience assessment and an emergency response plan, certify them to the EPA and review them every five years. Cybersecurity is part of both. Smaller systems are not covered by that rule, but the same planning protects them too.

Free help exists

CISA and the EPA publish free guidance for water and wastewater systems, and CISA offers no-cost services such as vulnerability scanning of internet-facing systems to eligible organizations.

Take the next step

Our free NIST CSF 2.0 assessment asks five quick questions about who owns security, where sensitive data lives, sign-in, incident plans and tested backups, and gives an indicative result. It is a short check, not a formal rating.

Related reading

Take the free NIST CSF 2.0 assessment

← All articles