AWIA Is Already a Cybersecurity Instrument
For small and medium community water systems, America's Water Infrastructure Act does not prescribe a security stack. It requires something more foundational: an honest assessment of cyber risk, an emergency plan that responds to the findings, and a recurring act of executive accountability.
What AWIA requires
Section 2013 applies to community water systems serving more than 3,300 people. Covered systems must develop or update a risk and resilience assessment, prepare or revise an emergency response plan, certify completion to the EPA, and repeat the review on a five-year cycle.
Cybersecurity is not optional. The assessment includes electronic, computer, and automated systems, while the emergency plan must incorporate findings and strategies to improve physical security and cybersecurity. AWIA creates an assessment duty, a planning duty, a certification duty, and a recurring review duty. It does not prescribe a complete control baseline.
Where cyber gets thin
Thin assessments describe technology without modeling consequence, rely on vendor declarations instead of evidence, smooth uncertainty into an average score, or stop when the report is filed. A firewall inventory is not a risk assessment. A claim that a vendor handles SCADA security is not evidence without the access path, account, authentication, logging, and revocation process.
A serious assessment connects compromised remote access, ransomware, lost telemetry, manipulated set points, or destroyed engineering files to treatment, distribution, monitoring, public communication, billing, and regulatory reporting.
The deliverable should work
The useful output is concise and connected: an executive risk narrative, an asset and trust-boundary map, an evidence-backed finding register, a prioritized treatment plan, ERP updates for isolation and manual operation, and a decision record showing who accepted, funded, deferred, or transferred each material risk.
Infraxion Guard is positioned around the gap between certification and operational certainty. An AWIA-ready engagement should show what was assessed, what evidence supports each finding, what could affect safe service, what remains uncertain, who owns each decision, and what should happen next.
Electora position: an AWIA cyber assessment should connect assets, access paths, threat scenarios, operational consequences, evidence, risk owners, and emergency-response actions.