What EPA Cybersecurity Expectations Actually Require of a 5,000-Connection Water System
Cybersecurity guidance for the water sector is mostly written for utilities with a security team. If you serve 5,000 connections, you probably have one IT person, possibly shared with the city, possibly also responsible for the phone system. This is written for that person.
First, the Regulatory Picture, Honestly
The America's Water Infrastructure Act of 2018 requires community water systems serving more than 3,300 people to complete a risk and resilience assessment and an emergency response plan, and to recertify on a five-year cycle. At roughly 2.5 to 3 people per connection, a 5,000-connection system serves somewhere around 12,500 to 15,000 people. You are covered. AWIA requires you to assess electronic systems as part of that risk assessment. It does not prescribe controls.
EPA attempted to close that gap in March 2023 by requiring cybersecurity review during sanitary surveys. That memorandum was withdrawn in October 2023 following legal challenge. What remains is guidance rather than mandate: EPA and CISA advisories, the joint Water and Wastewater Sector Incident Response Guide, WaterISAC's fundamentals, and CISA's Cross-Sector Cybersecurity Performance Goals. The regulatory environment continues to move. Verify current requirements with your primacy agency rather than relying on any published summary, including this one.
The practical situation is this: your legal floor is lower than your operational risk. EPA's own inspection findings have repeatedly identified basic failures, including default credentials still in place, shared logins used by all operators, and accounts belonging to departed staff still active. These are not sophisticated findings. They are the findings that show up when nobody has looked.
The Five Things That Matter
1. Know what is connected.Not a formal asset management program. A list, in a spreadsheet, that you could hand to someone in an emergency. For each item: what it is, where it is, who the vendor is, whether it is reachable from the internet, and who to call when it breaks. Cover the business network, the SCADA and HMI systems, the PLCs and RTUs, every cellular modem and radio link at remote sites, the vendor remote access tools, and anything a contractor installed that you inherited. The remote sites are where inventories fail—lift stations, wells, and elevated tanks accumulate cellular modems installed by whoever did the last upgrade, often still carrying default configurations.
2. Get control systems off the public internet. The Aliquippa incident in November 2023 is the reference case. A Unitronics PLC at a Pennsylvania water authority was reachable from the internet and still carrying the manufacturer default password. The attackers were not sophisticated. They were scanning. Search Shodan for your public IP ranges and see what answers. Change every default credential on every PLC, HMI, modem, and camera. If a control system needs remote reachability, put it behind a VPN with multi-factor authentication rather than exposing it directly. Where operators need remote visibility, prefer a read-only view over a control-capable session.
3. Control vendor access, which is where the real risk lives. Your integrator probably has standing remote access to your SCADA environment, probably uses a shared account, and probably has been in place since installation without review. Ask three questions and write down the answers: Who at the vendor can connect, by name. What tool do they use and does it require your approval per session. Can you see what they did afterward. Move toward access that is off by default and enabled on request, with sessions logged.
4. Patch what faces outward, consistently.Perfect patching is not the goal. Prioritize in this order: anything internet-reachable, then remote access infrastructure including VPN appliances and firewalls, then business systems including email and billing, then HMI workstations, then embedded controllers on the vendor's schedule. A predictable monthly window that is actually observed beats an aggressive schedule that is skipped.
5. Write a two-page response plan and test it once. Not a hundred pages. Two, laminated, posted in the control room and carried in the on-call bag. It needs: who to call in what order with mobile numbers, how to isolate the business network from the control network physically, how to run treatment and distribution manually and for how long, and who notifies whom within what timeframe. Then run it once as a tabletop exercise over lunch. Ninety minutes. The exercise will surface two or three gaps you did not know about, and that is the entire point.
The Operational Question That Organizes Everything
If your business systems are compromised tomorrow, can you still deliver safe water? Colonial Pipeline shut down its pipeline in 2021 not because the pipeline was compromised, but because the billing system was and the operator could not account for product movement. The OT environment was fine. The business impact forced the shutdown anyway.
For a water system, the equivalent question is whether treatment and distribution can run without the business network. If the answer is yes, and operators have practiced it, an IT compromise is expensive and embarrassing. If the answer is no, or nobody knows, it is a public health event. Answer that question first. Everything else on this list is downstream of it.