Securing Water and Wastewater Systems: Turning Visibility Into Action

Water and wastewater operators make decisions every day that affect service reliability and public safety. Cybersecurity needs to fit that responsibility: helping teams understand exposure, protect critical systems, and respond without creating unnecessary operational disruption.

In its October 1 article, “Securing Water and Wastewater Operational Technology Environments,” NIST discusses the risks of connected operational technology (OT), the importance of secure remote access, and the need for accurate asset visibility. Its message provides a useful starting point for utilities evaluating how to protect the systems that support water treatment and delivery.
At Sedara, we believe the next step is making that guidance part of everyday operations. An inventory, an access policy, or a security assessment becomes more valuable when someone owns the findings, monitors changes, and follows through on remediation.

Make the inventory useful to the people running the system

NIST identifies asset management and visibility as an important foundation for securing OT. For a utility, we recommend building an inventory that answers operational questions as well as technical ones.

For each critical asset, document:

• What process or facility it supports.
• Who owns it and who maintains it.
• How employees, vendors, and other systems can reach it.
• What would happen if it became unavailable or its configuration changed.\
• What protections are in place and what gaps remain.

A list of IP addresses provides limited direction on its own. Knowing that a particular workstation supports a remote pump station, has vendor access, and lacks a documented recovery procedure gives the team a concrete issue to address.
Include the supporting infrastructure in this review. Identity services, remote access systems, firewalls, and administrative workstations should have clear owners and documented relationships to the operational environment.

Treat remote access as an ongoing responsibility

NIST’s SP 1800-45 demonstrates secure remote access architectures for water utilities with different capacities. These examples give operators practical reference points for evaluating approaches that fit their environments.

Sedara’s recommendation is to pair the technical design with a repeatable access review. For every remote access path, ask:

• Is this connection still needed?
• Is access assigned to an identifiable person or a documented system identity?
• Is it limited to the required assets and tasks?
• Who approves access, and when should it expire?
• Who reviews the activity and can revoke access when needed?

Vendor access deserves particular attention. A connection established for an installation or repair should have an owner, a defined purpose, and a review date. When the work ends, the team should confirm whether that access should remain available.
Consider a hypothetical utility with a contractor account that remains enabled after a project closes. The useful outcome of an access review is a decision: remove the account, restrict it, or retain it with documented justification and an accountable owner.

Prioritize exposure by operational consequence

Utilities need a way to decide which findings deserve attention first. At Sedara, we recommend weighing accessibility, privileges, existing protections, and process importance alongside technical severity.
A finding on a system that provides a path into a critical operational environment may warrant faster action than a similar finding on an isolated, less consequential asset. The team should also consider how quickly the affected process could be restored and whether a tested alternative is available.
Build a remediation plan that names the responsible person, the next action, the target date, and any operational dependencies. If a fix must wait for a maintenance window, record the temporary protections and the date for reassessment.
This gives leadership a clearer basis for allocating resources and gives operators a plan they can work with.

Make security changes with operations at the table

NIST’s Guide to Operational Technology Security addresses OT’s distinct safety, reliability, and performance requirements. Those requirements should shape how utilities evaluate and implement security controls.
Discovery, testing, patching, and endpoint software deployment need an approach appropriate to the equipment involved. Passive discovery and existing records can be useful starting points; active methods require evaluation and coordination. Changes should be reviewed with operations personnel and relevant vendors, tested where practical, and supported by a rollback plan.
When immediate remediation is impractical, evaluate measures such as tighter access restrictions, segmentation, or additional monitoring. Document the remaining risk and who has authority to accept it.

Connect monitoring to an agreed response

Our recommendation is to define what each important alert should cause someone to do. Start with selected events such as unexpected remote access, privileged account changes, or changes to approved connectivity. Confirm which systems can provide the necessary evidence and identify visibility gaps.
Then agree on escalation procedures with operations. A security analyst needs to know whom to call, which actions require operational approval, and how to preserve information for investigation. Automatic containment should be evaluated carefully wherever disconnecting a system could affect a physical process.

Practice the decisions before an incident

A tabletop exercise can reveal whether the response plan works across IT, operations, leadership, and external support providers.
Use a scenario such as suspicious vendor access followed by loss of remote visibility at a facility. Ask who verifies process conditions, who can revoke access, how staff communicate, and what must be confirmed before restoring connectivity.
Turn unanswered questions into assigned improvements. Review recovery procedures and the availability of configurations, backups, vendor contacts, and other information needed to restore critical systems.

Build a program your team can maintain

Sedara helps organizations connect security visibility with risk prioritization, remediation, and response planning through assessments, advisory services, security engineering, managed detection and response, and tabletop exercises.
Sedara Attack Surface Management can contribute visibility into supported IT assets, identities, and security coverage that may support operational environments. Dedicated OT discovery and process monitoring should be evaluated separately for the utility’s equipment and operational needs.
For water and wastewater operators, a practical starting point is to review a critical process, its supporting assets, and the access paths into it. Assign the most consequential gaps, define how changes will be monitored, and practice the response.

Connect with Sedara to discuss your utility’s asset visibility, remote access, and incident readiness—and identify practical next steps for reducing exposure.
Contact Us.