Cybersecurity Guide

Environmental Cybersecurity: Water Systems, Threats, and Protection

Last updated:

Written by Cybersecurity Guide Contributors

Collaborative Cybersecurity Guide byline for regularly updated content reviewed and maintained by multiple contributors.

In this guide

Environmental cybersecurity protects the digital systems used to provide drinking water, treat wastewater, and monitor conditions such as water quality and pollution.

The central concern is not only data theft: attacks can also interrupt services, undermine trustworthy measurements, or, when operational technology is reached, interfere with equipment. A cyber intrusion does not by itself prove contamination or physical damage.

What is cybersecurity in environmental protection?

It is the practice of securing information technology (IT), operational technology (OT), connected sensors and supporting data used for environmental services.

IT runs business functions such as billing and email. OT senses, monitors or controls physical processes such as pumping and chemical treatment. Both matter to resilience, but they create different risks.

In the United States, water and wastewater systems form a CISA critical infrastructure sector. Separately, CISA identifies “Supply Water” and “Manage Wastewater” as National Critical Functions. A sector identifies infrastructure and organizations; a National Critical Function identifies an indispensable activity.

EPA says the United States has more than 148,000 public water systems, which provide drinking water to about 90% of Americans. The inventory includes community and non-community systems, not just municipal treatment plants.

EPA reports have also described roughly 16,000 publicly owned wastewater treatment systems, a distinct population that should not be merged with the drinking-water count.

Which environmental systems face cyber risk?

SystemWhat is exposedWhy it matters
Drinking waterPump controls, treatment equipment, chemical dosing and telemetryPotential loss of monitoring or incorrect process commands
WastewaterLift stations, treatment controls, alarms and discharge systemsPotential service interruptions or loss of environmental oversight
Environmental monitoringConnected sensors, remote measurements and communications linksIncorrect or missing readings can affect decisions
Laboratories and compliance systemsAnalytical records, databases and reporting workflowsAltered data can undermine quality assurance and accountability

These are potential failure paths, not claims that every facility has the same equipment or that all listed harms have been documented. NIST includes physical-environment monitoring within its OT security scope, while EPA maintains separate guidance on verifying environmental information.

What do SCADA, PLC and HMI mean?

A SCADA system gathers data and supports supervisory control across equipment or remote sites. A programmable logic controller (PLC) runs control logic for machinery.

A human-machine interface (HMI) shows conditions and allows authorized operators to interact with a process. These are often connected parts of an industrial control system; they are not interchangeable terms.

Which cyber threats matter most?

Directly exposed OT. An internet-reachable PLC or HMI with weak credentials can allow an attacker to alter settings or interrupt access. Federal investigations have documented this class of attack against water-sector devices.

Compromised passwords or vendor connections. Shared accounts, unchanged default passwords, excessive permissions and unsecured remote access can provide entry points. EPA identified such deficiencies among inspected systems; its inspection findings should not be generalized to the entire sector.

Ransomware and ordinary IT outages. Attackers may disrupt billing, email or business services without compromising treatment. Conversely, failure of an engineering workstation or OT network connection could affect operations. The actual impact must be established case by case.

Unreliable monitoring data. Manipulated logs, sensor feeds or control displays can hide abnormal conditions. Utilities need independent process checks and sound data-validation procedures, not merely more network alerts.

Supply chain and insider risks. Contractors and integrators need access to equipment, and vendors may provide updates or remote maintenance. Limit access to necessary work, remove expired accounts and review procurement practices.

Related resources

What have actual cyber incidents shown?

American Water, October 2024: Business interruption, not a confirmed water-quality incident

American Water discovered unauthorized computer-network activity on October 3, 2024, and disclosed the event to the SEC on October 7. Some systems were disconnected during the response. The company reported that water and wastewater operations were not negatively affected.

By October 10, its customer portal had returned, and standard billing was resuming; American Water explicitly stated that water quality was not affected. The incident illustrates the need to restore business services and communicate clearly even when treatment remains safe. Its cited disclosures did not verify ransomware or a named attacker.

CyberAv3ngers, 2023–2024: Exposed control devices

A CISA advisory first issued December 1, 2023, and revised December 18, 2024, describes Iranian-affiliated actors compromising internet-accessible Unitronics PLCs and HMIs, often with default or no passwords.

The revised advisory documented at least 34 compromised devices in U.S. water and wastewater systems, among at least 75 across several industries. Not every compromise was accompanied by a reported unsafe treatment outcome. The practical lesson is to remove unnecessary public access and secure controller credentials.

Iranian-affiliated PLC threats, 2026: A separate campaign

A joint federal advisory of April 7, 2026, updated July 22, describes exploitation of internet-exposed PLCs across multiple infrastructure sectors.

The update identifies targeting involving Rockwell Automation/Allen-Bradley, Schneider Electric and Siemens devices; agencies reported disruption and financial losses across affected sectors.

Those findings should not be converted into an unsupported claim of contamination at a particular utility. The lesson is to inventory exposed OT and validate changes with qualified operations and security staff.

How can utilities reduce cybersecurity risks?

Start with the controls that close common paths of unauthorized access without disturbing plant safety. EPA, WaterISAC, NIST, CISA and AWWA all publish useful water-sector or OT guidance. Their resources complement rather than replace local engineering decisions.

  1. Locate devices and connections. Record PLCs, HMIs, remote links, engineering workstations and contractors. Prioritize systems reachable from the public internet.
  2. Secure identities. Remove default credentials and unused accounts; use individual accounts and appropriate multifactor authentication for remote access.
  3. Separate networks. Restrict traffic between corporate IT and operational equipment, allowing the links needed for safe processes.
  4. Keep recoverable backups. Preserve protected system and controller configurations; test restoration with the responsible engineer.
  5. Monitor changes. Review relevant login and configuration logs and confirm unusual readings with independent process evidence.
  6. Practice incident response. Agree who can authorize isolation, manual operations, public notices, regulatory contacts and restart. Avoid untested scanning or indiscriminate controller shutdowns.

Which WaterISAC fundamentals are current? WaterISAC consolidated its guidance into 12 Cybersecurity Fundamentals for Water and Wastewater Utilities, announced in May 2025 after 2024 revisions. The former 15-fundamentals edition is historical. The current site also offers a Small Systems Guidance Compendium.

What should a small water utility do first?

A small team can begin with an inventory, a review of internet-exposed equipment, default-password changes, secure contractor access, backups and a contact sheet.

EPA provides free assessment requests, a self-service Water Cybersecurity Assessment Tool (WCAT) and technical assistance. AWWA offers a small-systems assessment option, although its tool requires a site login.

What cybersecurity requirements apply to U.S. water utilities?

The main federal planning obligation is SDWA Section 1433, as amended by AWIA in 2018. It applies to community drinking water systems serving more than 3,300 people.

Covered systems must complete and certify risk and resilience assessments (RRAs) and emergency response plans (ERPs), addressing security of electronic and automated systems and cybersecurity resilience, then review them at least every five years.

QuestionAnswer as of October 9, 2026
Which systems are federally covered by Section 1433 certification?Community drinking water systems serving 3,301 or more people
Is the same Section 1433 certification mandatory for wastewater-only plants or smaller community systems?No; other legal or state duties may still apply
What is the listed 2026 RRA deadline for systems serving 3,301–49,999?June 30, 2026
What is the matching EPA-listed ERP date?December 31, 2026, if the RRA was certified on its final deadline; otherwise within six months of actual RRA certification
Are WaterISAC, AWWA and NIST tools mandatory federal standards?No; they provide guidance that may help a utility meet applicable obligations

EPA withdrew its March 2023 cybersecurity sanitary-survey memorandum in October 2023. Its May 2024 enforcement alert described enforcement of existing Section 1433 obligations, not reinstatement of the withdrawn memo.

CIRCIA reporting status: As of October 9, 2026, the implementing federal CIRCIA final rule was still pending regulatory review after being submitted on October 1. A proposed reporting deadline is not yet an enforceable obligation under that pending rule. Other current reporting requirements must be considered independently.

What should a utility do during a cyber incident?

First, confirm the suspicious activity and activate the utility’s response plan. Keep operators, engineering contractors and security responders coordinated; make isolation and restart decisions under plant safety procedures.

Record what happened, contact regulators and appropriate incident responders when required, preserve useful evidence and independently verify process readings before restoring normal operations. EPA supplies a water-sector incident action checklist and an editable response-plan template.

Where can environmental utilities get practical help?

OrganizationBest starting point
EPAWater Sector Cybersecurity: free evaluations, technical assistance and planning resources
WaterISACCybersecurity Fundamentals: 12-fundamentals guidance and small-systems compendium
CISACybersecurity Performance Goals: voluntary baseline practices
NISTSP 800-82 Rev. 3: safety-aware OT security reference
AWWACybersecurity Guidance: assessment tools and templates; account access may be needed
EPACybersecurity Response: federal reporting links and active threat resources

Related reading: cybersecurity across critical industries, energy-sector cybersecurity and how to respond to a cyber incident.

Frequently asked questions

Can an attack on a water utility contaminate drinking water?

It is a possible consequence when an attacker gains meaningful control over treatment equipment and relevant safeguards fail. It is not a justified conclusion from every breach. American Water’s October 2024 incident did not affect water quality according to the company’s disclosure.

What is the biggest difference between IT and OT cybersecurity?

IT typically protects business systems and information. OT protects devices that monitor or change physical processes; reliability, safe operation and equipment constraints may make untested patches or scans inappropriate.

Does water cybersecurity also protect environmental data?

Yes. Environmental monitoring and laboratory records must remain accurate, available and auditable. Manipulated or missing measurements may impair assessment and reporting even when no physical control is compromised.

Where should suspected incidents be reported?

Use the facility’s plan and check applicable state and federal requirements. EPA links to CISA’s cyber incident reporting portal; sharing information with WaterISAC can also be useful, but voluntary information sharing does not replace mandatory notifications.

References and sources