Water and Wastewater Cybersecurity Guide: SCADA and PLC Exposure

Water and wastewater utilities run chemical dosing, pumping and treatment from PLCs, HMIs and SCADA systems that are often reachable from the internet, protected by default passwords and maintained by vendors over remote access, and most utilities have little or no dedicated security staff. Federal advisories since 2021 have described intruders changing a treatment setpoint at one plant and defacing internet-exposed PLCs at dozens of water facilities. This guide covers drinking water cybersecurity and wastewater cybersecurity: what makes the water sector different, the incidents the official advisories describe, how to remove PLC and HMI exposure, how to control vendor remote access, how to engineer against chemical dosing manipulation, and the US obligations and guidance that apply: America's Water Infrastructure Act (AWIA) risk and resilience assessments, EPA programmes, WaterISAC fundamentals and AWWA guidance. It is written for utility managers, operators, OT engineers and the IT and security staff who support them.

Key takeaways

• Exposure is the first problem. Joint advisory AA23-335A describes at least 75 Unitronics PLCs and HMIs compromised, including at least 34 in the US water and wastewater sector, through internet-connected devices with default or no passwords.
• Remote access is the second. The 2021 water treatment advisory points to desktop sharing software, an outdated operating system and poor password security as likely weaknesses.
• Engineer for the bad day. CISA's advice for water systems is to install independent cyber-physical safety systems, such as limits on chemical pump size, valve gearing and pressure switches, so a compromised control system cannot create dangerous conditions.
• AWIA already requires cyber assessment. Community water systems serving more than 3,300 people must include electronic, computer and automated systems in risk and resilience assessments and review them every five years.
• Free help exists. EPA's Water Sector Cybersecurity Evaluation Program and technical assistance, CISA scanning, WaterISAC fundamentals and the AWWA assessment tool are built for utilities with small teams.

Why water and wastewater systems are different

The water and wastewater systems sector spans drinking water treatment and distribution and wastewater collection and treatment, from large city utilities to systems serving a few hundred people. Several features shape water sector cybersecurity:

• Distributed assets: wells, booster stations, lift stations, tanks and reservoirs spread over a large area, often connected by cellular modems, radio or leased lines to a central water SCADA system.
• Small teams: many utilities have one or two operators per shift and outsource IT and control system integration, so vendors hold much of the operational knowledge and access.
• Physical consequences: controllers set chemical feed rates, pump speeds and valve positions. Loss of view or control can mean boil-water notices, sewage overflows or equipment damage, not just data loss.
• Long-lived equipment: PLCs and HMIs stay in service for decades and are rarely patched during operation.
• Public funding and oversight: spending competes with pipes and treatment upgrades, and oversight comes from state primacy agencies and federal EPA rather than a single cyber regulator.

Water utility cybersecurity programmes fail when they copy enterprise IT controls without these constraints in mind. For general OT architecture, protocols and the Purdue model, see the OT Security Guide. This page focuses on what is specific to water.

Sector incidents: what the official advisories say

Oldsmar: the 2021 advisory does not name the facility; it was widely reported as the Oldsmar water treatment plant in Florida. In March 2023 the city's former manager said at a conference that the event was employee error and that "The FBI concluded there was nothing, no evidence of any access from the outside", according to Route Fifty; the FBI declined to comment. The official advisory has not been withdrawn, and its mitigations stand regardless of cause.

Aliquippa: the November 2023 alert describes a Unitronics PLC with an integrated HMI at "a U.S. water facility". The joint advisory's references cite reporting that the Municipal Water Authority of Aliquippa in Pennsylvania (often shortened to the Aliquippa water authority) was the utility affected. For later campaigns against water utility PLCs, see the Top 10 OT Security Risks.

Removing PLC and HMI exposure

A water PLC or HMI that answers on the public internet will be found. The Unitronics alert and advisory give specific, testable actions:

• Disconnect from the internet: "Disconnect the PLC from the public-facing internet", and where remote access is genuinely needed put a firewall or VPN in front of it with an allowlist of source IPs.
• Change default passwords: replace all default passwords on PLCs and HMIs, including the Unitronics default "1111", and confirm the change survives a power cycle and firmware update.
• Move off default ports: use a non-default port for programming access where the device allows, as a secondary measure, never as a substitute for removing exposure.
• Require MFA: enforce multi-factor authentication for all remote access to the OT network; if the PLC cannot do MFA, terminate access on a VPN or gateway that can.
• Update firmware: upgrade PLC and HMI firmware to the current release for the model during planned maintenance.
• Back up logic: keep tested offline copies of the logic and configuration of every controller so a tampered or wiped device can be restored quickly.

Check exposure from the outside as well as from asset lists: utilities often find cellular modems or integrator-installed routers that nobody recorded. See the OT Asset Visibility Guide and the Attack Surface Management Guide.

Water utility vendor access

Integrators and equipment vendors often install their own remote access to support SCADA, telemetry or a single skid. Common patterns are a desktop sharing tool left running unattended on the SCADA server, a vendor-owned cellular router, or a shared login used by everyone at the integrator.

Whatever the method, the utility, not the vendor, should own the accounts, approve each session and be able to cut access at once. See the Remote Access Identity Guide and the Third-Party Access Guide.

Engineering against chemical dosing manipulation

Chemical dosing manipulation is the consequence water engineers must design against: a compromised HMI or PLC, or an operator mistake, commanding a chemical feed outside safe limits. The 2021 advisory recommends independent cyber-physical safety systems that prevent dangerous conditions even if the control system is compromised. WaterISAC's fundamentals list "Install Independent Cyber-Physical Safety Systems" as a core control. In practice:

• Size limits: chemical metering pumps sized so that even at maximum output they cannot reach a harmful concentration for the plant's flow.
• Hardwired interlocks: pressure switches, flow switches and level switches wired to stop feed independently of the PLC.
• Independent analysers: continuous pH, chlorine residual and other quality analysers with alarms that do not depend on the SCADA server being trustworthy.
• Setpoint limits in logic: high and low limits on setpoints enforced in the controller, with changes logged and alarmed.
• Procedures: operators trained to treat an unexplained setpoint change as a potential security event, with manual operation as a rehearsed fallback.

Water treatment plant cybersecurity is therefore partly a process safety discipline. The goal is that no single compromised system can push the process outside safe bounds, which is also good process safety practice regardless of the threat.

US obligations: AWIA, EPA and sanitary surveys

Safe Drinking Water Act section 1433, as amended by AWIA section 2013, requires community water systems serving more than 3,300 people to prepare risk and resilience assessments (RRAs) and emergency response plans (ERPs) and certify them to EPA. EPA states the AWIA risk and resilience assessment must cover "electronic, computer, or other automated systems (including the security of such systems)", so cyber is mandatory, alongside malevolent acts and natural hazards, monitoring practices, financial infrastructure, chemical handling and operation and maintenance.

RRAs are reviewed at least every five years, ERPs are due six months after the RRA certification, systems certify per PWSID and keep copies for five years. Utilities certify completion; they do not submit the documents.

• Sanitary survey cybersecurity: in March 2023 EPA issued a memorandum, "Addressing Public Water System Cybersecurity in Sanitary Surveys or an Alternate Process", which would have brought cybersecurity into state sanitary surveys. EPA withdrew it in October 2023, saying "the memorandum is being withdrawn due to litigation" brought by Missouri, Arkansas and Iowa, joined by AWWA and the National Rural Water Association. EPA continues to encourage states to review public water system cybersecurity voluntarily.
• EPA water cybersecurity support: EPA offers a free Water Sector Cybersecurity Evaluation Program, in which a contractor assesses the utility; a free Cybersecurity Technical Assistance Program; and a self-assessment, the Water Cybersecurity Assessment Tool and Risk Mitigation Template, with checklist fact sheets.
• Reporting: EPA directs utilities to report cyber incidents to CISA and to the FBI's IC3.
• Outside the US: drinking water is an essential service under the UK NIS Regulations 2018, and drinking water and waste water are in scope of the EU NIS2 Directive. See the NIS2 Directive Guide.

Sector guidance: WaterISAC and AWWA

WaterISAC (Water ISAC), the water sector's information sharing and analysis centre, published 15 Cybersecurity Fundamentals for Water and Wastewater Utilities in 2019: perform asset inventories; assess risks; minimise control system exposure; enforce user access controls; safeguard from unauthorised physical access; install independent cyber-physical safety systems; embrace vulnerability management; create a cybersecurity culture; develop and enforce policies and procedures; implement threat detection and monitoring; plan for incidents, emergencies and disasters; tackle insider threats; secure the supply chain; address all smart devices; and participate in information sharing. In 2024 WaterISAC consolidated these into 12 fundamentals, released quarterly, folding insider threat into culture and smart devices into asset management, treating risk assessment as assumed because of AWIA, referencing CISA's Cross-Sector Cybersecurity Performance Goals and adding small systems guidance. Later fundamentals include "Implement System Monitoring for Threat Detection and Alerting", "Account for Critical Assets", "Enforce Access Control" and "Embrace Risk-Based Vulnerability Management". A Small Systems Guidance Compendium collects the advice for small utilities.

AWWA (American Water Works Association) cybersecurity guidance consists of Water Sector Cybersecurity Risk Management Guidance (version 4.0) and a Cybersecurity Assessment Tool. The tool asks which technologies a utility uses and generates a customised, prioritised list of controls, with a Small Systems Option for systems serving 10,000 people or fewer and a Full Assessment, mapping to EPA's priority controls. AWWA describes the guidance as a voluntary way to implement NIST Cybersecurity Framework controls and support the cybersecurity provisions of AWIA section 2013. Access requires an AWWA website login.

Where identity fits

Shared operator logins on HMIs, a single integrator account used by every technician, PLC programming passwords that never change and service accounts on historians that bridge IT and OT are the identity problems found most often in water utility OT. Use named accounts for remote and engineering access, keep shared HMI logins only where operations require them and compensate with physical controls and logging, rotate controller passwords when staff or vendors change, and remove accounts when contracts end. See the OT and ICS Identity and Access Guide.

How to implement: a phased approach

1. Find exposure (weeks 1 to 4): request CISA vulnerability scanning, check your public IP ranges, and walk sites to find modems and routers. Remove internet exposure of PLCs and HMIs first.
2. Fix credentials: change every default password on controllers and HMIs, record them in a vault, and enable MFA on all remote access.
3. Back up and test restore: take offline backups of PLC logic and HMI projects, and test a restore on a spare or simulator before you depend on it. A known-good backup is also the rollback for every later change.
4. Control vendor access: replace unattended desktop sharing and vendor modems with one utility-owned path, piloting with one vendor before moving the rest.
5. Verify safety layers: review chemical feed sizing, interlocks and analyser alarms with process engineers; test interlocks during planned maintenance with manual operation ready.
6. Segment and monitor: separate IT from OT with a DMZ, then add passive monitoring of OT traffic and alerts on logic downloads and setpoint changes.
7. Assess and plan: fold results into the AWIA RRA and ERP, use the EPA or AWWA tool to prioritise, and exercise a scenario with manual operation and a boil-water decision.

Decision guidance

• Small systems (a few PLCs, no IT staff): prioritise exposure removal, default passwords, one remote access path, logic backups and the EPA evaluation program or AWWA Small Systems Option. Ask the integrator to document every connection.
• Medium utilities: add a DMZ jump host, named vendor accounts, OT monitoring and regular RRA updates.
• Large utilities: run an OT security programme aligned to IEC 62443 with supplier requirements in contracts and a 24-hour monitoring capability. See the IEC 62443 Guide.
• Keep or remove remote access: if remote access is used rarely, disconnect it and enable it per session; if operators depend on it for alarms out of hours, keep it but behind MFA and a single controlled gateway.

Detection and measurement

Log and alert on remote access sessions to OT, PLC program downloads and mode changes, setpoint changes outside normal ranges, new devices on OT networks, and HMI logins outside shift patterns. Correlate SCADA events with independent analyser readings so a manipulated display can be spotted.

• Number of internet-exposed OT devices (target zero), checked monthly.
• Percentage of PLCs and HMIs with non-default passwords and a tested logic backup.
• Percentage of vendor remote sessions that were approved, MFA-protected and recorded.
• Percentage of chemical feed systems with a verified independent safety limit.
• Time from an unexplained setpoint change to operator investigation, measured in exercises.

Common failure patterns

• "Nobody would target us": the 2023 campaign hit small utilities because their devices were reachable, not because they were chosen.
• Integrator-installed access nobody owns: modems and desktop sharing tools left in place after commissioning.
• Dormant remote access accounts: an unused account on a remote access service was the entry point in the Colonial Pipeline ransomware attack.
• Backups that do not include logic: IT backups of the SCADA server but no copies of PLC programs or HMI projects.
• Relying on SCADA to detect SCADA tampering: no independent analyser or interlock, so a manipulated system can hide its own changes.
• RRA as a paperwork exercise: cyber sections copied forward without testing exposure or remote access.

Practitioner checklist

• Confirm no PLC, HMI or SCADA interface is reachable from the internet, and recheck monthly.
• Change all default passwords on controllers and HMIs and store them securely.
• Require MFA for every remote connection into OT.
• Replace vendor modems and unattended desktop sharing with one utility-owned, session-approved path.
• Keep tested offline backups of PLC logic and HMI projects.
• Verify independent safety limits and interlocks on every chemical feed system.
• Alert on logic downloads, setpoint changes and out-of-hours OT logins.
• Include cyber findings in the AWIA RRA and ERP and meet certification dates.
• Join WaterISAC and use EPA, CISA and AWWA free assessments.
• Exercise manual operation and incident reporting to CISA and the FBI.

Standards and references

• CISA: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities (AA23-335A)
• CISA: Exploitation of Unitronics PLCs used in Water and Wastewater Systems
• CISA: Compromise of U.S. Water Treatment Facility (AA21-042A)
• EPA: America's Water Infrastructure Act Section 2013
• EPA: Cybersecurity Assessments for water utilities
• WaterISAC: Cybersecurity Fundamentals for Water and Wastewater Utilities
• AWWA: Cybersecurity Guidance and Assessment Tool
• MITRE ATT&CK: Techniques for ICS

Related NHI Mgmt Group resources: OT Security Guide · OT and ICS Identity and Access Guide · OT Incident Response Guide · IEC 62443 Guide · OT Security Platform Buyer's Guide