Water utility cybersecurity assessment FAQs

Some water utilities or water-related businesses do not have cybersecurity expertise on staff, therefore it is a great idea for the water sector to begin their cybersecurity journey with a focus on incident response. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Environmental Protection Agency (EPA) in the U.S. published an incident response guide for the water and wastewater sector. This document has many free and helpful tips and resources, and the entire incident response cycle is described in the document: Prepare, detect/analyze, contain/eradicate/recover, and post-incident analysis.

Understand cybersecurity standards and risks and ask your technology partners about how they keep their platform up to date with evolving global standards and local regulations. 2) System visibility enables security awareness: Choose solutions that can integrate data streams no matter the source for more effective monitoring of potential threats and anomalies. 3) Make sure cybersecurity is built into your tech and when evaluating new digital tools or platforms, make sure to ask vendors about their approach to security and how it's integrated into their products. 4) Have a response plan and only work with technology suppliers that provide strong support and employee training programs and are flexible to meet your organization’s unique needs. And 5) Select expert partners - cybersecurity expertise by itself is not enough. Look for partners who not only offer advanced digital solutions but also have a deep understanding of the water infrastructure space and its unique challenges.

• CISA’s Top Actions for Securing Water Systems: https://www.cisa.gov/water
• U.S. Funding sources
• CISA’s No-cost cyber vulnerability scanning for water utilities
• CISA’s Secure by Demand Guide
• Recognize and Avert Phishing Attempts
• EPA’s Water resilience cybersecurity help desk
• EPA No-Cost Cybersecurity Assessment Service
• EPA Cybersecurity for the Water Sector
• EPA – Cybersecurity Incident Action Checklist s for Water Utilities
• AWWA (American Water Works Association)’s Cybersecurity Guidance
• AWWA Water Sector Cybersecurity Risk Management Guidance
• AWWA Assessment Tool
• WaterISAC (Water Information Sharing and Analysis Center): water-sector threat alerts, guidance and events
• WaterISAC Cybersecurity Fundamentals for Water and Wastewater Utilities
• NRWA Rural Water Cybersecurity Center: free tools, training and SANS ICS Five Critical Controls short courses for utilities
• ENISA provides strategic risk reports, security guidelines, and regulatory frameworks for EU critical infrastructure rather than direct operational scanning
• ENISA NIS360

The National Rural Water Association’s Rural Water Cybersecurity Center offers short courses on the SANS ICS Five Critical Controls, a practical framework for securing the systems that run treatment plants and pump stations. The courses are written for water utility staff, including operators without an IT background.

Start with NRWA’s Rural Water Cybersecurity Center, which offers tools, training and guidance sized for small systems. EPA’s cybersecurity help desk answers specific questions at no cost, and WaterISAC’s Cybersecurity Fundamentals guide shows where to focus first.

Start with the basics that stop most attacks: 1) turn on multi-factor authentication, especially for remote access, 2) change every default password, 3) keep control systems off the public internet, 4) apply security patches on a regular schedule, and 5) back up critical systems and practice restoring them. When buying technology, use CISA’s Secure by Demand Guide to ask vendors for things like a published vulnerability disclosure policy. For a fuller list, see WaterISAC’s Cybersecurity Fundamentals.

The Xylem Trust Center brings Xylem’s product security information together in one place, including its security practices, policies and documentation. Utilities can use it to answer security questions about the Xylem products they already run or are considering.

Start with the Xylem Trust Center, which provides security documentation you can include in your vendor review. Pair it with CISA’s Secure by Demand Guide, which lists the questions utilities should ask any technology vendor. Xylem has also signed CISA’s Secure by Design Pledge, a public commitment to building security into its products.

CISA and its partner agencies published Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products. It lists the security features to look for when choosing digital products, such as secure default settings, strong authentication, built-in logging and a clear process for patches, so utilities can set clear expectations with vendors.

MITRE’s System of Trust framework gives organizations a consistent way to assess the risks of a supplier, its products and its services. It breaks trust down into specific questions about a vendor’s security, integrity and reliability. Xylem is a System of Trust community member.

Xylem’s product security team identifies, assesses and fixes vulnerabilities in Xylem products, and publishes security advisories that tell customers what to do. Details on Xylem’s vulnerability management process are available in the Xylem Trust Center.

Security researchers, customers and partners can report a suspected vulnerability in a Xylem product. Xylem works with the reporter to confirm and fix the issue, then publishes guidance so customers can protect their systems. Reporting instructions and Xylem’s disclosure policy are available in the Xylem Trust Center.

WaterISAC is the water sector’s information-sharing center. It sends members threat alerts, advisories and practical guidance written specifically for water and wastewater systems. Its Cybersecurity Fundamentals guide is a good free starting point. Xylem is a WaterISAC member.

Additionally, you can receive alerts by signing up with CISA, CISA’s Joint Cyber Defense Collaborative (JCDC), VulnCheck and others.

Yes. WaterISAC holds water-focused cybersecurity events where utilities hear current threat updates and learn from experts and peer utilities. Xylem sponsors several of these local events. See WaterISAC’s upcoming events.

The Water and Wastewater Sector Incident Response Guide, developed by CISA, the FBI and EPA with water sector partners, explains the support each agency offers and how to reach them at every stage of an incident. Utilities can report an incident to CISA or contact their local FBI field office at any time.

CISA’s Joint Cyber Defense Collaborative (JCDC) brings government agencies and private companies together to plan for and respond to cyber threats. In 2023, CISA expanded JCDC to include industrial control system expertise, adding companies whose technology runs critical infrastructure such as water systems.