The short answer
CISA Resources
The federal cybersecurity agency offers water and wastewater utilities a set of free services and publications: the cross-sector cybersecurity performance goals, a prioritized list of controls with cost and impact ratings, and the water and wastewater sector goals that map them to utility systems; regional cybersecurity advisors who visit, assess, and connect utilities to services; a vulnerability scanning service that continuously scans a utility internet-facing addresses and reports what an attacker would see; the industrial control systems advisories and the catalog of vulnerabilities known to be exploited; a self-assessment tool with a module for the water sector; tabletop exercise packages with water scenarios; guidance on ransomware; a water sector toolkit that collects the sector material in one place; and a channel for reporting incidents and receiving assistance. A utility of any size starts with the advisor and the scanning service, works the performance goals, and uses the exercise package once a year.
Key points
- The performance goals are the prioritized to-do list; the water sector goals translate them into utility terms.
- Regional advisors visit, assess, and connect; they are the human entry point to everything else.
- The external scanning service shows what the internet sees of the utility, weekly, for free.
- The industrial control advisories and the exploited catalog are the vulnerability feeds.
- The self-assessment tool and the exercise packages are the annual review and the annual drill.
- Incidents are reported to the agency, which also assists; the number is on the plan.
The resources
| Resource | What it is | How a utility uses it |
|---|---|---|
| Cross-sector cybersecurity performance goals | A prioritized set of practices across governance, identity, devices, data, protection, detection, response, and recovery, each with an estimate of cost, complexity, and impact | The checklist for the program; work the high-impact, low-cost items first |
| Water and wastewater sector goals | The cross-sector goals applied to utility systems, with sector-specific examples | The same checklist in utility language; the one to hand to the operations manager |
| Regional cybersecurity advisors | Agency staff in each region who meet with critical infrastructure organizations, perform assessments, and connect them to services | Call them first; the assessment and the introductions are free |
| Vulnerability scanning | A service that scans the utility public internet addresses continuously and sends a weekly report of exposed services and known vulnerabilities | Sign up; the first report is usually a surprise, and fixing it is the highest-value week of the year |
| Industrial control systems advisories | Coordinated vulnerability advisories for control system products | Subscribe for the vendors in the inventory |
| Known exploited vulnerabilities catalog | Vulnerabilities with evidence of active exploitation | The urgency signal in vulnerability triage |
| Self-assessment tool | A downloadable tool that walks through standards and goals, including a water sector module, and produces a report | The annual self-assessment; keep the reports to show progress |
| Tabletop exercise packages | Ready-made scenarios, facilitator guides, and discussion questions, including water and wastewater scenarios | The annual exercise, run by the utility itself in an afternoon |
| Ransomware guidance | Prevention, response, and recovery guidance and a checklist | The ransomware section of the incident plan |
| Water sector toolkit | A collection of the sector material from the cybersecurity, environmental, and investigative agencies and the sector center | The starting page for a new security owner |
| Incident reporting and assistance | A reporting channel and, for significant incidents, assistance with response | The number and the address on the incident plan; reporting obligations may apply |
| Free training | Online and in-person courses on control system security for owners and operators | Onboarding for the security owner and the control engineers |
Where to start
- 1
Contact the regional advisor
Through the agency regional office page. The advisor meets the utility, performs or arranges an assessment, and opens the door to the rest.
- 2
Enroll in vulnerability scanning
Provide the public address ranges and the point of contact; reports arrive weekly. Fix what the first report shows before anything else.
- 3
Adopt the performance goals
The water sector goals as the program checklist, with the high-impact items scheduled for the first year.
- 4
Subscribe to the advisories
For the vendors in the inventory, and to the exploited catalog updates.
- 5
Run a tabletop exercise
With the water sector package, the incident plan, and the operators and managers in one room for an afternoon.
- 6
Self-assess annually
With the tool and the water module, keeping the report as the evidence of progress.
Reporting
The agency receives incident reports from critical infrastructure and, for significant incidents, provides assistance to the affected organization. Under the critical infrastructure incident reporting law and its rule, covered water and wastewater utilities have mandatory reporting timelines; utilities below the threshold are encouraged to report voluntarily and receive the same assistance. The reporting channel, the phone number, and the address are on the utility incident plan, and the exercise includes making the call.
Alongside the other agencies
The cybersecurity agency material is aligned with the environmental agency checklist and the sector center fundamentals, and the three publish jointly on the water sector: the incident response guide and the top actions list carry all their names. A utility works one set of goals and reports progress in the same terms to each. The regional advisor, the environmental agency technical assistance, and the sector center are three doors to the same set of free help, and a utility may use all of them.
Frequently asked questions
- Is the scanning service safe for a control system?
- It scans only the public internet addresses the utility provides, from outside, the way an attacker would; it does not touch the control network unless the control network is exposed to the internet, which is the finding the service exists to produce. It is used by thousands of organizations.
- Will the agency tell the regulator what it found?
- The assessment services are voluntary assistance to the utility, and the agency has said the results are for the utility. Mandatory incident reports under the reporting rule are protected from public disclosure by the law. Check the current terms for each service.
- We are a very small system. Is any of this for us?
- All of it, and the small systems are the ones the agency most wants to reach because they are least resourced. The advisor visit, the scanning, the goals, and the exercise package are sized for a utility with a handful of staff. Start with the advisor.
- How current is this list?
- As of the time of writing; the agency adds and renames services. The water sector toolkit page and the regional advisor are the current sources, and the sector center digest announces changes.
Related topics
- EPA GuidanceWhat the federal environmental agency provides to water and wastewater utilities on cybersecurity and what it expects: the free assessment, the checklist aligned with federal goals, joint incident response guidance, the enforcement position, and how to use it.
- AWIA RequirementsWhat the 2018 water infrastructure act requires of community water systems: a risk and resilience assessment and an emergency response plan, certified on a schedule by size and repeated every five years, with cybersecurity named in both, and who is covered.
- Advisories and AlertsWhere a utility learns its equipment has a known vulnerability and what to do with the news: the government and vendor advisory feeds, the sector center, the exploited catalog, subscribing by product, a weekly triage on exposure and consequence, and records.
- Reporting RequirementsWho a water or wastewater utility must tell about a cyber incident, how fast, and what to say: the federal critical infrastructure reporting rule, state laws, the drinking water regulator, public notification, law enforcement, the sector center, and insurers.
- Small Utility Cybersecurity PrioritiesWhat a utility with a few operators and no IT department should do first: the ten measures that remove most of the risk for the least money and time, in the order to do them, with what each one costs, what it prevents, and how to know it is done.
- Security Program BasicsWhat a control system security program is for a utility that has never had one: a named owner, an inventory, a risk assessment, a few policies, baseline controls, training, vendor rules, an exercised incident plan, and a first-year plan for a small staff.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.