Network Work for Water and Wastewater Utilities
AWIA Risk and Resilience Assessments
Under America's Water Infrastructure Act (section 2013, amending Safe Drinking Water Act section 1433), community water systems serving more than 3,300 people must complete a risk and resilience assessment (RRA) and an emergency response plan (ERP).
The RRA must cover the security of automated and computer systems as well as pipes, treatment, storage and source water. Systems must review the RRA at least every five years and certify the review to EPA.
The latest RRA certification deadlines were 2025-03-31 for systems serving 100,000 or more, 2025-12-31 for 50,000 to 99,999, and 2026-06-30 for 3,301 to 49,999. The matching ERP deadlines were 2025-09-30, 2026-06-30 and 2026-12-31.
The ERP must include strategies and resources to improve resilience, including physical and cybersecurity, and must be prepared within six months of certifying the RRA.
Systems certify completion to EPA and keep the RRA and ERP themselves for five years. EPA's tools include the Vulnerability Self-Assessment Tool, the Water Cyber Assessment Tool, a Cybersecurity Incident Response Plan template and the Water Sector Cybersecurity Evaluation Program.
EPA and CISA Cybersecurity Guidance
In a May 2024 enforcement alert, EPA reported that over 70 % of systems inspected since September 2023 violated basic SDWA section 1433 requirements. EPA inspectors found default passwords left unchanged, one login shared by all staff, and former employees whose access was never removed.
EPA expects systems to reduce internet exposure, change default passwords, inventory OT and IT assets, back up systems and train staff.
On 2026-07-30 CISA warned of a significant increase in attacks on PLCs at water and wastewater systems, including changed PLC passwords and IP addresses, with boil-water notices and extended manual operation as results. CISA's alert says cellular modems installed by operators, vendors or integrators are being targeted and may be undocumented.
EPA and CISA warned that internet-exposed HMIs at water systems had been used by hacktivists to run equipment outside normal limits.
CISA asks water systems to take PLCs off the internet, route remote access through a VPN or gateway, change default passwords, allow-list remote IPs and keep clean PLC backups. Practising manual operation is one of CISA's five primary OT mitigations, alongside separating IT and OT networks.
OT Network Separation and Remote Access
CloudCentric is a managed IT provider in Mount Pleasant, South Carolina, serving businesses across Charleston and the Lowcountry. We provide network services for municipal and county water and wastewater utilities on the Charleston and Savannah coast, and can be reached at (844) 422-7000.
CloudCentric's work for utilities is the network around the SCADA system: separating plant and office networks, replacing modems with VPN access, and replacing unmanaged switches. The network map and asset list from an OT network assessment feed the computer-systems part of the RRA.
Lift stations and remote sites can be linked by long-range wireless bridges or a managed cellular router behind the firewall. The UMR-Industrial router (LTE Cat 4, IP66, -40 to 70 °C, 9 to 30 V DC, DIN or pole mount) fits lift-station cabinets.
Cameras and badge readers at treatment plants and lift stations run on the same UniFi console as the network.
Technical Limits and Integrator Coordination
CloudCentric works alongside the utility's SCADA integrator and does not certify the RRA or ERP; the utility certifies to EPA. CloudCentric holds no partner, certification or authorised-integrator status with Rockwell Automation, Allen-Bradley or Siemens; the brand names identify the equipment worked on.
Limit: no UniFi page says the gateway firewall or IDS/IPS understands industrial protocols such as Modbus/TCP, EtherNet/IP, S7comm, PROFINET or DNP3; rules between zones are written by address and port.
Limit: UniFi gear lists no substation (IEC 61850-3, IEEE 1613) or marine approvals, so utility protection networks are out of scope.