Cybersecurity for water utilities: protecting IT and OT

Why water utilities require a different ap­proach from or­di­nary office IT

A water and sewage company runs services where downtime can affect public health, service continuity and local trust. Security therefore cannot stop at email, workstations and servers. It also has to cover automation interfaces, remote vendor access, facility monitoring, configuration backups, emergency procedures and the way IT cooperates with maintenance teams. It requires owners for processes and assets, operating rules, technical controls, documented exceptions and recurring reviews across IT, OT and supplier access. A controlled operating model gives management, IT and maintenance teams a shared view of which risk must be handled first and how effectiveness will be proved.

• Separate office, server and automation environments where the architecture allows.
• Treat remote service access as a high-risk point, not a convenient shortcut.
• Check backups of configurations, dispatch systems and emergency documentation.
• Require evidence: logs, procedures, recovery tests, account lists and training records.

What does a prac­ti­cal waterworks cybersecurity project involve?

A good project does not start with purchasing equipment. First, you need to establish critical processes, assets, dependencies, owners, vulnerabilities, and the minimum level of resilience. Only then can you select the tools: EDR, backup, SIEM, segmentation, MFA, vulnerability monitoring, training and incident management procedures. In OT, EDR selection, patching and isolation require compatibility checks with automation systems and assessment of process-safety impact. Agree changes with operations and the supplier, test before deployment and use an approved change window with a plan to restore the previous configuration. Where an urgent fix cannot be deployed immediately, apply safe compensating controls and monitor the exposure.

Programme status and what matters in 2026

Checked on 23 October 2026. In its 16 July 2026 announcement, CPPC reported completion of agreement signing: 733 agreements and 657 annexes extending project implementation periods. The announcement gives 31 December 2026 as the extended implementation deadline; each beneficiary should check its own agreement and annex. The 24 September update concerns documents for further personal-data processing, and the 29 September update provides a revised change-request instruction. The priorities are project delivery, current documentation, settlement and evidence that controls work.

• Verify which activities were planned as organisational, skills-related and technical.
• Separate the costs of equipment, services, training and audits from regular IT maintenance.
• Maintain acceptance records, configurations, reports, attendance lists and test evidence.
• Don't leave recovery testing and incident scenarios until the end of the project.

Why cybersecurity matters in the water sector

In water infrastructure, a digital incident can move quickly from an IT problem to service interruption, treatment plant disruption, sanitary risk, loss of resident trust and regulatory pressure. A water utility cybersecurity programme therefore needs to cover classic IT, OT dependencies, remote service access, privileged accounts, backup, crisis communication and evidence that controls work in practice. Management sees impact and priorities, while IT and maintenance teams know which systems, flows, accounts and service connections are critical.

• Treat water delivery, treatment, facility monitoring and control as critical processes rather than mere support systems.
• Combine risk analysis with business continuity, because an attack may result not only in data leakage, but also in operational interruption.
• Include automation suppliers, service companies, integrators and remote access as part of the risk chain.
• Record decisions, exceptions and tests as evidence supporting assessment of programme, contractual and applicable legal requirements. Documentation alone does not establish organisation-wide compliance.
• The protection model is reviewed after automation, network or supplier changes.

Areas of support

The scope of work in water supply projects should correspond to what the financing programme indicated as organisational, technical and skills-development activities. This means not only purchasing security solutions, but also building an incident management process, risk analysis, access policies, multi-factor authentication, audits, SOC, vulnerability management, penetration tests and improving staff qualifications.

How to organise project implementation and settlement

During the initial application round, it was crucial to follow CPPC announcements, collect documents and check the de minimis aid limits. After the application window closed, the same questions remained important for project implementation and settlement: which activities were eligible, which costs relate to security, which deadlines apply to the beneficiary and which evidence must be retained for audit.

• Check the current regulations, ranking list, contract and project schedule, instead of relying on working assumptions from the application stage.
• Verify the de minimis aid limit, the scope of eligible costs and the method of describing cybersecurity expenses.
• Prepare a plan of activities, owners, offers, acceptance protocols, reports and tests that will confirm the work has been completed.
• Incorporate IT, maintenance, management and accounting into one process so that technical and financial documentation is consistent.

Why cooperate with Virtline?

Virtline supports organisations in cybersecurity, IT outsourcing, audits, backups, monitoring and security implementations. In the case of water utilities, it is important to be able to translate programme requirements, NIS2 and the realities of municipal infrastructure into practical actions: from diagnosis and phased action plan, through the configuration of technical controls, to organising evidence for management and project control. The application of NIS2/KSC and DORA depends on the organisation’s sector, status and activities. Technical records can support assessment, but do not by themselves confirm compliance or certification.

• We combine technical, audit and operational perspectives, so the project does not end with the purchase of a tool.
• We help you choose priorities that actually limit the risk of interruption in the provision of water supply services.
• We support documentation, reports, protocols, training and tests, i.e. elements needed for the settlement and maintenance of the project.
• We can take over some of the maintenance, monitoring and periodic reviews when the internal team does not have all necessary security expertise.

Evidence that distinguishes implementation from policy statements

In cybersecurity projects for utilities, proof of action is paramount. A security policy without a list of owners, a backup without a restore test, an EDR without a response procedure and training without a phishing simulation do not provide real resilience. Documentation should be short, up-to-date and usable during an incident. For water utilities, network maps, supplier accounts, segmentation rules, configuration copies, restore reports and incident exercise records are especially important. Retain scope, decisions, owners, configurations, exceptions, test results, open risks and the next review date.

• Register of IT assets and key OT dependencies.
• Permission matrix and list of privileged accounts.
• System or data recovery test report.
• Incident-response instructions with roles, communication channels and escalation thresholds.

Deliverables for management, IT and maintenance

A project for waterworks should leave a common language for the management, IT specialists and people responsible for automation. Virtline organises the scope so that purchasing decisions, configurations, procedures and training are linked to real processes of water supply, treatment, remote service and business continuity.

• IT/OT risk report with priorities for the management board and action owners.
• Segmentation, remote access, MFA, backup and monitoring plan for critical systems.
• Evidence package: configurations, acceptance protocols, test reports, training records and decisions on exceptions.
• Schedule for maintaining controls after the project, including reviews of accounts, backups, logs and procedures.

From IT/OT risk to a plan, implementation and evidence

Virtline helps water utilities turn security and NIS2 requirements into a concise review of systems, owners, risks and evidence. This includes separating office IT, process systems and suppliers, protecting continuity and preparing decisions that management, IT and maintenance teams can use. These services connect water-utility protection with continuity, monitoring and risk management.

How does a water-utility cybersecurity project work?

Map the processes whose interruption would affect water delivery, treatment, control rooms or distributed facilities, then identify assets, accounts, service connections and suppliers. Restrict urgent exposure according to risk and process safety; MFA, backup and monitoring do not wait for a 60-day review. OT changes needing tests and an operational window receive an owner, interim controls and a deadline. The dates below are example progress reviews adapted to the project.

Who needs structured IT/OT security most?

Primarily water and wastewater utilities with distributed facilities, automation, remote vendor access, legacy systems, many integrators or a limited internal team. The more informal exceptions and supplier dependencies exist, the more valuable a shared accountability model becomes. Utilities with regulated processes, sensitive operational data, customer portals or cloud services also benefit because pragmatic shortcuts such as old accounts, broad permissions, missing documentation and manual workarounds accumulate across organisational boundaries.

What risks appear without a structured IT/OT model?

Unclear ownership, shared accounts, flat networks, uncontrolled remote service, untested backup, missing event records and weak escalation remain invisible until downtime or an incident. They can then cause service interruption, data loss, fraud, audit findings or a security crisis. Procedures, configurations, tests and evidence must form one operating rhythm, including controls that are not merely documented but operated and reviewed in practice.

Acceptance criteria for IT/OT cybersecurity

Acceptance confirms more than purchase or configuration. It demonstrates system coverage, working controls, accepted exceptions, incident and change handling, and ownership of recurring reviews. Controls should be tested against plausible water-utility scenarios and evidence should be usable by operations and management.

Contact

The review connects water-process risk, technical scope, accountability and evidence with a practical delivery path. Call +48 12 200 27 10 to discuss IT/OT dependencies, current risks, project timing and the fastest useful starting point. Virtline combines IT operations, cybersecurity, compliance and delivery practice.

Sources for the requirements and dates discussed