# Water & Wastewater OT cybersecurity

> One operator on nights, a flat SCADA network and a chemical feed that answers to a PLC. Water is the sector where a cyber event becomes a public health event fastest.

Canonical: https://blackbirdcyber.com/sectors/water  
Blackbird Cyber · https://blackbirdcyber.com/ · sales@blackbirdcyber.com

## The exposure — Public health runs on a flat network.

Most utilities have radio-linked lift stations, an HMI that doubles as the engineering workstation, and integrator remote access that has never been turned off. Chemical dosing sits one hop away.

Regulations and guidance: AWIA §2013, EPA · CISA guidance, State PUC.

- Chemical feed and disinfection setpoint protection
- Radio and cellular telemetry to remote sites
- Risk and resilience assessment and ERP alignment

## Typical topology

A representative control network for water and wastewater utilities, by Purdue level:

- L3.5 · DMZ: Reporting server
- L2 · HMI: Operator HMI
- L2 · SCADA: Plant SCADA
- L2 · Historian: Historian
- L1 · PLC: Treatment PLC
- L1 · RTU: Lift station RTU
- L1 · Safety: Chlorine safety
- L0 · Process: Intake · clarifier · chemical feed · pumps

Exposed path: vendor VPN → L2 · Historian (Historian).

## Where we start — Recommended engagements for water and wastewater utilities.

- [OT Cyber Audit](https://blackbirdcyber.com/capabilities/ot-cyber-audit): A site-level assessment of control system exposure, ranked by consequence.
- [OT Network Architecting](https://blackbirdcyber.com/capabilities/ot-network-engineering): Segmented control networks designed and built to keep the process running.