What a voluntary control systems memo could not give small water utilities

The week

On July 28, 2021, President Biden signed a National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems. It formally established the Industrial Control Systems Cybersecurity Initiative, a voluntary collaboration between government and infrastructure operators that had begun in April with a 100-day plan for the electricity sector and had since extended to natural gas pipelines. The memorandum said the initiative would expand to further sectors, including water and wastewater. It directed the Department of Homeland Security, through CISA and working with NIST, to develop baseline cybersecurity performance goals for critical infrastructure, with preliminary goals for control systems within months. It came five months after a widely reported incident at a water treatment plant in Oldsmar, Florida There, a plant operator reported seeing someone remotely change chemical settings, and the case drew national attention to small utilities.

The memorandum relied on voluntary goals because federal agencies lacked authority to impose detailed cybersecurity standards on most infrastructure sectors. In electricity, that approach sat alongside mandatory reliability standards and large operators with security teams. Water is different. The United States has tens of thousands of community water systems, most of them small and many owned by cities, counties, towns and special districts. For those systems, a voluntary goal is a document that someone must read, fund and act on. Each of those steps needs something the memorandum could not provide: an owner, a person whose job includes control system security; a budget line that recurs; and a reason to act that a council or board will accept. Local officials could supply all three. Federal agencies could not.

An owner: someone whose job it is

Many small utilities have no dedicated cybersecurity staff and often no dedicated IT staff. Control systems are typically installed and maintained by an integrator or equipment vendor and operated day to day by licensed treatment operators whose training is in chemistry and hydraulics. Remote access, which spread during the pandemic so that operators and vendors could check plants from home, was often set up by whoever needed it, sometimes with shared passwords and no monitoring.

Ownership is also split by public governance. In a typical municipal utility, the plant’s control systems belong to the utility, its office network to the city IT department, and its contracts to a central procurement office. When something looks wrong, it may not be clear who can disconnect a vendor’s remote access, call for help, or notify the state drinking water regulator. That ambiguity costs hours in exactly the situation where hours matter.

A voluntary goal cannot assign that ownership. A city manager, utility general manager or board can, in a single resolution or job description change. The useful version is specific: one named person accountable for control system security, a deputy, written authority to cut remote access in an emergency without further approval, and a duty to brief the governing body on a short list of measures each quarter. Free help then has somewhere to land. CISA’s regional advisers, state agencies and sector associations offered assessments and checklists, but they needed a counterpart at the utility to receive them.

A budget line: competing with pipes

Water utilities are financed mainly by ratepayers, and their capital plans are dominated by pipes, pumps, treatment upgrades and water quality compliance. Cybersecurity competes with those needs for money and attention, and it usually loses unless it appears as its own line.

Grants help only at the margins. The infrastructure law signed in November 2021 created a state and local cybersecurity grant program, and some water infrastructure funding could support security projects. But grants are episodic, and the measures that matter most are recurring: patching and maintaining control system software, monitoring remote access, refreshing offline backups, and the staff or contractor hours to do it. A grant-funded assessment that produces a list of fixes nobody is paid to implement changes little.

The local remedy is to put security into the rate case and the operating budget. A modest annual line, justified by the cost of a forced manual operation or a boil-water notice, is easier to defend than a one-off request after an incident. Utilities that contract with an integrator can also write security duties into that contract: multi-factor authentication for vendor remote access, notice before changes to control logic, and copies of configurations held by the utility.

Scale is the other lever. A utility serving a few thousand people cannot justify its own monitoring service, but a county, a regional water authority or a state program can buy one for many systems at once. Shared remote access gateways, pooled incident response retainers and cooperative purchasing of monitoring turn a cost no single small utility can carry into one a group can. The trade-off is dependence on a shared provider, which the owner should manage like any other contract.

A reason to act: the missing mandate

The third gap is legal. Electric utilities face mandatory reliability standards for the bulk power system. Pipelines had just received TSA security directives. Drinking water systems serving more than 3,300 people had a duty under the America’s Water Infrastructure Act of 2018 to assess risks, including cybersecurity, and to update emergency response plans, but no detailed federal cybersecurity standard.

Without a mandate, voluntary goals compete with every other demand on a council’s agenda. A requirement creates a floor that justifies spending to ratepayers. It can also burden very small systems that lack the capacity to comply. That tension has never been resolved nationally.

Locally, officials can create their own reason. A governing body can adopt a short security policy for its utility and require the owner to report against it. The measures with the best return were well known in 2021: remove internet exposure of control interfaces, change default passwords, require multi-factor authentication on remote access, keep offline copies of control logic and configurations, and rehearse running the plant manually. None needed a federal rule. Each needed someone, some money and a reason. Local government, not Washington, controls all three.

With hindsight

From 2026, the memorandum delivered its direct outputs: CISA published cross-sector cybersecurity performance goals in October 2022 and has revised them since. The water sector’s gaps persisted. In March 2023 the EPA told states to evaluate cybersecurity during sanitary surveys of public water systems, then withdrew the requirement in October 2023 after several states and industry groups sued. In late 2023, actors linked to Iran compromised internet-exposed control devices at several US water utilities, In 2024 the EPA issued an enforcement alert urging systems to act, and a Kansas city switched its plant to manual operation after an attack. The Oldsmar incident itself was later disputed, as discussed earlier in this series, when the city’s former manager attributed it to employee error in 2023. The gaps it exposed were real either way. Small utilities that named an owner, budgeted the basics and gave their boards a reason to ask fared better than those waiting for federal rules.