Water supply and waste water
Small institutions with small teams, but obligations equal to the largest. That makes the order of work matter more here than anywhere.
What the Act requires of this sector
Drinking water and waste water are two separate sectors of Annex I. For both, the competent authority is the central state authority for cyber security, that is the Security and Intelligence Agency (SOA), and the competent CSIRT is the national cyber security centre (NCSC-HR).
The category follows size, but the authority may classify an entity regardless of size under the special criteria of Article 11. One of those criteria is being the sole provider of a service essential to maintaining critical societal activities, which in water supply is not unusual.
As a result, this sector often sees a small utility with a handful of people carrying the same obligations as a large one. The answer is not more documents but documentation a small team can actually maintain.
The term supplier in the table below comes from the Water Services Act (NN 66/19), which speaks of public water service suppliers. Elsewhere on this site we say service providers, but here we keep the statutory term.
Where this sector usually gets stuck
What we do for you
Who from the sector falls in scope
The category is set by the competent authority and the level of measures by the national risk assessment; both are explained in the overview of the Act.
A booster station taken over at Aliquippa water authority
An Iran-linked group took control of a controller at a booster station that maintains pressure for two townships. They got in through a device exposed to the internet with its factory password still in place, not through anything sophisticated. An alarm went off, staff switched to manual operation and the water kept flowing. The lesson is blunt: if a controller sits on the internet with the password from the manual, an attacker needs a search engine, not skill.
SOURCE: CISA, FBI, EPA and NSA joint advisory on the exploitation of PLCs, December 2023.
Frequently asked questions
The questions water and waste water utilities ask first, mostly about small teams and control systems.
Are we an essential entity even though we are small?
Larger water and waste water utilities are essential entities and medium-sized ones are important. Size sets the line within the sector, with the exception that the competent authority may classify the sole provider of an essential service as essential regardless of size, under Article 11 of the Act. How many people you have in IT does not affect the scope of the obligations.Where do we start with a small team?
With the asset and access inventory, then backups with restore testing, then a short incident procedure. Those three cover most of the risk per euro spent.What about controllers at pumping stations?
They must not be directly reachable from the internet, factory passwords must be changed and every access logged. Most public incidents in this sector began with exactly that omission.Who takes over when there is only one IT person?
That is why a deputy is named and instructions are written that somebody else can follow. Knowledge that exists in one head only does not count for an auditor.Can we comply on a small budget?
You can, if the scope is realistic. Short documents the team actually maintains are worth more than long ones nobody opens.Related pages
The pages that set out in full what water and waste water have to show in measures and evidence.
Let us build a plan a small team can carry out.
Half an hour, no obligation. We put together a plan two people can carry out alongside their regular work.