OT Security for Water Utilities: What NIST Says About Secure Remote Access

Water and wastewater utilities face a fundamental cybersecurity challenge: the connectivity essential to modern operations also expands the potential attack surface for adversaries seeking to disrupt critical services.

In an October 2026 blog post, CheeYee Tang, Robert Stea, and John Wiltberger of the National Institute of Standards and Technology (NIST) emphasize that securing water and wastewater systems requires more than protecting remote access points. Water utilities need to identify connected OT assets, reduce unnecessary internet exposure, enforce identity-based, least-privilege remote access, monitor in-session activity, and segment OT networks to limit lateral movement if a connection is compromised.

Because connectivity serves key operational needs, the objective is not to eliminate it but to secure and control it more effectively. Engineers need to troubleshoot systems remotely, while vendors and contractors require access to specialized equipment. Beyond human access, SCADA systems, PLCs, HMIs, and other OT assets must communicate to support critical processes, from water treatment to distribution.

Recent cyberattacks against U.S. water and wastewater systems illustrate what can happen when critical infrastructure is inadequately secured. In a July 2026 public service announcement, the FBI warned of attacks targeting OT devices directly. According to the alert, “after remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality.” Water utilities in at least seven states reported incidents, with operational consequences including loss of water pressure and flooding.

Together, these challenges and recent incidents underscore the importance of the measures outlined by NIST. The October blog also highlights NIST SP 1800-45, a June 2026 practice guide that provides example architectures for securing remote access in water and wastewater utilities. Below, we explore NIST's key recommendations and their implications for the water sector.

The Top Cybersecurity Challenges Facing Water and Wastewater Utilities

Water and wastewater infrastructure is both highly distributed and operationally critical. A single utility may operate treatment facilities, pumping stations, storage tanks, and other assets across a wide geographic area. Staff must monitor water quality, pressure, and equipment performance across these locations, often using interconnected systems that can be accessed remotely. Each connection supports an operational need, but can also introduce cybersecurity risk.

According to NIST's October 2026 blog post, the U.S. has nearly 50,000 community water systems and over 16,000 wastewater treatment systems. More than 80% of water utilities are small, serving 3,300 people or fewer, and these organizations can be particularly constrained in terms of cybersecurity resources and staffing.

Mounting cyber threats, coupled with the challenges of securing distributed infrastructure with limited resources, have prompted legislative action in the United States. In August 2026, Senators Adam Schiff and Amy Klobuchar introduced the Water Cyber Shield Act, which would authorize an additional $600 million annually from 2027 through 2032 to strengthen drinking water and wastewater cybersecurity. The proposed legislation would also expand the Environmental Protection Agency's cybersecurity oversight, establish baseline cybersecurity requirements, and strengthen risk assessment and incident reporting obligations.

Why OT Asset Visibility Matters for Water Utilities

Reducing the OT attack surface starts with understanding what is connected. NIST recommends that water utilities maintain an accurate OT asset inventory, identify communication paths, reduce unnecessary internet exposure, and strengthen security for systems that require remote access.

An accurate inventory provides the foundation, but understanding how assets communicate is equally important. For example, a utility needs to know which remote pumping stations communicate with its central SCADA system, which devices are externally accessible, and who can access them for maintenance or troubleshooting. This visibility helps utilities identify unnecessary exposure while preserving the connections essential to daily operations.

Best Practices for Secure Remote Access in Water Utilities

Remote access allows employees, vendors, contractors, and other authorized users to troubleshoot, monitor, maintain, and manage OT systems without being physically on site. For geographically distributed water infrastructure, this capability can be crucial.

But, as NIST emphasizes, remote access is not inherently secure.

Traditional remote connectivity solutions like VPNs can give users broader network access than they actually need. If credentials or an endpoint are compromised, that access can become a pathway into other parts of the OT environment.

Effective secure remote access for water utilities should instead establish tightly controlled connections to the specific systems users need. NIST highlights controls including multifactor authentication (MFA), encryption, network segmentation, logging and monitoring, access control lists, least privilege, and accountability.

For example, a third-party technician servicing a pump controller should have a controlled route to that specific equipment—not full access to the utility's SCADA network or other operational systems.

How Does Secure Remote Access Fit into a Broader OT Security Strategy?

NIST SP 1800-45 recognizes that remote connectivity isn't limited to people accessing equipment. One of its reference designs addresses automated system-to-system communication between geographically dispersed OT environments, where operational data must move securely without human involvement. This is particularly relevant to water utilities, where remote facilities and centralized control systems depend on reliable data exchange.

Protecting both human-to-machine and machine-to-machine connectivity requires complementary security controls. Secure remote access helps protect connections into OT environments, while controlling communications between OT systems can limit the paths available to an attacker if an account or asset is compromised.

Limiting Lateral Movement with OT Segmentation

Preventing every potential compromise is unrealistic, especially in the age of AI-driven threats. Water utilities thereforeneed to limit the impact when a compromise does occur. NIST's broader OT security guidance identifies network segmentation as an important safeguard that helps prevent attackers from reaching deeper into operational networks after gaining access.

OT segmentation limits lateral movement by restricting which systems can communicate with one another. This reduces the number of assets an attacker can reach after an initial compromise. While traditional network segmentation separates broader network zones, OT microsegmentation enables more granular control over communications between individual assets or groups of assets.

In a water utility, segmentation can help isolate remotely accessible pumping-station systems from other operational assets, restrict unnecessary communications between treatment and distribution systems, and prevent an attacker who compromises one system from gaining access to other critical equipment. The objective is to preserve legitimate process communications while containing threats before they spread across the network and potentially disrupt essential water and wastewater services.

Simply put, secure remote access controls the pathways into the OT environment. Segmentation controls the pathways through that environment.

But achieving these benefits isn't always straightforward. Strict uptime requirements, legacy equipment, complex networks, limited cybersecurity resources, and the risks associated with major infrastructure changes can turn a traditional segmentation project into a lengthy—and potentially disruptive—undertaking.

To overcome these challenges, water utilities can introduce segmentation gradually rather than attempting a large-scale overhaul, prioritizing the connections that present the greatest risk. These may include externally accessed systems, third-party access paths, and IT/OT boundaries, with controls expanding over time. This targeted approach allows utilities to reduce their most significant exposures and realize security benefits sooner, without waiting for a full-scale deployment.

Building Cyber Resilience in Water and Wastewater Utilities

NIST emphasizes that even utilities with effective cybersecurity protections may experience service disruptions during an attack. For water and wastewater utilities, cyber resilience means being able to contain incidents, restore operations quickly, and maintain essential services that protect public health.

This calls for a coordinated approach that brings together asset visibility, secure remote access, monitoring, and segmentation to support every stage of cybersecurity:

Prevent unauthorized access → detect risky activity → restrict lateral movement → contain threats → maintain and restore operations.

Secure Remote Access in Practice: The Lillehammer Municipality Case Study

Like many water utilities, Lillehammer Municipality's Water and Wastewater Department in Norway depends on remote connectivity for day-to-day operations. While a VPN-based approach initially met remote access needs across approximately 80 pumping stations and facilities, the municipality ultimately determined that this model no longer provided sufficient protection against growing cyber risk.

Working with Cyolo and local partner Last Mile, Lillehammer Municipality introduced two-factor authentication, real-time session supervision, logging of who accessed which equipment and when, and controls for external files. Users retained straightforward browser-based access to the equipment they needed for troubleshooting and maintenance.

To minimize the risk of operational disruption, Lillehammer Municipality phased in the new solution gradually, keeping its previous remote access system available as a fallback during the transition. The deployment also preserved the municipality's existing firewall infrastructure, avoiding the need for major changes to its network environment.

As detailed in the Lillehammer Municipality case study, this project demonstrates an important principle for secure remote access in water and wastewater environments: stronger security does not have to come at the expense of accessibility, uptime, or established operational workflows.

Beyond Remote Access: Securing Every OT Connection

From treatment plants to remote pumping stations, water and wastewater operations depend on connections between people, equipment, and systems spread across multiple locations. As NIST's guidance makes clear, securing remote access is essential, but it is only one part of protecting this interconnected infrastructure.

The ultimate goal for security and operations teams in water facilities is not to eliminate connectivity, but to eliminate unnecessary and uncontrolled connections while protecting those that critical operations depend on. This requires greater visibility and control over who and what is connected, how those connections are used, and where a threat could spread if one is compromised.

This is precisely the approach behind the Cyolo Secure Connectivity Platform, which brings together secure remote privileged access for human-to-machine connections and Zero Trust microsegmentation for machine-to-machine communications, alongside capabilities such as OT asset discovery and real-time, AI-powered session supervision.

Interested to see how Cyolo can help your organization reduce cyber risk while maintaining reliable water and wastewater operations? Schedule a demo today.

Frequently Asked Questions About Water Utility OT Security