Energy and utilities

Water and Wastewater

Water utilities keep a city supplied and its wastewater treated around the clock, usually with a small team and a budget set years in advance.

Drinking waterDesalinationDistributionWastewater
Talk to an advisor For product makers

How the process runs

From source to tap, and back

Water is drawn, treated, stored and pumped to customers. Wastewater is collected, treated and returned to the environment. In the Middle East the source is often the sea, through desalination plants.

  1. Stage 1: Source and intake

    Raw water is drawn from rivers, reservoirs, wells or the sea.

    Control systems
    Intake pump PLCsLevel and quality sensors

  2. Stage 2: Treatment and desalination

    Dosing, filtration and disinfection, or reverse osmosis for seawater, make water safe to drink.

    Control systems
    Treatment plant SCADAChemical dosing controlRO skid PLCs
    Challenge2

  3. Stage 3: Storage and pumping

    Reservoirs, tanks and booster stations hold water and keep up pressure.

    Control systems
    Booster station PLCsTank level telemetry
    Challenge1

  4. Stage 4: Distribution network

    Pipes, valves and meters deliver water across the city.

    Control systems
    Network SCADA and RTUsPressure managementSmart water meters

  5. Stage 5: Wastewater collection

    Sewers and lift stations carry wastewater to the treatment plant.

    Control systems
    Lift station PLCsCellular telemetry
    Challenge1

  6. Stage 6: Wastewater treatment

    Biological treatment cleans wastewater before it is discharged or reused.

    Control systems
    Aeration controlSludge handling PLCsEffluent monitoring
Across every stage

Attackers rarely go straight for a controller. They travel through these shared systems, so this is where we look first.

Central SCADACellular telemetryIntegrator remote accessLinks to billing and GIS
Challenges34

For product makers

Building products for water and wastewater?

Water utilities rarely have OT security staff, so more of the burden now sits with the maker: secure defaults, no shared passwords, and fixes when something is found.

What makers build
  • PLCs and RTUs
  • SCADA and telemetry software
  • Dosing and analyser controllers
  • Smart water meters
  • Cellular gateways
What customers and regulators ask of the product
Secure by default

After the Unitronics PLC attacks in 2023, CISA called on manufacturers to stop shipping default passwords. Source: CISA

EU Cyber Resilience Act

Products sold in the EU must ship without known exploitable vulnerabilities, with secure default settings and security updates.

IEC 62443-4-2

Utilities and integrators ask for certified components.

Where product makers start
EU CRA ComplianceGap to conformity assessmentIEC 62443-4-1 SDLC CertificationYour way of working, audit-proofIEC 62443-4-2 CSA CertificationThe features your product is missing

For plant owners

Where it gets hard, and how we tackle it

We start from how your process runs, fix what matters most first, and use what you already own wherever we can.

  1. 03 Storage and pumping05 Wastewater collection

    Controllers facing the internet

    In November 2023, attackers compromised an internet-exposed Unitronics PLC at a booster station in Aliquippa, Pennsylvania, through its default password, and the station had to run manually. Small remote stations are often connected this way for convenience. Source: CISA

    How we tackle it

    We find every device reachable from the internet or a cellular network, close what does not need to be open, and replace direct access with one controlled path.

    Gap Assessment
  2. 02 Treatment and desalination

    Dosing is a public health function

    Chemical dosing decides whether water is safe to drink. A changed setpoint can harm people before anyone notices.

    How we tackle it

    We treat dosing setpoints and interlocks as safety-critical: limited write access, an alarm on every change, and hard limits in the field that SCADA cannot override.

    Risk Assessment
  3. Across every stage

    Small teams, fixed budgets

    Most utilities have no OT security specialist, and budgets are set years ahead. Big tool purchases are not realistic.

    How we tackle it

    We start with what you already own: firewall rules, switch settings, accounts and backups. Then a phased roadmap that fits your budget cycle, with the most important fixes first.

    Strategy & Roadmap
  4. Across every stage

    The integrator holds the knowledge

    The integrator who built the SCADA often keeps the only current drawings, passwords and remote access.

    How we tackle it

    We document the system with you, bring accounts and remote access under the utility's control, and set out what future integrator contracts must require.

    Cybersecurity Program

Where plant owners usually start

Three ways in

01Gap AssessmentRapid maturity review02Strategy & RoadmapPhased, budget-aligned03Cybersecurity SolutionsVendor-agnostic deployment

Rules and standards

What applies in water and wastewater

  • IEC 62443International

    Zones, conduits and security levels for treatment plants, pumping stations and telemetry.

  • NIS2European Union

    Drinking water and waste water are two separate sectors of high criticality.

  • NCA OTCC-1:2022Saudi Arabia

    Mandatory OT controls for critical national infrastructure operators, built on the NCA Essential Cybersecurity Controls.

  • CERT-In Directions, 2022India

    Cyber incidents must be reported to CERT-In within 6 hours.

Talk to RelyBlue

Operating in water and wastewater?

An honest conversation about your OT environment. No sales pressure, no fear tactics.

  • You talk to a senior advisor, never a salesperson