Could Your OT Environment Withstand a Cyber Event? 7 Questions Every Water Utility Should Be Asking

Unfortunately, it often takes a high-profile event to bring operational resilience into focus.

For water utilities, preparing for disruption shouldn’t begin after the headlines. It should begin long before.

At Actemium Avanceon, we’ve been encouraging utilities to think beyond prevention and start planning for recovery. Because while reducing risk is important, no organization can eliminate every potential threat.

The recent cyberattacks affecting multiple U.S. water utilities reinforce an important point: many of the vulnerabilities involved weren’t new. They were the result of aging infrastructure, unsupported systems, limited visibility, and gaps in operational readiness.

Rather than asking, “Could this happen to us?” utilities should be asking a different question: “If it did happen, how prepared would we be to recover?”

Here are seven questions every utility should consider.

1.Do you know every PLC and OT asset connected to your network?

You can’t protect what you don’t know exists.

Many utilities have equipment that has been in service for decades. Over time, systems are expanded, modified, or inherited through capital projects, making it difficult to maintain an accurate inventory. Without visibility into your OT assets, it’s nearly impossible to understand where risks exist or prioritize improvements.

Why it matters: Asset visibility is the foundation of every OT resilience strategy.

2.Are any of your PLCs, HMIs, servers, or operating systems unsupported?

Unsupported hardware and software don’t automatically create a security incident, but they do increase operational risk. As vendors discontinue support, security updates become unavailable, replacement parts become harder to find, and recovery after a failure becomes more difficult.

Why it matters: Understanding your technology lifecycle allows you to proactively plan upgrades instead of reacting to unexpected failures.

3.Could you recover your SCADA system today?

Cybersecurity isn’t only about preventing attacks, it’s also about recovering from them.

If a SCADA server failed or became unavailable, how long would it take to restore operations? Are backups current? Have they been tested? Does everyone know the recovery process?

Why it matters: Recovery capability often has a greater impact on operations than the initial event itself.

4.Is remote access properly managed?

Remote access has become essential for supporting distributed operations, but it also creates additional pathways into critical systems when not properly managed.

Utilities should understand who has access, how access is granted, and whether connections are monitored and periodically reviewed.

Why it matters: Secure remote access reduces unnecessary exposure while still enabling efficient support.

5.Are your backups regularly tested?

Having backups is only part of the equation.

Can you restore a PLC program? Recover an HMI? Bring a SCADA server back online? The only way to know is to validate the recovery process before an incident occurs.

Why it matters: A backup that hasn’t been tested shouldn’t be assumed to be recoverable.

6.Are you relying on one person to support critical systems?

Many utilities depend on experienced operators or controls engineers who have built and maintained systems for years.

When knowledge exists only in one person’s head, it creates operational risk. Documentation, standardized procedures, and cross-training become just as important as the technology itself.

Why it matters: Operational resilience depends on people as much as technology.

7.If something happened tomorrow, how confident are you that operations could continue?

This is the question that ties everything together.

Operational resilience isn’t measured by whether an attack occurs—it’s measured by how effectively an organization can continue providing safe, reliable service during and after an unexpected event.

The goal isn’t to eliminate every risk. It’s to understand where your greatest vulnerabilities exist and have a plan to address them over time.

Why it matters: Confidence comes from preparation, not assumptions.

Where Do You Stand?

Every utility’s environment is different. Some organizations have already addressed many of these areas, while others are just beginning to evaluate their OT readiness.

The important thing is to start the conversation before an unexpected event forces it.

Review these seven questions with your leadership team, operations staff, and controls engineers. If there are questions your team can’t confidently answer, they may represent opportunities to strengthen your operational resilience.

Continue the Conversation

To help utilities begin that discussion, we’re offering complimentary 30-minute OT Risk & Resilience Reviews for water and wastewater organizations.

Together, we’ll walk through these seven questions, discuss your current environment, and help identify potential areas of operational risk.

The goal isn’t to perform a formal assessment or recommend projects. It’s to provide an outside perspective, validate what’s already working well, and help you better understand where additional preparation may be worthwhile.

Do not wait until something happens to find out how prepared you really are.

Contact us to schedule your complimentary OT Risk & Resilience Review today.

Written by: Lynette Cohen