Cybersecurity when you are the IT department

You are not going to get an IT department. The water system is you, maybe two or three other people, and a SCADA laptop that everyone needs at two in the morning when an alarm goes off. So the password lives on a sticky note by the monitor, because writing it down beats making four people memorize a rotation, and it has worked fine for years.

Then a headline about a hacked water system crosses your board chair's desk. Now you are explaining what "cybersecurity" means for a system with no server room and no security staff. The honest answer is that most of what protects a small utility is not exotic, just a short list of doors that are easy to close, and just as easy for someone else to walk through if you skip them.

Rung 4 of the manager track.

The digital doors, passwords, networks, backups, and who is in charge when something goes wrong, are what follows here. The physical side, fences, locks, lighting, chemical deliveries, has its own guide (see /guides/security-walkthrough-for-small-systems), and it is worth working through alongside this one. Both protect the same system from different directions.

The easy doors close most of the risk

A widely cited breach study found that 79 percent of the organizations that got hit had an easily exploitable weakness rather than being singled out, and 96 percent fell to attacks that were not even technically difficult. Nobody hand-picked most of those utilities. Someone found a default password, an open connection, or an employee who clicked the wrong link, and that was the whole attack.

That is good news for a system your size. You do not need a security team to close most of the risk. You need to walk the list of easy doors and shut them: default passwords, a control system reachable from the open internet, no backup of your settings, and no plan for who decides what if something looks wrong at 3 a.m.

What EPA wants you to do first

EPA, working with CISA and the FBI, narrowed its full guidance down to eight actions every water and wastewater system should tackle first, regardless of size. For a system your size, they come down to this:

• Get rid of internet-facing shortcuts. If your SCADA system or a control-room computer can be reached from the open internet for convenience, that is the easiest door in the building. Close it unless there is a real reason it has to stay open.
• Kill the default passwords everywhere. Every device ships with one, often printed right in the manual. Change it at installation, set a minimum length by policy, and add multi-factor authentication for any remote access into your control system, even if it is just you dialing in from home.
• Know what is plugged in. Keep a running list of every device with an IP address, including the old equipment nobody remembers ordering, and check that list at least once a quarter.
• Back up what would hurt to lose: control-system configurations, programmable-logic-controller logic, network drawings, and personnel records. Keep three copies on two kinds of storage, with one copy somewhere other than your building, and test that you can actually restore from it.
• Decide who is in charge of a cyber incident before you have one, and write it down. In a two- or three-person shop, that role can rotate, but it needs a name attached, not an assumption.
• Train everyone, at least once a year, to recognize a phishing email or a suspicious phone call, and to report it instead of shrugging it off.

None of that requires hiring anyone. It requires an afternoon and a checklist.

One login for three people at 2 a.m.

The instinct behind the sticky note is not wrong. When three people genuinely need the same login at odd hours, forcing separate credentials and strict role separation can slow down an emergency more than it protects you. Guidance built for small systems recognizes this directly.

A screening question in one small-system cybersecurity tool asks whether your SCADA system is used by only one person, and whether your utility has fewer than five staff. Answering yes to either lets you mark a long list of separation-of-duties controls as not applicable to a system your size.

What that guidance does not let you skip is the baseline. Passwords still need to be strong, at least eight characters mixing upper and lower case, numbers, and a special character, and every default password still needs to be changed the day a device goes in. Change passwords on a regular schedule too, every 90 days, and immediately after anyone with access leaves the job.

If your crew genuinely needs a shared credential for the SCADA laptop, make that a deliberate, written choice you revisit, not a default you backed into because nobody ever set a policy.

Keep the controls off the open internet

The single most common weak spot named across every piece of guidance is a control system reachable from the internet, whether by accident or for convenience, like a vendor leaving remote access open after an install. Unless there is a real operational reason a device needs to be internet-reachable, it should not be.

Where remote access is genuinely necessary, route it through something like a VPN, and remember a VPN only protects you if the laptop connecting to it is also clean. A secure tunnel from an infected computer does nothing.

Where you can, split your network so the office side, email, billing, the printer, sits apart from the SCADA side. A breach on one should not hand someone a path to the other. You do not need an enterprise network closet for this; even a basic separation between office Wi-Fi and the control-system connection closes a door that otherwise stays wide open.

Backups, and who decides what if something looks wrong

Back up your control-system settings the way you would back up any computer: three copies, two kinds of media, one copy stored somewhere other than the building it protects. Test the restore occasionally so it is not a surprise the day you need it. If a laptop dies or a configuration gets scrambled, and you can pull settings from a known-good backup that same day, most of what looked like an attack becomes an afternoon of annoyance instead of a lost week.

Just as important, decide in advance who has the authority to take a system offline if something looks wrong, and write it down before you need it. Guidance built for control systems is blunt about why: normal IT instincts, like rebooting the affected machine, can erase the evidence you need and sometimes make the problem worse. If something looks off, the safer first move is usually to isolate the affected device rather than restart it, and to call whoever you designated ahead of time.

What's coming on reporting, and where to get help

Reporting rules for cyber incidents at water systems are still being written at the federal level, and the details are moving, so do not build your plan around a specific date you read somewhere. Build it around a habit instead: know today who you would call if you suspected a cyber incident, whether that is your state drinking water program, the FBI, or your regional water-sector information-sharing group. You do not want to be looking up a phone number while the plant is down.

You also do not have to do any of this alone or pay for it. Federal cybersecurity assistance programs offer free remote help sized for small systems. A no-cost vulnerability scan is available to water utilities, and USDA's circuit rider program puts a technical-assistance person in your state you can call before you have a problem.

Rural water and rural community assistance groups offer the same kind of help on the assessment and planning side. None of this is a sales call. A system with no IT department is exactly who these programs were built for.

Close the easy doors, physical and digital both, and you have closed off most of the risk a small system actually faces. For the walkthrough of gates, locks, lighting, and chemical deliveries that pairs with this list, see /guides/security-walkthrough-for-small-systems. The rest of the manager track lives at /field-guide#managers.