Industry Blueprint · Water

Keep the water flowing.Control every route in.

Water companies depend on suppliers, remote engineering and telemetry to keep treatment works, reservoirs and pumping stations running. Control for Water protects treatment operations, governs remote access and preserves your ability to recover, without touching the process.

Discuss your industry Blueprint Explore the Control Plans

Treatment works, reservoirs and remote pumping stations
NIS Regulations, with DWI oversight for drinking water
Five Control Plans, plus Offline Secure Storage®
Treatment, pumping and telemetry never disconnected automatically

The industry reality

Water runs on connections. Most were never designed to close.

Treatment works, reservoirs and pumping stations depend on telemetry, specialist suppliers and equipment built to run for decades. That connectivity keeps water flowing. It is also how incidents get in.

Remote, unstaffed sitesPumping stations and reservoirs report over telemetry, often with nobody on site.

Equipment built to last decadesPLCs and HMIs stay in service long after vendors stop updating them.

Specialist suppliersPump, instrument and SCADA suppliers need remote access to keep equipment running.

Threats this Blueprint addresses

Supply chain riskRansomwareLegacy system riskInsider threatRegulatory risk

of breaches in Verizon’s 2026 report involved a third party, up from 30% the year before.

Verizon 2026 Data Breach Investigations Report

0hours

to report an incident affecting the essential service under the NIS Regulations, overseen for drinking water by the DWI.

Drinking Water Inspectorate, NIS Regulations 2018

nationally significant cyber incidents handled by the NCSC in the year to August 2025, up from 89.

NCSC Annual Review 2025

In each case, the water kept flowing.

What stopped was everything around it: automation, billing and customer data. That is the disruption Control for Water is built to limit.

Customer data

South Staffs Water2022

Attackers were inside the network for nearly two years before they were found. Drinking water stayed safe, but 633,887 people’s data was published, and the ICO fined the company £945,000 in 2026.

Bitdefender, reporting the ICO

Manual operations

Arkansas City, Kansas2024

After a cyber incident, the water treatment facility switched to manual operations as a precaution. The water supply stayed safe.

Infosecurity Magazine

Customer service

American Water2024

The company disconnected systems, took its customer portal offline and paused billing. It said its water and wastewater facilities were not affected.

TechTarget

What needs protecting

Not just systems. The service people rely on.

A water operator is not simply worried about ransomware. It has to keep treatment, distribution, telemetry, safety and its regulatory obligations intact.

Treatment and disinfectionThe control of treatment processes at each works.

Distribution and pumpingThe pumping stations and reservoirs that keep supply moving.

Telemetry and SCADAThe visibility operators rely on to run the network.

PLC programs and configurationsThe logic that runs the plant, and the known-good copies to restore it.

Customer and billing dataIncluding information about customers on the Priority Services Register.

The people who depend on supplyHouseholds, hospitals, schools and businesses.

Threats and failure scenarios

How an incident could actually develop.

Four credible scenarios for a water operator, and the Control Plans that address each one.

Ransomware on corporate IT

Starts in corporate IT

A laptop opens a malicious attachment.
Ransomware spreads across corporate IT.
It reaches the industrial DMZ over the always-on IT–OT link.

Addressed by
CP-04 Physical Segmentation CP-01 Ransomware Containment

A compromised supplier session

Starts on a supplier’s laptop

A supplier’s laptop is compromised.
Its standing VPN reaches the access broker.
The engineering route leads on to treatment PLCs.

Addressed by
CP-03 Third-Party Access CP-02 Incident Containment

Stolen engineering credentials

Starts in the industrial DMZ

An engineer’s password is phished.
It works on the access broker.
PLC programs can be changed remotely.

Addressed by
CP-03 Third-Party Access CP-05 Critical Infrastructure

An unknown route at a remote site

Starts at a pumping station

A modem was installed for support years ago.
It is not on any network drawing.
It gives a direct route to a pumping station controller.

Addressed by
CP-05 Critical Infrastructure

Industry architecture

Illustrative sector connections.

Corporate IT, the industrial DMZ, treatment works, remote sites, operational suppliers and the management network, with Offline Secure Storage® deployed separately. Step through each stage.

Illustrative sector connection

Stage

Without Control: the selected routes remain open.

Modules in this Blueprint

Shown when the agreed Control response is selected.

An illustrative ransomware event starts in a connected system and follows the open routes shown here. This is a connection model, not a prediction of a real attack.The open connections allow movement in this simplified model. Actual exposure depends on your environment and existing defences.

Selected connection states

Supplier VPNAlways connected
Engineering routeAlways connected
IT–OT linkAlways connected
Data feedAlways connected
Recovery access (OSS)Disconnected

!Illustrative threat starts at · Laptops and email
+Modelled movement to · Billing
+Modelled movement to · Logins
+Modelled movement to · Historian
+Modelled movement to · Access broker, SCADA
+Modelled movement to · Treatment PLCs, Control room, Pumping stations
+Modelled movement to · Engineering PC, Reservoirs

This model only shows the selected routes. An interrupted route does not remove an existing compromise or protect unmodelled paths. Your security tools detect the event; the agreed Control design governs the response. Offline Secure Storage® holds copies separately; it is not a Control module.

Recommended industry Blueprint

Our recommended Blueprint for Water.

For Water, we recommend controlled supplier access and selected boundaries between corporate IT and operational systems, with treatment, telemetry and safety dependencies assessed separately.

Start with these connections: Supplier support into engineering systems, and the boundary between corporate IT and operational support.
Agree how access works: Open the selected support route for an authorised task, with an owner, a defined scope and agreed closing conditions.
Plan the response: Change only the agreed boundary after assessing the service impact. Treatment control, telemetry and safety links are not assumed disconnectable.

Refine this recommendation with water operations, engineering and security leads. Offline Secure Storage® can hold recovery copies separately; it is not a Control module.

As featured in

Operational scenarios

Safe at every stage. Available throughout.

How the Blueprint behaves in normal operation, maintenance, supplier access, incident response and recovery, with safety and availability first.

StageWhat happensWho decidesOn record

1Normal operationNo standing routes

Supplier and engineering routes stay disconnected. The IT–OT link and data feed stay connected, with Firebreak® ready.UnlinkFracture

Set in the Blueprint, signed off by operations and your NIS lead.

Crossing states, continuously.

2MaintenancePlanned engineering change

The engineering route opens to the named equipment for an approved change, then is removed.RelayLockUnlink

The operations owner approves. The duty operator confirms the plant is ready.

Change, window and session.

3Supplier accessBooked supplier visit

Two people approve. Relay opens the supplier route to the access broker and the one PLC in the job, Lock limits it to the named engineer, and Unlink removes it afterwards.RelayLockUnlink

The operations owner and the duty operator.

Request, both approvals, session and close.

4Incident responseConfirm, then close

The duty operator confirms the plant is safe. Execute runs the agreed action, Firebreak® closes the routes into treatment and Isolate holds OT apart.ExecuteFractureIsolate

The incident owner authorises. The IT–OT link can close automatically on a high-confidence alert.

The decision, who made it, why, and each cut.

5RecoveryCheck, then reconnect

PLC programs are checked against known-good copies in Offline Secure Storage®, the industrial DMZ is rebuilt, and crossings are reconnected one at a time.

The operations owner signs off each reconnection.

Every check and reconnection.

Never part of an automatic disconnection: treatment control loops, disinfection dosing, local control at sites and the telemetry operators rely on. Those dependencies are mapped before any crossing is agreed.

Why it is safe to rely on

01Independent zones

Close the supplier route. Keep the plant running.

What we engineered: Suppliers, the industrial DMZ, treatment works and remote sites are separate zones. A route between them can be closed without touching the process.

The result: A misused session goes no further, and the water keeps flowing.

Control for OT environments

02Out-of-band command path

Take control independently of the process network.

What we engineered: An independently governed command path for authorised connection changes. Available methods and operating conditions are agreed for the deployment.

The result: The authorised operator can manage agreed connection changes without relying solely on the affected process path. Command availability still needs to be verified.

Protecting the management plane

03An evidential record

Supplier windows, on record.

What we engineered: Configured window openings, closures and approvals are timestamped and logged locally and, where integrated, to SysLog.

The result: Evidence for your NIS lead, the regulator and your insurer.

Control in a live incident

Resilience and recovery

Control the route. Protect the baselines.

Control for Water decides which routes into OT exist. Offline Secure Storage® is a separate, physically disconnected environment with its own access and recovery arrangements.

Known-good PLC programs and configurations
Recovery images for industrial DMZ and SCADA servers
Evidence retained for your NIS lead and the regulator

Explore Offline Secure Storage®

Standards and governance

What it supports, and what you keep.

Control for Water can help support these obligations. It does not make you compliant on its own.

Aligned to how you are regulated

1NIS Regulations 2018Overseen for drinking water by the DWI, with incident reporting within 72 hours.
2NCSC CAFObjective B, protecting against cyber attack, and objective D, minimising the impact of incidents.
3IEC 62443-3-3SR 5.1 and SR 5.2: zones, conduits and boundary protection.
4MITRE ATT&CK for ICSExternal remote services and valid accounts used to reach control systems.

Evidence to retain

1Crossing registerEvery route into OT, its normal state and its owner.
2ApprovalsBoth approvals for every supplier and engineering window.
3Commands and statesEvery command and observed state, timestamped and sent to SysLog.
4Test resultsIsland-mode and supplier-window tests, with operations present.
5ReconnectionChecks against known-good copies, and sign-off.

Technical guide

Control for Water

The water architecture and its trust zones
The Control Plans, crossings and decision rules
Safety dependencies and what is never touched
Testing, evidence and handover

Request the Blueprint

What Control for Water does

Closes routes into OT, physically, at Layer 1.
Leaves the process alone. Treatment, pumping and telemetry keep running.
Gives suppliers access on your terms, for booked jobs only.
Records configured windows and decisions for your NIS lead and regulator.

What it does not do

Control the process. It never starts, stops or changes plant.
Replace OT monitoring. Your monitoring spots problems, and Control acts on decisions.
Patch your PLCs. It reduces their exposure while they keep running.
Make you compliant on its own. It can help support your NIS duties.

Deployment and proof of concept

Start with one route. Prove it. Then expand.

Most water companies start with supplier access at one site, then extend the same Blueprint across works and remote sites.

1Assess
Map every route into OT, including modems and cellular routers at remote sites.
2Prioritise
Choose the route that matters most. For most water companies, that is supplier access.
3Pilot
Put one crossing under control at one site, with operations involved from the start.
4Test
Run island-mode and supplier-window tests against agreed acceptance criteria.
5Expand
Extend the same Blueprint to more crossings, works and remote sites.

→Plan your first route

Start with the route you would close first.

Tick anything that sounds familiar. You’ll see where your discovery session would start, and which modules it would use.

Outcomes

What success looks like, and how it is measured.

The Blueprint is judged on results you can test, not on what is installed.

No standing supplier routesMeasured by

The crossing register shows supplier and engineering routes disconnected by default.

Every window approved and recordedMeasured by

Each window has two approvals, a named engineer and a signed open and close.

The IT–OT link can close while sites runMeasured by

An island-mode test with operations present, and service checks throughout.

Recovery checked against known-good copiesMeasured by

PLC programs compared with the copies in Offline Secure Storage® before access returns.

?Questions worth asking

Before you change how suppliers connect.

Your operations team will want reassurance. Your NIS lead will want evidence. Here are the practical answers.

No. Treatment, pumping, local control loops and the telemetry you rely on are never part of an automatic disconnection. Control for Water only controls the routes into them.

They request a window for a named job. Two people approve it: the operations owner signs off the booking and the duty operator confirms the plant is ready. The route then opens for that job only.

The duty operator confirms the plant is in a safe state, the incident owner authorises the action, and the route is closed. Sites keep running on local and SCADA control.

Yes. Many PLCs and HMIs cannot be patched without stopping the plant. Control reduces their exposure by removing the standing routes to them, so they can keep doing their job.

No. Firebreak® decides whether a path exists rather than inspecting what travels on it, and it keeps its control and data layers completely separate.

It can help support your duties to manage risk and reduce the impact of incidents, with a record of configured actions. It does not make you compliant on its own.

Usually with the supplier route. We agree the booking process and approvers, then test it with your operations team before you rely on it.

See all questions

→Your next step

Keep the water flowing. Control the routes in.

A working session with your operations team: the routes into OT, the first one to control, and the evidence your NIS lead will ask for.

Discuss your industry Blueprint

Prefer to talk first? Speak to the team

Book a demo Speak to the team