The US National Institute of Standards and Technology (NIST) September 2026 draft of Special Publication 800-82 Revision 4, Guide to Operational Technology (OT) Security, has broken water and wastewater infrastructure into its own dedicated section (2.5.5) examining the operational technologies, infrastructure dependencies, and cybersecurity challenges facing water and wastewater utilities.
The Revision 4 comment period runs through the end of November 2026, so edits may still appear in Section 2.5.5. After a summer of cyberattacks in the news, where the US Cybersecurity & Infrastructure Security Agency (CISA) observed malicious cyber activity targeting over 100 water and wastewater systems in July alone, OT cybersecurity in the water sector is a big part of the national conversation.
The expanded discussion in this revision is an important recognition of the unique challenges facing a sector responsible for one of society's most essential services. Water utilities must maintain continuous operations while managing aging infrastructure, increasingly connected control systems, geographically dispersed equipment, and limited cybersecurity resources.
These recent cyberattacks have exposed weaknesses in internet-connected industrial equipment, remote access, and the management of operational technology. The expanded material examines processes and technologies associated with chemical treatment, filtration, ultraviolet purification, water-quality monitoring, pumping stations, and distribution systems. It also recognizes the challenges associated with monitoring and controlling infrastructure spread across large geographic areas.
Specific additions to NIST Revision 4, Section 2.5.5 draft
At the time of writing, additions to NIST Revision 4, Section 2.5.5:
- Explicitly discuss chemical feeds, filtration, UV purification, and water-quality monitoring.
- Identify pump stations, pressure sensors, telemetry, and communications dependencies.
- Explicitly identify small utilities' dependence on managed service providers (MSPs).
- Recommend defining cybersecurity responsibilities in MSP contracts.
- Specifically address water and wastewater system (WWS) remote access, authentication, credentials, monitoring, and patching.
- Connect cybersecurity decisions with water safety regulations and reporting obligations.
ISA/IEC 62443 standards offer a framework
Several parts of the ISA/IEC 62443 series of OT cybersecurity standards align with NIST's expanded water sector discussion. The ISA/IEC 62443 series provides a complementary framework to translate cybersecurity considerations into practice.
- ISA 62443-2-1 addresses cybersecurity program requirements for asset owners, helping organizations establish policies, governance, responsibilities, and ongoing cybersecurity management.
- ISA 62443-2-4 addresses security-related requirements for service providers, supporting clearer expectations for organizations responsible for installing, integrating, maintaining, and supporting industrial automation and control systems.
- ISA 62443-3-2 provides a methodology for assessing cybersecurity risk, defining the system under consideration, identifying zones and conduits, and establishing target security levels appropriate to potential operational consequences.
- ISA 62443-3-3 establishes technical system security requirements, including identification and authentication, access control, system integrity, restricted data flow, response to events, and resource availability.
The ISA/IEC 62443 standards don’t assume that every water utility faces identical risks or should implement identical security measures. A small rural treatment facility and a large metropolitan water system may share common threats but have significantly different architectures, operational dependencies, resources, and potential consequences.
A risk-based methodology helps organizations identify what is most critical, understand how systems could be compromised, and establish security requirements proportionate to the risks involved.
A consistent approach to a global challenge
Although NIST guidance originates in the United States, the challenges facing water and wastewater infrastructure extend well beyond national borders. These shared challenges highlight the importance of internationally recognized cybersecurity standards that provide a common technical foundation for asset owners, equipment suppliers, system integrators, and service providers.
National guidance and regulations can address specific regional priorities, while international standards such as ISA/IEC 62443 support consistent cybersecurity practices across technologies, organizations, and geographic boundaries.
The expanded water and wastewater discussion in NIST's Revision 4 draft represents an important step in recognizing the operational realities and cybersecurity challenges facing this essential infrastructure sector.
However, recognition alone does not reduce risk.
Meaningful progress requires utilities to translate guidance into practical actions, establish clear accountability, evaluate cybersecurity through the potential consequences to physical operations, and incorporate security into ongoing engineering and operational decisions.
