At a Glance
The July 30 FBI/EPA warning says water and wastewater utilities in at least seven states reported incidents involving internet-facing PLCs after July 27, and some activity degraded water operations. [1]
The immediate lesson is operational: internet reachability, remote access, device configuration, and the ability to switch to safe manual operations can determine how far a cyber event reaches into physical service delivery. [1]
A practical resilience program starts by knowing vital assets, reducing unnecessary exposure, controlling remote access, segmenting networks, preparing isolation, and testing recovery. [2] [3] [4] [5]
What the Verified U.S. Warning Establishes
The FBI cyber-alert stream records the July 30, 2026 joint FBI/EPA warning on malicious activity targeting internet-facing operational technology used by water utilities. The evidence is a documented incident set, not a universal prevalence estimate for all U.S. critical infrastructure. [1]
The Business Boundary Is the Essential Service
For critical infrastructure, the useful question is not simply whether an attacker reached a network. It is whether the organization can continue delivering water, power, transportation, manufacturing output, public services, or another essential function safely. Cyber risk becomes operational risk when a digital path can alter monitoring, control, availability, or operator confidence. That is why service ownership, fallback procedures, and recovery evidence belong in the same conversation as firewalls and credentials.
Reduce Reachability Before Buying More Complexity
Recent federal guidance repeatedly returns to a simple control: avoid unnecessary direct internet exposure for OT. NIST’s 2026 water-sector remote-access guidance shows that remote operations can be enabled through designed architectures rather than direct device exposure. [2] [3]
Remote Access Is an Operating Decision
Remote access often exists for valid reasons: small utilities need off-site support, plants need specialist maintenance, and distributed infrastructure benefits from centralized oversight. The answer is not to declare every connection unsafe. Secure remote access should be treated like a controlled operating capability, not a permanent convenience. [2]
Build for a Disconnected Day
EPA’s 2026 National Cyber Drill was built around a scenario in which telecommunications and internet access were unavailable or unreliable. The exercise emphasized maintaining critical functions when SCADA remote connectivity, cloud services, email, and other digital communication tools could not be assumed. [4]
Protect Operator Confidence
A cyber incident can create two simultaneous problems: an actual change in the process and uncertainty about whether displayed information can still be trusted. Teams need clear authority to compare local conditions, device states, trusted configuration records, and independent observations. The goal is to prevent a rushed return to normal connectivity when the organization has not yet established what changed or whether the affected path remains unsafe.
Executive Metrics That Reveal Readiness
Percentage of vital OT assets with a named service owner, current inventory record, and documented criticality.
Count of public-facing or externally reachable OT services, with approved business justification and current controls.
Percentage of remote-access paths using named accounts, approved methods, logging, and tested revocation.
Median time to isolate an affected OT path while preserving the minimum safe service.
Percentage of critical configurations and logic with tested, versioned recovery copies.
Age of unresolved exceptions involving internet exposure, shared credentials, unmonitored vendor access, or untested manual operations.
Standards and Threat Mapping
Current federal guidance converges on reducing unnecessary internet exposure, securing remote access, prioritizing baseline cyber practices, and exercising continuity when connectivity is degraded. [2] [3] [4] [5]
Visual Decision Architecture
The following decision models convert the campaign thesis into a repeatable sequence for executive review, operational containment, continuity, recovery, and governance. They are CyberTech Intelligence synthesis tools, not claims that every incident follows the same path.
Critical Infrastructure Cyber Attack Path
Figure 1. Critical Infrastructure Cyber Attack Path - From Reachable OT to Verified Recovery
|
Stage |
Operational Meaning |
|
1. Find a reachable path |
An internet-facing OT device, remote-access service, vendor connection, or weakly protected pathway makes operational technology reachable. |
|
2. Gain operational access |
The actor reaches a device or supporting system with enough access to view, change, or disrupt operations. |
|
3. Change trusted state |
Passwords, addresses, configurations, project files, logic, or other trusted settings are changed or misused. |
|
4. Degrade visibility or control |
Operators lose monitoring, control, or confidence and must determine what remains safe to operate. |
|
5. Protect the essential service |
Teams isolate the affected path, preserve evidence, and use approved manual or fallback procedures. |
|
6. Restore and validate |
Teams restore known-good settings and access, verify changes, strengthen monitoring, and stage normal operations. |
Operational Isolation and Recovery Decision Workflow
Figure 2. Operational Isolation and Recovery Decision Workflow
|
Decision Step |
Required Outcome |
|
1. Define the essential service |
Confirm the service, minimum safe state, dependencies, and accountable incident authority. |
|
2. Isolate the risky path |
Separate affected OT and enabling systems at preplanned isolation points without unnecessary service loss. |
|
3. Preserve evidence |
Retain configurations, access logs, network records, change history, vendor activity, and operator observations. |
|
4. Sustain operations |
Use approved manual operations, local control, alternate communications, or other continuity procedures. |
|
5. Restore trust |
Restore known-good configurations, rotate credentials, validate communications and logic, and reconnect in stages. |
|
6. Improve the system |
Close root causes, update architecture and procedures, assign owners, and retest response and recovery. |
Critical Infrastructure Cyber Resilience Maturity Model
Figure 3. Critical Infrastructure Cyber Resilience Maturity Model
|
Maturity |
Operating Pattern |
Leadership Priority |
|
Reactive |
Exposure and recovery dependencies emerge during an incident. |
Identify vital services, exposed assets, owners, and isolation options. |
|
Defined |
Policies exist, but IT, OT, vendors, and continuity remain separate. |
Standardize inventory, access, segmentation, monitoring, response, and recovery. |
|
Connected |
Cyber, operations, engineering, safety, vendors, and executives share evidence. |
Use one resilience model around essential-service outcomes. |
|
Measured |
Exposure, access, isolation, recovery tests, and exceptions are measured by service. |
Prioritize investment using operational impact and tested evidence. |
|
Adaptive |
Controls evolve from incidents, exercises, architecture changes, and threat intelligence. |
Scale proven patterns and retest assumptions as dependencies change. |
Governance and Decision Rights
Figure 4. Critical Infrastructure Cyber Resilience Governance Framework
|
Decision Stage |
Accountable Owner |
Required Evidence |
Exit Criteria |
|
Critical-Service Scope |
Business / Operations Owner |
Essential service, safe state, dependencies, impact tolerance, and fallback method. |
Service priority and continuity requirements approved. |
|
Architecture and Access |
OT / Engineering / Security |
Asset inventory, exposure, remote access, identities, segmentation, vendors, and change controls. |
Material paths are owned and constrained. |
|
Detection and Response |
CISO / Incident Commander |
OT telemetry, network records, change events, escalation criteria, isolation, and communications. |
Detection, escalation, and containment tested. |
|
Continuity and Recovery |
Operations / Engineering Owner |
Manual operations, backups, known-good configurations, recovery sequence, validation, and rollback. |
Return-to-service evidence and authority recorded. |
|
Improvement and Investment |
Executive Risk Committee |
Exercises, incidents, exceptions, corrective actions, regulatory duties, and investments. |
Actions are funded, owned, and closed with evidence. |
CyberTech Intelligence Critical Infrastructure Cyber Resilience Framework™
Eight operating layers connect essential-service purpose to reduced exposure, controlled access, observable operations, reliable isolation, trusted recovery, and evidence-led governance.
Figure 5. CyberTech Intelligence Critical Infrastructure Cyber Resilience Framework™ - Eight-Layer Architecture
|
Layer |
Name |
Operating Requirement |
|
01 |
Know |
Identify essential services, OT assets, owners, dependencies, remote connections, vendors, and minimum safe states. |
|
02 |
Reduce Exposure |
Remove unnecessary internet exposure, retire unused pathways, secure gateways, and eliminate insecure defaults. |
|
03 |
Control Access |
Use named identities, strong authentication where feasible, least privilege, time-limited vendor access, and rapid revocation. |
|
04 |
Segment |
Separate business IT, OT zones, safety functions, remote-access paths, and management networks by operational need. |
|
05 |
Observe |
Monitor access, configuration change, network behavior, privileged actions, and service conditions for reconstruction. |
|
06 |
Isolate |
Predefine and test graduated isolation so teams can contain a cyber path without improvising. |
|
07 |
Recover |
Maintain tested backups and known-good configurations, manual alternatives, integrity checks, and staged restoration. |
|
08 |
Govern |
Align cyber, operations, engineering, safety, legal, compliance, vendors, and executives around service continuity. |
Critical Infrastructure Cyber Resilience Readiness Score™
Table. Critical Infrastructure Cyber Resilience Readiness Score™
|
Domain |
Executive Assessment Question |
Ready-State Evidence |
|
Asset Visibility |
Can leaders identify OT assets and support systems for each essential service? |
Current inventory, owner, function, criticality, version, dependencies, and review evidence. |
|
Internet Exposure |
Are public-facing OT devices and services known, justified, and minimized? |
Exposure inventory, approved exceptions, secure gateways, rules, and recurring verification. |
|
Remote Access |
Is every remote-access path attributable, approved, monitored, and revocable? |
Named accounts, approved methods, strong authentication where feasible, limits, logs, and revocation tests. |
|
Can compromise in business IT or one OT zone be contained? |
Documented zones, conduits, access rules, third-party paths, diagrams, and isolation tests. |
|
|
Identity and Privilege |
Do users, services, and vendors have only required operational access? |
Role-based access, unique credentials, privileged controls, reviews, and termination procedures. |
|
OT Monitoring |
Can teams detect and reconstruct unauthorized access or configuration change? |
Network telemetry, device-change records, time synchronization, retention, alerts, and investigation procedures. |
|
Response and Isolation |
Can teams isolate an affected path without unmanaged operational risk? |
Graduated isolation plan, decision rights, test evidence, alternate communications, and preserved forensic data. |
|
Manual Operations and Continuity |
Can essential service continue if remote connectivity or central monitoring is unavailable? |
Manual/local procedures, trained operators, dependency map, alternate communications, and exercises. |
|
Backup and Recovery |
Are configurations, logic, and support data recoverable from trusted copies? |
Versioned backups, change integration, restore tests, known-good baselines, validation, and rollback. |
|
Third-Party Access |
Are vendor connections and shared support paths governed as operational exposure? |
Vendor inventory, contract controls, access windows, monitoring, notification, and offboarding evidence. |
|
Executive Governance |
Are operational cyber risks, exceptions, exercises, duties, and investments owned? |
Risk register, service metrics, exception aging, exercises, corrective-action closure, and executive decisions. |
How to Calculate the Score
Rate each domain from 0 to 4: 0 = absent; 1 = informal; 2 = documented; 3 = implemented and tested; 4 = measured and continuously improved. The maximum is 44 points. Divide the total by 44 and multiply by 100. Suggested bands are Critical (0-24%), Developing (25-49%), Defined (50-69%), Managed (70-84%), and Adaptive (85-100%). The score is an internal readiness aid. It is not a certification, a statement of compliance, or a prediction of incident likelihood.
Continue the Critical Infrastructure Cyber Resilience Journey
Use this asset to review one essential service end to end. Confirm the service owner, vital OT assets, exposed and remote-access paths, identities, segmentation, monitoring, isolation choices, manual operating method, backup and recovery evidence, vendor dependencies, and executive risk decision. CyberTech Intelligence can support a facilitated executive resilience assessment or working session built around organization-specific evidence.
Assess Your Readiness
See How Prepared Your Organization Is for Critical-Infrastructure Cyber Disruption. Explore the Cybertech Intelligence Critical Infrastructure Resilience Checklist.
About CyberTech Intelligence
CyberTech Intelligence provides research-led cybersecurity intelligence, executive content, and market engagement programs. This publication is vendor-neutral and intended for education and decision support.
Research and Citation Governance
This asset uses public sources current through August 21, 2026. Incident statements are limited to what the cited organizations published within their stated scope. CyberTech Intelligence does not infer local exposure, customer impact, actor identity where authorities have not attributed an incident, control effectiveness, or incident probability without organization-specific evidence. Framework and scorecard content are CyberTech Intelligence analysis and are presented as decision aids rather than external proof points.
References
[1] Federal Bureau of Investigation, “2026 Cyber Alerts,” July 30, 2026. https://www.fbi.gov/investigate/cyber/alerts/2026 Accessed August 21, 2026. Relevance: Lists the July 30 joint FBI/EPA warning on attacks against internet-facing PLCs used by water utilities.
[2] National Institute of Standards and Technology, “NIST Guidelines for Secure Remote Access in Water and Wastewater Systems,” June 24, 2026. https://www.nist.gov/news-events/news/2026/06/nist-guidelines-secure-remote-access-water-and-wastewater-systems Accessed August 21, 2026. Relevance: Explains NIST SP 1800-45 and practical secure remote-access architectures for water and wastewater OT.
[3] CISA, FBI, EPA, and DOE, “Primary Mitigations to Reduce Cyber Threats to Operational Technology,” May 6, 2025. https://www.cisa.gov/sites/default/files/2025-05/fact-sheet-primary-mitigations-to-reduce-cyber-threats-to-operational-technology-508c.pdf Accessed August 21, 2026. Relevance: Recommends removing unnecessary public-internet OT exposure, changing default passwords, and strengthening access controls.
[4] U.S. Environmental Protection Agency, “EPA 2026 National Cyber Drill,” July 8, 2026. https://www.epa.gov/cyberwater/epa-2026-national-cyber-drill Accessed August 21, 2026. Relevance: Describes an exercise built around maintaining water operations when telecommunications and internet access are degraded or unavailable.
[5] CISA, EPA, and FBI, “Top Cyber Actions for Securing Water Systems,” February 23, 2024. https://www.cisa.gov/sites/default/files/2024-02/fact-sheet-top-cyber-actions-for-securing-water-systems.pdf Accessed August 21, 2026. Relevance: Provides prioritized cyber actions for water systems, including reducing public-facing exposure and conducting regular assessments.
Author
CyberTech Intelligence Editorial Desk
Author