At a Glance

The July 30 FBI/EPA warning says water and wastewater utilities in at least seven states reported incidents involving internet-facing PLCs after July 27, and some activity degraded water operations. [1]

The immediate lesson is operational: internet reachability, remote access, device configuration, and the ability to switch to safe manual operations can determine how far a cyber event reaches into physical service delivery. [1]

A practical resilience program starts by knowing vital assets, reducing unnecessary exposure, controlling remote access, segmenting networks, preparing isolation, and testing recovery. [2] [3] [4] [5]

What the Verified U.S. Warning Establishes

The FBI cyber-alert stream records the July 30, 2026 joint FBI/EPA warning on malicious activity targeting internet-facing operational technology used by water utilities. The evidence is a documented incident set, not a universal prevalence estimate for all U.S. critical infrastructure. [1]

The Business Boundary Is the Essential Service

For critical infrastructure, the useful question is not simply whether an attacker reached a network. It is whether the organization can continue delivering water, power, transportation, manufacturing output, public services, or another essential function safely. Cyber risk becomes operational risk when a digital path can alter monitoring, control, availability, or operator confidence. That is why service ownership, fallback procedures, and recovery evidence belong in the same conversation as firewalls and credentials.

Reduce Reachability Before Buying More Complexity

Recent federal guidance repeatedly returns to a simple control: avoid unnecessary direct internet exposure for OT. NIST’s 2026 water-sector remote-access guidance shows that remote operations can be enabled through designed architectures rather than direct device exposure. [2] [3]

Remote Access Is an Operating Decision

Remote access often exists for valid reasons: small utilities need off-site support, plants need specialist maintenance, and distributed infrastructure benefits from centralized oversight. The answer is not to declare every connection unsafe. Secure remote access should be treated like a controlled operating capability, not a permanent convenience. [2]

Build for a Disconnected Day

EPA’s 2026 National Cyber Drill was built around a scenario in which telecommunications and internet access were unavailable or unreliable. The exercise emphasized maintaining critical functions when SCADA remote connectivity, cloud services, email, and other digital communication tools could not be assumed. [4]

Protect Operator Confidence

A cyber incident can create two simultaneous problems: an actual change in the process and uncertainty about whether displayed information can still be trusted. Teams need clear authority to compare local conditions, device states, trusted configuration records, and independent observations. The goal is to prevent a rushed return to normal connectivity when the organization has not yet established what changed or whether the affected path remains unsafe.

Executive Metrics That Reveal Readiness

Percentage of vital OT assets with a named service owner, current inventory record, and documented criticality.

Count of public-facing or externally reachable OT services, with approved business justification and current controls.

Percentage of remote-access paths using named accounts, approved methods, logging, and tested revocation.

Median time to isolate an affected OT path while preserving the minimum safe service.

Percentage of critical configurations and logic with tested, versioned recovery copies.

Age of unresolved exceptions involving internet exposure, shared credentials, unmonitored vendor access, or untested manual operations.

Standards and Threat Mapping

Current federal guidance converges on reducing unnecessary internet exposure, securing remote access, prioritizing baseline cyber practices, and exercising continuity when connectivity is degraded. [2] [3] [4] [5]

Visual Decision Architecture

The following decision models convert the campaign thesis into a repeatable sequence for executive review, operational containment, continuity, recovery, and governance. They are CyberTech Intelligence synthesis tools, not claims that every incident follows the same path.

Critical Infrastructure Cyber Attack Path

Figure 1. Critical Infrastructure Cyber Attack Path - From Reachable OT to Verified Recovery

Stage

Operational Meaning

1. Find a reachable path

An internet-facing OT device, remote-access service, vendor connection, or weakly protected pathway makes operational technology reachable.

2. Gain operational access

The actor reaches a device or supporting system with enough access to view, change, or disrupt operations.

3. Change trusted state

Passwords, addresses, configurations, project files, logic, or other trusted settings are changed or misused.

4. Degrade visibility or control

Operators lose monitoring, control, or confidence and must determine what remains safe to operate.

5. Protect the essential service

Teams isolate the affected path, preserve evidence, and use approved manual or fallback procedures.

6. Restore and validate

Teams restore known-good settings and access, verify changes, strengthen monitoring, and stage normal operations.

Operational Isolation and Recovery Decision Workflow

Figure 2. Operational Isolation and Recovery Decision Workflow

Decision Step

Required Outcome

1. Define the essential service

Confirm the service, minimum safe state, dependencies, and accountable incident authority.

2. Isolate the risky path

Separate affected OT and enabling systems at preplanned isolation points without unnecessary service loss.

3. Preserve evidence

Retain configurations, access logs, network records, change history, vendor activity, and operator observations.

4. Sustain operations

Use approved manual operations, local control, alternate communications, or other continuity procedures.

5. Restore trust

Restore known-good configurations, rotate credentials, validate communications and logic, and reconnect in stages.

6. Improve the system

Close root causes, update architecture and procedures, assign owners, and retest response and recovery.

Critical Infrastructure Cyber Resilience Maturity Model

Figure 3. Critical Infrastructure Cyber Resilience Maturity Model

Maturity

Operating Pattern

Leadership Priority

Reactive

Exposure and recovery dependencies emerge during an incident.

Identify vital services, exposed assets, owners, and isolation options.

Defined

Policies exist, but IT, OT, vendors, and continuity remain separate.

Standardize inventory, access, segmentation, monitoring, response, and recovery.

Connected

Cyber, operations, engineering, safety, vendors, and executives share evidence.

Use one resilience model around essential-service outcomes.

Measured

Exposure, access, isolation, recovery tests, and exceptions are measured by service.

Prioritize investment using operational impact and tested evidence.

Adaptive

Controls evolve from incidents, exercises, architecture changes, and threat intelligence.

Scale proven patterns and retest assumptions as dependencies change.

Governance and Decision Rights

Figure 4. Critical Infrastructure Cyber Resilience Governance Framework

Decision Stage

Accountable Owner

Required Evidence

Exit Criteria

Critical-Service Scope

Business / Operations Owner

Essential service, safe state, dependencies, impact tolerance, and fallback method.

Service priority and continuity requirements approved.

Architecture and Access

OT / Engineering / Security

Asset inventory, exposure, remote access, identities, segmentation, vendors, and change controls.

Material paths are owned and constrained.

Detection and Response

CISO / Incident Commander

OT telemetry, network records, change events, escalation criteria, isolation, and communications.

Detection, escalation, and containment tested.

Continuity and Recovery

Operations / Engineering Owner

Manual operations, backups, known-good configurations, recovery sequence, validation, and rollback.

Return-to-service evidence and authority recorded.

Improvement and Investment

Executive Risk Committee

Exercises, incidents, exceptions, corrective actions, regulatory duties, and investments.

Actions are funded, owned, and closed with evidence.

CyberTech Intelligence Critical Infrastructure Cyber Resilience Framework™

Eight operating layers connect essential-service purpose to reduced exposure, controlled access, observable operations, reliable isolation, trusted recovery, and evidence-led governance.

Figure 5. CyberTech Intelligence Critical Infrastructure Cyber Resilience Framework™ - Eight-Layer Architecture

Layer

Name

Operating Requirement

01

Know

Identify essential services, OT assets, owners, dependencies, remote connections, vendors, and minimum safe states.

02

Reduce Exposure

Remove unnecessary internet exposure, retire unused pathways, secure gateways, and eliminate insecure defaults.

03

Control Access

Use named identities, strong authentication where feasible, least privilege, time-limited vendor access, and rapid revocation.

04

Segment

Separate business IT, OT zones, safety functions, remote-access paths, and management networks by operational need.

05

Observe

Monitor access, configuration change, network behavior, privileged actions, and service conditions for reconstruction.

06

Isolate

Predefine and test graduated isolation so teams can contain a cyber path without improvising.

07

Recover

Maintain tested backups and known-good configurations, manual alternatives, integrity checks, and staged restoration.

08

Govern

Align cyber, operations, engineering, safety, legal, compliance, vendors, and executives around service continuity.

Critical Infrastructure Cyber Resilience Readiness Score™

Table. Critical Infrastructure Cyber Resilience Readiness Score™

Domain

Executive Assessment Question

Ready-State Evidence

Asset Visibility

Can leaders identify OT assets and support systems for each essential service?

Current inventory, owner, function, criticality, version, dependencies, and review evidence.

Internet Exposure

Are public-facing OT devices and services known, justified, and minimized?

Exposure inventory, approved exceptions, secure gateways, rules, and recurring verification.

Remote Access

Is every remote-access path attributable, approved, monitored, and revocable?

Named accounts, approved methods, strong authentication where feasible, limits, logs, and revocation tests.

Network Segmentation

Can compromise in business IT or one OT zone be contained?

Documented zones, conduits, access rules, third-party paths, diagrams, and isolation tests.

Identity and Privilege

Do users, services, and vendors have only required operational access?

Role-based access, unique credentials, privileged controls, reviews, and termination procedures.

OT Monitoring

Can teams detect and reconstruct unauthorized access or configuration change?

Network telemetry, device-change records, time synchronization, retention, alerts, and investigation procedures.

Response and Isolation

Can teams isolate an affected path without unmanaged operational risk?

Graduated isolation plan, decision rights, test evidence, alternate communications, and preserved forensic data.

Manual Operations and Continuity

Can essential service continue if remote connectivity or central monitoring is unavailable?

Manual/local procedures, trained operators, dependency map, alternate communications, and exercises.

Backup and Recovery

Are configurations, logic, and support data recoverable from trusted copies?

Versioned backups, change integration, restore tests, known-good baselines, validation, and rollback.

Third-Party Access

Are vendor connections and shared support paths governed as operational exposure?

Vendor inventory, contract controls, access windows, monitoring, notification, and offboarding evidence.

Executive Governance

Are operational cyber risks, exceptions, exercises, duties, and investments owned?

Risk register, service metrics, exception aging, exercises, corrective-action closure, and executive decisions.

How to Calculate the Score

Rate each domain from 0 to 4: 0 = absent; 1 = informal; 2 = documented; 3 = implemented and tested; 4 = measured and continuously improved. The maximum is 44 points. Divide the total by 44 and multiply by 100. Suggested bands are Critical (0-24%), Developing (25-49%), Defined (50-69%), Managed (70-84%), and Adaptive (85-100%). The score is an internal readiness aid. It is not a certification, a statement of compliance, or a prediction of incident likelihood.

Continue the Critical Infrastructure Cyber Resilience Journey

Use this asset to review one essential service end to end. Confirm the service owner, vital OT assets, exposed and remote-access paths, identities, segmentation, monitoring, isolation choices, manual operating method, backup and recovery evidence, vendor dependencies, and executive risk decision. CyberTech Intelligence can support a facilitated executive resilience assessment or working session built around organization-specific evidence.

Assess Your Readiness

See How Prepared Your Organization Is for Critical-Infrastructure Cyber Disruption. Explore the Cybertech Intelligence Critical Infrastructure Resilience Checklist.

About CyberTech Intelligence

CyberTech Intelligence provides research-led cybersecurity intelligence, executive content, and market engagement programs. This publication is vendor-neutral and intended for education and decision support.

Research and Citation Governance

This asset uses public sources current through August 21, 2026. Incident statements are limited to what the cited organizations published within their stated scope. CyberTech Intelligence does not infer local exposure, customer impact, actor identity where authorities have not attributed an incident, control effectiveness, or incident probability without organization-specific evidence. Framework and scorecard content are CyberTech Intelligence analysis and are presented as decision aids rather than external proof points.

References

[1] Federal Bureau of Investigation, “2026 Cyber Alerts,” July 30, 2026. https://www.fbi.gov/investigate/cyber/alerts/2026 Accessed August 21, 2026. Relevance: Lists the July 30 joint FBI/EPA warning on attacks against internet-facing PLCs used by water utilities.

[2] National Institute of Standards and Technology, “NIST Guidelines for Secure Remote Access in Water and Wastewater Systems,” June 24, 2026. https://www.nist.gov/news-events/news/2026/06/nist-guidelines-secure-remote-access-water-and-wastewater-systems Accessed August 21, 2026. Relevance: Explains NIST SP 1800-45 and practical secure remote-access architectures for water and wastewater OT.

[3] CISA, FBI, EPA, and DOE, “Primary Mitigations to Reduce Cyber Threats to Operational Technology,” May 6, 2025. https://www.cisa.gov/sites/default/files/2025-05/fact-sheet-primary-mitigations-to-reduce-cyber-threats-to-operational-technology-508c.pdf Accessed August 21, 2026. Relevance: Recommends removing unnecessary public-internet OT exposure, changing default passwords, and strengthening access controls.

[4] U.S. Environmental Protection Agency, “EPA 2026 National Cyber Drill,” July 8, 2026. https://www.epa.gov/cyberwater/epa-2026-national-cyber-drill Accessed August 21, 2026. Relevance: Describes an exercise built around maintaining water operations when telecommunications and internet access are degraded or unavailable.

[5] CISA, EPA, and FBI, “Top Cyber Actions for Securing Water Systems,” February 23, 2024. https://www.cisa.gov/sites/default/files/2024-02/fact-sheet-top-cyber-actions-for-securing-water-systems.pdf Accessed August 21, 2026. Relevance: Provides prioritized cyber actions for water systems, including reducing public-facing exposure and conducting regular assessments.