Executive Brief

The FBI’s cyber-alert channel records a July 30, 2026 warning on malicious activity targeting internet-facing PLCs used by water utilities. [1] The playbook treats cyber resilience as a service-continuity capability rather than a product checklist.

Define the Essential Service and Risk Tier

Start with the physical or public service. Risk tiering should drive the depth of segmentation, monitoring, response testing, recovery evidence, and executive review. A service that can affect public safety or widespread operations deserves a stronger evidence threshold than a low-impact support process.

Build an Authoritative OT Asset and Dependency Inventory

An inventory must support decisions during a live event. Record devices, controllers, HMIs, engineering workstations, gateways, network equipment, remote-access systems, firmware and software versions, owners, physical locations, functions, criticality, and dependencies. [4]

Reduce Unnecessary Exposure

Start with what is externally reachable. Identify direct internet exposure, remote-access portals, vendor tunnels, cloud-managed devices, shared communications services, and legacy management interfaces. Remove pathways that no longer have a business purpose. For those that remain, use controlled gateways, explicit authorization, monitoring, and documented ownership. The goal is not isolation for its own sake; it is to ensure every externally reachable path exists because the service needs it and because the organization can govern it.

Control Remote Access and Privilege

Use named accounts, role-based access, strong authentication where feasible, time-bounded vendor access, separate administration, rapid revocation, and records of privileged changes. When a legacy device cannot support modern controls, place stronger controls around the device through gateways, network separation, monitoring, and operational procedures. [5]

Segment for Containment and Continuity

Design zones and conduits around process function and trust. Separate business IT from OT, separate high-impact functions from lower-impact support systems, control vendor entry points, and avoid management paths that bypass intended boundaries. Segmentation is only meaningful when the organization has current diagrams and has tested what happens when a boundary is closed. The test should verify both containment and the minimum safe service.

Observe Operational Change

Collect enough evidence to explain who connected, what configuration changed, which device or network path was affected, and what operational condition followed. Security telemetry should be correlated with operator observations and change records. Detection that only reports an IP address may be insufficient for an incident commander deciding whether a process can continue. The objective is reconstructable operational evidence.

Preauthorize Isolation, Manual Operation, and Recovery

Decide in advance who can isolate remote access, separate a zone, move to local control, invoke manual procedures, preserve evidence, rotate credentials, restore configuration, and approve reconnection. Recovery should use known-good versions and staged return. DOE’s C2M2 supports capability-based maturity assessment across IT and OT, while NIST CSF 2.0 provides a common vocabulary for governance and risk outcomes. [2] [3]

A Practical 90-Day Roadmap

Days 0-30: name essential services and owners, inventory externally reachable OT and remote-access paths, and identify immediate exposure or shared-account issues. Days 31-60: validate segmentation, tighten access, define isolation and manual procedures, and establish trusted configuration and backup sources. Days 61-90: run a joint cyber-operations exercise, restore a sample configuration, measure response and isolation time, close high-impact gaps, and present residual risks and investment decisions to the executive forum.

Standards and Threat Mapping

The playbook aligns its operating model with current federal and cross-sector guidance. Each source is used within its stated scope. [1] [2] [3] [4] [5]

Visual Decision Architecture

The following decision models convert the campaign thesis into a repeatable sequence for executive review, operational containment, continuity, recovery, and governance. They are CyberTech Intelligence synthesis tools, not claims that every incident follows the same path.

Critical Infrastructure Cyber Attack Path

Figure 1. Critical Infrastructure Cyber Attack Path - From Reachable OT to Verified Recovery

Stage

Operational Meaning

1. Find a reachable path

An internet-facing OT device, remote-access service, vendor connection, or weakly protected pathway makes operational technology reachable.

2. Gain operational access

The actor reaches a device or supporting system with enough access to view, change, or disrupt operations.

3. Change trusted state

Passwords, addresses, configurations, project files, logic, or other trusted settings are changed or misused.

4. Degrade visibility or control

Operators lose monitoring, control, or confidence and must determine what remains safe to operate.

5. Protect the essential service

Teams isolate the affected path, preserve evidence, and use approved manual or fallback procedures.

6. Restore and validate

Teams restore known-good settings and access, verify changes, strengthen monitoring, and stage normal operations.

Operational Isolation and Recovery Decision Workflow

Figure 2. Operational Isolation and Recovery Decision Workflow

Decision Step

Required Outcome

1. Define the essential service

Confirm the service, minimum safe state, dependencies, and accountable incident authority.

2. Isolate the risky path

Separate affected OT and enabling systems at preplanned isolation points without unnecessary service loss.

3. Preserve evidence

Retain configurations, access logs, network records, change history, vendor activity, and operator observations.

4. Sustain operations

Use approved manual operations, local control, alternate communications, or other continuity procedures.

5. Restore trust

Restore known-good configurations, rotate credentials, validate communications and logic, and reconnect in stages.

6. Improve the system

Close root causes, update architecture and procedures, assign owners, and retest response and recovery.

Critical Infrastructure Cyber Resilience Maturity Model

Figure 3. Critical Infrastructure Cyber Resilience Maturity Model

Maturity

Operating Pattern

Leadership Priority

Reactive

Exposure and recovery dependencies emerge during an incident.

Identify vital services, exposed assets, owners, and isolation options.

Defined

Policies exist, but IT, OT, vendors, and continuity remain separate.

Standardize inventory, access, segmentation, monitoring, response, and recovery.

Connected

Cyber, operations, engineering, safety, vendors, and executives share evidence.

Use one resilience model around essential-service outcomes.

Measured

Exposure, access, isolation, recovery tests, and exceptions are measured by service.

Prioritize investment using operational impact and tested evidence.

Adaptive

Controls evolve from incidents, exercises, architecture changes, and threat intelligence.

Scale proven patterns and retest assumptions as dependencies change.

Governance and Decision Rights

Figure 4. Critical Infrastructure Cyber Resilience Governance Framework

Decision Stage

Accountable Owner

Required Evidence

Exit Criteria

Critical-Service Scope

Business / Operations Owner

Essential service, safe state, dependencies, impact tolerance, and fallback method.

Service priority and continuity requirements approved.

Architecture and Access

OT / Engineering / Security

Asset inventory, exposure, remote access, identities, segmentation, vendors, and change controls.

Material paths are owned and constrained.

Detection and Response

CISO / Incident Commander

OT telemetry, network records, change events, escalation criteria, isolation, and communications.

Detection, escalation, and containment tested.

Continuity and Recovery

Operations / Engineering Owner

Manual operations, backups, known-good configurations, recovery sequence, validation, and rollback.

Return-to-service evidence and authority recorded.

Improvement and Investment

Executive Risk Committee

Exercises, incidents, exceptions, corrective actions, regulatory duties, and investments.

Actions are funded, owned, and closed with evidence.

CyberTech Intelligence Critical Infrastructure Cyber Resilience Framework™

Eight operating layers connect essential-service purpose to reduced exposure, controlled access, observable operations, reliable isolation, trusted recovery, and evidence-led governance.

Figure 5. CyberTech Intelligence Critical Infrastructure Cyber Resilience Framework™ - Eight-Layer Architecture

Layer

Name

Operating Requirement

01

Know

Identify essential services, OT assets, owners, dependencies, remote connections, vendors, and minimum safe states.

02

Reduce Exposure

Remove unnecessary internet exposure, retire unused pathways, secure gateways, and eliminate insecure defaults.

03

Control Access

Use named identities, strong authentication where feasible, least privilege, time-limited vendor access, and rapid revocation.

04

Segment

Separate business IT, OT zones, safety functions, remote-access paths, and management networks by operational need.

05

Observe

Monitor access, configuration change, network behavior, privileged actions, and service conditions for reconstruction.

06

Isolate

Predefine and test graduated isolation so teams can contain a cyber path without improvising.

07

Recover

Maintain tested backups and known-good configurations, manual alternatives, integrity checks, and staged restoration.

08

Govern

Align cyber, operations, engineering, safety, legal, compliance, vendors, and executives around service continuity.

Critical Infrastructure Cyber Resilience Readiness Score™

Table. Critical Infrastructure Cyber Resilience Readiness Score™

Domain

Executive Assessment Question

Ready-State Evidence

Asset Visibility

Can leaders identify OT assets and support systems for each essential service?

Current inventory, owner, function, criticality, version, dependencies, and review evidence.

Internet Exposure

Are public-facing OT devices and services known, justified, and minimized?

Exposure inventory, approved exceptions, secure gateways, rules, and recurring verification.

Remote Access

Is every remote-access path attributable, approved, monitored, and revocable?

Named accounts, approved methods, strong authentication where feasible, limits, logs, and revocation tests.

Network Segmentation

Can compromise in business IT or one OT zone be contained?

Documented zones, conduits, access rules, third-party paths, diagrams, and isolation tests.

Identity and Privilege

Do users, services, and vendors have only required operational access?

Role-based access, unique credentials, privileged controls, reviews, and termination procedures.

OT Monitoring

Can teams detect and reconstruct unauthorized access or configuration change?

Network telemetry, device-change records, time synchronization, retention, alerts, and investigation procedures.

Response and Isolation

Can teams isolate an affected path without unmanaged operational risk?

Graduated isolation plan, decision rights, test evidence, alternate communications, and preserved forensic data.

Manual Operations and Continuity

Can essential service continue if remote connectivity or central monitoring is unavailable?

Manual/local procedures, trained operators, dependency map, alternate communications, and exercises.

Backup and Recovery

Are configurations, logic, and support data recoverable from trusted copies?

Versioned backups, change integration, restore tests, known-good baselines, validation, and rollback.

Third-Party Access

Are vendor connections and shared support paths governed as operational exposure?

Vendor inventory, contract controls, access windows, monitoring, notification, and offboarding evidence.

Executive Governance

Are operational cyber risks, exceptions, exercises, duties, and investments owned?

Risk register, service metrics, exception aging, exercises, corrective-action closure, and executive decisions.

How to Calculate the Score

Rate each domain from 0 to 4: 0 = absent; 1 = informal; 2 = documented; 3 = implemented and tested; 4 = measured and continuously improved. The maximum is 44 points. Divide the total by 44 and multiply by 100. Suggested bands are Critical (0-24%), Developing (25-49%), Defined (50-69%), Managed (70-84%), and Adaptive (85-100%). The score is an internal readiness aid. It is not a certification, a statement of compliance, or a prediction of incident likelihood.

Continue the Critical Infrastructure Cyber Resilience Journey

Use this asset to review one essential service end to end. Confirm the service owner, vital OT assets, exposed and remote-access paths, identities, segmentation, monitoring, isolation choices, manual operating method, backup and recovery evidence, vendor dependencies, and executive risk decision. CyberTech Intelligence can support a facilitated executive resilience assessment or working session built around organization-specific evidence.

Take the Next Step

Turn the Guidance Into Action. Request a Critical Infrastructure Cyber Resilience Assessment to Identify the Operational Gaps That Deserve Attention First.

About CyberTech Intelligence

CyberTech Intelligence provides research-led cybersecurity intelligence, executive content, and market engagement programs. This publication is vendor-neutral and intended for education and decision support.

Research and Citation Governance

This asset uses public sources current through August 21, 2026. Incident statements are limited to what the cited organizations published within their stated scope. CyberTech Intelligence does not infer local exposure, customer impact, actor identity where authorities have not attributed an incident, control effectiveness, or incident probability without organization-specific evidence. Framework and scorecard content are CyberTech Intelligence analysis and are presented as decision aids rather than external proof points.

References

[1] Federal Bureau of Investigation, “Cyber Alerts,” accessed August 21, 2026. https://www.fbi.gov/investigate/cyber/alerts Accessed August 21, 2026. Relevance: Provides the FBI cyber-alert stream, including the July 30, 2026 warning on water-sector PLC attacks.

[2] U.S. Department of Energy, “Cybersecurity Capability Maturity Model (C2M2),” updated 2026. https://www.energy.gov/ceser/cybersecurity-capability-maturity-model-c2m2 Accessed August 21, 2026. Relevance: Provides a maturity model for IT and OT capabilities and a July 2026 threat-profile development resource.

[3] National Institute of Standards and Technology, “The NIST Cybersecurity Framework (CSF) 2.0,” February 26, 2024. https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final Accessed August 21, 2026. Relevance: Provides high-level outcomes for cybersecurity risk governance and management across sectors and maturity levels.

[4] National Security Agency, “NSA Joins CISA and Others to Share OT Asset Inventory Guidance,” August 13, 2025. https://www.nsa.gov/serve-from-netstorage/press-room/Press-Releases-Statements/Press-Release-View/Article/4273440/nsa-joins-cisa-and-others-to-share-ot-asset-inventory-guidance/index.html Accessed August 21, 2026. Relevance: Explains why current OT asset inventory and taxonomy are foundational to risk identification, vulnerability management, and incident response.

[5] CISA and EPA, “EPA Guidance on Improving Cybersecurity at Drinking Water and Wastewater Systems,” September 2024. https://www.cisa.gov/sites/default/files/2024-09/epa-guidance-on-improving-cybersecurity-at-drinking-water-and-wastewater-systems-1.pdf Accessed August 21, 2026. Relevance: Provides a cybersecurity checklist, risk-mitigation planning guidance, and priority practices for water and wastewater systems.