TL;DR · 30-second read

The Short Version

A US government standards agency has published a guide telling water and sewer utilities that their riskiest weak spot is remote access: the ways staff and outside contractors log in from elsewhere to run pumps and treatment equipment.

More than half of American water systems serve 500 people or fewer and have few staff to defend them.

This matters beyond your tap. Many of the giant computer buildings behind artificial intelligence use water to keep their machines cool, often supplied by those same local utilities.

The US National Institute of Standards and Technology (NIST) has published SP 1800-45, Cybersecurity for the Water and Wastewater Sector: Build Architecture, which identifies secure remote access as the immediate cybersecurity priority for water and wastewater utilities, Industrial Cyber reported on June 26. The project, run by NIST’s National Cybersecurity Center of Excellence (NCCoE), offers high-level reference architectures and three example implementations built from commercially available products.

The three designs cover a traditional on-premises gateway (demonstrated with TDI ConsoleWorks), a cloud-managed access model (StrongDM with Cisco Duo), and encrypted machine-to-machine links between remote sites (Q-Net Security hardware). NIST describes them as product-agnostic demonstrations of capability, not vendor endorsements.

Executive Summary

NIST’s new practice guide gives water utilities a concrete starting point for what it calls the most pressing gap in their operational technology (OT), the networks of controllers and sensors that physically run pumps, valves and treatment processes. Utilities have moved from manual, on-site operation to automated and remotely managed systems. That shift improved efficiency but opened two-way paths into equipment that, if misused, could let an attacker manipulate processes or create unsafe conditions.

The guidance matters to the data center industry because water is an upstream dependency for many facilities that use water-based cooling. A data center can harden its own networks and still depend on a municipal control system it neither owns nor sees into. NIST’s focus on remote access marks where that external dependency is most exposed, and its emphasis on staffing and funding signals that many utilities will struggle to close the gap quickly.

The guide is also a snapshot of a market decision facing thousands of utilities: build remote-access security in-house, rent it from a cloud provider, or encrypt the links between sites in hardware. Each choice moves risk to a different place, and at least one vendor is already arguing that none of these designs goes far enough.

Why a Water Security Guide Is a Data Center Story

A water-cooled data center, especially one that relies on evaporative cooling towers, depends on a steady supply of water at usable pressure and quality. That supply is managed by the local utility’s SCADA (supervisory control and data acquisition) system: servers, programmable logic controllers (PLCs, the small industrial computers that switch pumps and valves) and operator screens spread across a main control station, regional centers and remote pump stations. NIST’s point is that these pieces are held together by remote access, both people logging in from outside and machines at separate pumping stations talking to each other over telecom networks. The guide warns that enabling two-way remote access to operational or safety systems widens the attack surface and could allow malicious actors to manipulate processes or create unsafe conditions.

Follow that chain downstream and the conclusion in our headline follows. For a facility whose cooling depends on municipal water, the earliest point at which a cyber incident could reach its cooling is not its own chiller plant. It is the utility’s remote-access layer: the vendor login to an operator screen, the cloud-brokered session, or the unencrypted controller traffic between pump stations. NIST’s three blueprints map directly onto those three entry points, which is why they read as a map of inherited risk for anyone siting or operating water-cooled capacity.

The exposure is uneven. Facilities using air cooling or closed-loop liquid systems draw far less from the municipal supply than those running evaporative towers, and any disruption at a utility would hit hospitals, homes and industry first and just as hard. The practical point is narrower and more useful: for water-dependent sites, the utility’s cyber posture belongs in site selection, resilience planning and supply conversations, alongside drought risk and capacity allocation.

Utility Size Decides Which Blueprint Is Realistic

NIST’s own figures show why no single design fits the sector. Very small community water systems, serving between 25 and 500 people, make up more than half of all systems but serve a small fraction of the population. Fewer than 1 percent of utilities are classified as very large, serving more than 100,000 people, yet they supply nearly half of the US population. Larger utilities tend to run dispersed infrastructure with complex SCADA networks and dedicated IT and OT staff. Smaller ones often rely on simpler or fully manual systems, aging hardware, few staff and tight budgets.

That split drives the choice of architecture. NIST expects larger systems to support in-house deployments, while smaller utilities are likelier to lean on vendor-managed or cloud-based remote access. The consequence is that for a large share of the country’s water systems, security will rest heavily on the terms of a service contract. NIST explicitly warns utilities to check those contracts for encryption, access controls, intrusion detection and vulnerability management. The guide also stresses that adequate staffing and funding are essential to configure and maintain any of these environments, a quiet acknowledgment that the architecture is the easy part.

Three Architectures, Three Places to Put the Risk

The first design is the classic industrial pattern: a demilitarized zone (DMZ, a buffer network between the outside world and the control system) guarded by paired firewalls, with a remote access server inside it. Users authenticate with multi-factor authentication over HTTPS, role-based rules limit which SCADA consoles, operator screens and PLCs they can reach, and every session is logged. NIST demonstrated it with TDI ConsoleWorks. It offers the utility the most control and demands the most in-house skill.

The second moves authentication, authorization and session monitoring to cloud-managed infrastructure. Users sign in with multi-factor authentication, receive an access token, and a security gateway inside the operational network checks that token before allowing a connection. NIST demonstrated this with StrongDM and Cisco Duo. It lowers the management burden, which is why NIST pitches it at smaller utilities, but it shifts part of the trust to the provider.

The third addresses traffic that no person touches: PLCs and remote terminal units exchanging process data between sites. Here NIST recommends encryption appliances at each network edge that authenticate one another and encrypt data before it leaves. The demonstration used Q-Net Security’s Q-Box hardware to protect Modbus traffic between PLCs. Modbus is a long-established industrial protocol that was not designed with built-in encryption, so this design closes a gap that access controls on human users do not address.

The Hardware-Isolation Critique, Weighed Fairly

Mike Carr, field CTO of Xona Systems, agreed that remote access is the water sector’s biggest cybersecurity weakness, but argued that the named products are all software sitting on the same attack surface adversaries already exploit. He called for hardware-enforced protocol isolation that physically separates the user from the critical network, summarised as “You can’t hack what you can’t reach.”

The critique makes a real point: remote-access gateways are themselves internet-facing targets, and adding controls to an exposed path is not the same as removing the path. Several parts of the claim need testing against the guide itself, though. The third implementation is hardware-based. NIST presents all three as product-agnostic examples rather than recommended products. And NIST treats remote diagnostics and vendor maintenance as operational necessities, while noting that some utilities already choose one-way alarming or on-site work for sensitive tasks. The statement that attacks are seen “in the field every day” comes without incident data. Utilities weighing the argument should ask any vendor, including this one, for evidence that its model preserves the maintenance access they actually need.

Background

NIST, part of the US Department of Commerce, publishes widely used cybersecurity frameworks and guidance. Its National Cybersecurity Center of Excellence produces the SP 1800 series of practice guides, which show how commercially available products can be combined to solve specific security problems in a given sector. SP 1800-45 applies that approach to water and wastewater utilities, a critical infrastructure sector made up of thousands of systems that range from tiny rural operators to large metropolitan authorities.

For the data center industry, water has become a central siting and operating issue as capacity grows for AI and cloud workloads. Facilities that cool with water depend on the reliability of local utilities, which puts utility resilience, including the cybersecurity of utility control systems, alongside power availability and land in data center planning.

Sources

Source: NIST SP 1800-45 outlines remote access security as key priority for water, wastewater sector amid expanding OT cyber risks (Industrial Cyber): coverage of NIST’s practice guide on securing remote access to water and wastewater operational technology.