Suggested Featured Image Concept: A clean, split-screen or overlay visual showing a modern water filtration plant with an overlaid, highly technical but clean network architecture map (Purdue Model lines, firewalls, and secure remote gateways), transitioning from standard physical pipes to digital bits, emphasizing secure connectivity.

The digital transformation of the Water and Wastewater Systems (WWS) sector has led to the dissolution of the traditional, air-gapped isolation of Operational Technology (OT) networks. While internet-connected sensors, Supervisory Control and Data Acquisition (SCADA) systems, and remote operations have improved municipal efficiency, they have also drastically expanded the sector's cyber-attack surface.

As the recent Cal Water incident has demonstrated, threat actors have critical infrastructure in their crosshairs and are working to target and breach IT and OT networks connected with them.

The recently released NIST Special Publication (SP) 1800-45, Cybersecurity for the Water and Wastewater Sector: Build Architecture, provides a vital blueprint to address this crisis. This analysis provides an executive and engineering evaluation of SP 1800-45, exploring its core reference architectures, practical implementation challenges, and strategic alignment with ISA/IEC 62443 and NIST SP 800-82 Rev. 3.

The vulnerable fluidity of critical infrastructure

The Water and Wastewater Systems (WWS) sector is facing unprecedented cybersecurity challenges. Historically insulated by obscurity and proprietary serial protocols, water utilities have rapidly adopted commercial off-the-shelf (COTS) components, cloud analytics, and remote maintenance channels. This IT/OT convergence has fundamentally exposed the sector. Nation-state threat actors and cybercriminal syndicates are actively targeting water treatment facilities, exploiting weak remote access mechanisms to alter chemical dosing, disrupt distribution, and hold critical public infrastructure hostage.

The vulnerability of the WWS sector stems from an asymmetric risk profile: utilities are asset-heavy but chronically resource-constrained. While a tier-one energy provider features a dedicated Security Operations Center (SOC), a mid-sized municipal water authority may rely on a single plant manager who handles both chemical balancing and IT troubleshooting. Malicious actors understand this disparity. Remote access mechanisms—deployed hastily to facilitate vendor support or weekend monitoring—have become the primary entry point for modern critical infrastructure attacks.

Against this backdrop, the National Institute of Standards and Technology (NIST) National Cybersecurity Center of Excellence (NCCoE) released NIST SP 1800-45. This practice guide directly tackles the sector’s most pressing vulnerability: Operational Technology Remote Access.

Decoding NIST SP 1800-45: Why this practice guide matters

Unlike abstract framework documents, NIST SP 1800-45 is an engineering practice guide built in a collaborative lab environment alongside technology vendors and industry experts. It transitions from the "what" of the NIST Cybersecurity Framework (CSF) 2.0 to a concrete "how."

The primary significance of SP 1800-45 lies in its focus on demonstrated, commercially available technologies. It acknowledges that water utilities cannot simply replace their legacy Programmable Logic Controllers (PLCs) or Human-Machine Interfaces (HMIs) to achieve modern security. Instead, it demonstrates how to construct a protective architectural layer around existing systems.

Core architectural principles

The document outlines foundational principles required to achieve resilient water utility operations:

• Least Privilege Access: Restricting interactive and system-to-system connections strictly to the minimum assets required for a specific operational role or function.

• Cryptographic Segmentation: Ensuring that any remote access session terminates in a secure DMZ (Demilitarized Zone) rather than bridging directly into the process control network.

• Continuous Visibility and Auditability: Logging all remote sessions at a granular level, recording every command sent to an engineering workstation or SCADA console.

Deconstructing the three reference architectures

NIST SP 1800-45 establishes three distinct reference implementations that showcase how utilities can securely enable remote access across different technology stacks. Each design addresses specific operational constraints and risk profiles.

Role-Based, console-centric access controls

This architecture focuses on managing interactive sessions by employees, contractors, and original equipment manufacturers (OEMs). Rather than granting a user a broad Virtual Private Network (VPN) connection into the network layer, this design uses specialized console-management systems (such as TDI ConsoleWorks) to isolate user activity.

Users authenticate through a centralized access gateway, where their permissions are bound to specific operational profiles. An external vendor can only view the specific HMI or PLC loop they are contracted to maintain. The system monitors the interactive session in real time, providing an explicit audit trail of all configuration changes and keystrokes.

Zero Trust access management platform

This architecture moves away from traditional, perimeter-heavy perimeter defenses by implementing a Zero Trust Architecture (ZTA) for remote endpoints. It integrates advanced Multi-Factor Authentication (MFA) platforms alongside unified access

Access is never granted based on network location. Whether an engineer connects from home or a laptop inside the plant, they must satisfy strict cryptographic authentication protocols. The Zero Trust gateway serves as a strict Policy Enforcement Point (PEP), verifying device health, user identity, and real-time context before brokering an ephemeral, encrypted proxy connection directly to the target OT asset.

Hardware-enforced network encryption

Recognizing that legacy, distributed assets—such as remote pumping stations, lift stations, and water storage tanks—often rely on vulnerable wireless or cellular backhaul networks, this architecture introduces hardware-enforced cryptographic boundaries.

By utilizing dedicated hardware encryption devices (such as Q-Net Security products), this design establishes immutable, encrypted enclaves for long-distance, system-to-system communications. Even if a physical communication channel or cellular tower is compromised, the telemetry data and control commands flowing between the primary treatment plant and remote assets remain encrypted and completely protected against injection or tampering attacks.

The strategic matrix: Comparing the reference frameworks

To help utility executives and security architects select the right path, the table below highlights the distinct attributes of each reference design:

Cross-framework harmonization: The unified OT security ecosystem

NIST SP 1800-45 does not replace existing standards; it serves as the practical enforcement mechanism for them. For a comprehensive security posture, organizations must understand how this guide harmonizes with broader industry frameworks.

ISA/IEC 62443 alignment

The foundational concept of "Zones and Conduits" within the ISA/IEC 62443 standard is directly realized through SP 1800-45's reference builds. By implementing these remote access gateways, utilities successfully establish secure conduits that regulate and monitor data flows across different security zones, preventing unauthorized lateral movement.

NIST SP 800-82 Rev. 3 integration

NIST SP 800-82 Rev. 3 provides overarching security guidance for Industrial Control Systems. SP 1800-45 takes the specific remote access controls outlined in SP 800-82 (such as jump hosts, multi-factor authentication, and separated data planes) and translates them into validated, multi-vendor product implementations.

NIST CSF 2.0 mapping

SP 1800-45 maps directly to the Protect (PR) and Detect (DE) functions of the NIST Cybersecurity Framework 2.0. Specifically, it delivers concrete blueprints for Identity Management and Access Control (PR.AA), Network Security (PR.IR), and Security Continuous Monitoring (DE.CM).

Practical implementation: A tailored approach for every utility

One size does not fit all in water and wastewater security. Utilities must evaluate their operational realities and size constraints when executing an SP 1800-45 deployment.

Small utilities (Serving under 10,000 customers)

• The reality: Limited budget; no dedicated cybersecurity personnel; high reliance on external integration partners.

• The approach: Focus on a Zero Trust proxy model. Avoid maintaining complex, on-premises identity infrastructure. Leverage cloud-managed MFA and secure access service edge (SASE) tools to shield legacy endpoints without overcomplicating local configurations.

Medium utilities (Serving 10,000 to 100,000 customers)

• The reality: Mixed environments containing modern COTS infrastructure paired with decades-old legacy PLCs; an internal IT team but limited OT-specific security expertise.

• The approach: Prioritize network segmentation and console-centric session management. Ensure that all external vendor connections terminate strictly within a DMZ jump host, and eliminate all direct-to-PLC cellular modems.

Large utilities (Serving over 100,000 customers)

• The reality: Highly complex, geographically distributed architectures; multiple treatment plants, dozens of remote lift stations; a formal corporate IT structure.

• The approach: Implement a hybrid strategy combining hardware-enforced cryptographic enclaves for distributed system-to-system telemetry alongside a robust Zero Trust access platform for internal and external personnel. Integrate session logs directly into a centralized Security Information and Event Management (SIEM) system.

Pitfalls to avoid: Overcoming real-world operational friction

Implementing SP 1800-45 requires navigating distinct cultural and operational hurdles within the water sector:

• The "Safety vs. Security" Conflict: OT teams prioritize process availability and safety above all else. If a multi-factor authentication mechanism or complex login process delays a plant operator from addressing an urgent chemical imbalance or pipe rupture, staff will inevitably find a way to bypass that security control. Security architectures must be seamless and intuitive to ensure compliance.

• The Shadow VPN Dilemma: System integrators and third-party vendors often install unmonitored cellular modems or consumer-grade remote desktop software directly onto the factory floor to simplify troubleshooting. Security teams must perform continuous asset discovery to find and eliminate these unauthorized access paths.

• Ignoring Asset Inventory Foundations: A secure remote access gateway is only effective if you know exactly what assets exist within your environment. Attempting to restrict access to a network without a precise, real-time inventory of every PLC, HMI, and smart instrument is a recipe for operational disruption.

Strategic action Items for CISOs and security leaders

To successfully integrate the principles of NIST SP 1800-45 into your organization, executive leadership should execute the following five steps:

• Conduct an Immediate Remote Access Audit: Identify every interactive and system-to-system remote connection into your OT environment. Enforce an immediate ban on all single-factor authentication paths.

• Enforce DMZ Termination for All Sessions: Ensure that no remote connection terminates directly on a control network asset. Every session must land in an insulated DMZ jump host or proxy gateway.

• Mandate Granular Session Logging: Implement logging mechanisms that capture specific command strings and configuration modifications, rather than just simple connection timestamps.

• Incorporate Security into Capital Improvement Plans: Treat cybersecurity as a core component of water infrastructure engineering rather than an isolated IT expense. Build SP 1800-45 reference designs directly into upcoming facility upgrades.

• Foster True IT/OT Collaboration: Establish cross-functional teams that pair corporate IT engineers with veteran plant operators. This ensures that security architectures align with real-world physical processes.

Building long-term cyber resilience

Regulatory frameworks and compliance mandates provide a baseline, but true resilience requires a proactive architectural approach. NIST SP 1800-45 offers a clear path forward for the water and wastewater sector, transforming cybersecurity from a theoretical goal into a practical, implementable engineering discipline.

By moving away from outdated, perimeter-reliant network security model and adopting the secure, role-based, and Zero Trust architectures validated by NIST, water utilities can confidently navigate their digital transformations. Securing our communities' water means protecting the digital systems that keep it flowing safely.

Partner with Shieldworkz to secure your Critical Infrastructure

Are you ready to transition your utility from legacy vulnerabilities to an SP 1800-45 compliant architecture? The critical infrastructure experts at Shieldworkz specialize in implementing vendor-neutral, Zero Trust remote access designs tailored specifically for the operational demands of the water and wastewater sector. Schedule a free consultation with our utility OT security experts here.   

Explore our specialized engineering resources at Shieldworkz Regulatory Playbooks to jumpstart your deployment.

Frequently Asked Questions (FAQs)

What is the primary focus of NIST SP 1800-45?

NIST SP 1800-45 is an engineering practice guide designed by the National Cybersecurity Center of Excellence (NCCoE). It demonstrates practical, multi-vendor reference architectures to secure interactive and system-to-system remote access within the Water and Wastewater Systems (WWS) sector.

How does NIST SP 1800-45 differ from NIST SP 800-82?

NIST SP 800-82 provides broad, conceptual security guidelines and control recommendations for Industrial Control Systems. In contrast, NIST SP 1800-45 is a hands-on, build-focused guide that provides specific implementation details using commercially available products to meet those security goals.

Can small municipal water utilities with limited budgets implement these architectures?

Yes. The guide features scalable designs, including proxy-based Zero Trust architectures. These models allow smaller utilities to deploy secure remote access using cloud-managed tools, minimizing the need for expensive, on-premises security infrastructure.

Why is traditional VPN access no longer recommended for OT remote environments?

Traditional VPNs generally provide broad network-layer access upon successful authentication. If a threat actor or compromised vendor device gains access via a standard VPN, they can often move laterally across the internal network to target critical PLCs and SCADA controllers. SP 1800-45 recommends identity-centric, session-isolated proxies instead.

How does this publication support compliance with ISA/IEC 62443?

SP 1800-45 maps directly to the architectural principles of ISA/IEC 62443 by establishing verified blueprints for "Zones and Conduits." It demonstrates how to effectively isolate critical process zones and securely control the communication conduits that connect them to the outside world.

Additional resources

• ICS Ransomware Defense Playbook: https://shieldworkz.com/regulatory-playbooks/ics-ransomware-defense-playbook-ot-ics-cybersecurity-guide

• IEC 62443-Based Zoning Implementation and Validation Checklist:https://shieldworkz.com/regulatory-playbooks/iec-62443-based-zoning-implementation-and-validation-checklist

• Incident Response Plan for OT/ICS - A Practical Template to Build Resilience:https://shieldworkz.com/regulatory-playbooks/incident-response-plan-for-ot-icsa-practical-template-to-build-resilience

• Facility Cybersecurity Plan & Checklist: https://shieldworkz.com/regulatory-playbooks/facility-cybersecurity-plan-checklist

• Defense Cybersecurity Comprehensive Standards Checklist: https://shieldworkz.com/regulatory-playbooks/defense-cybersecurity-comprehensive-standards-checklist