Remediation Guide
Incident Response Plan For
Municipal & Wastewater Utilities
Incident Response Plan for Municipal and Wastewater Utilities Know What To Do Before the Next Coordinated Attack Hits. Not Improvise.
Municipal water and wastewater utilities are now a confirmed, active target for coordinated cyberattacks, not a hypothetical one. In July 2026, more than thirty municipal water systems across Minnesota experienced a coordinated attack affecting operational technology, including control valves, pumps, and automated control functions. Communities including Braham, Maple Plain, Plymouth, and South St. Paul shifted to manual operations within hours. Officials confirmed water quality was never compromised. The reason it wasn't has a name: the utilities had a way to keep running safely without trusting their automated systems.
Most water utilities don't have that today. Shieldworkz has developed the Incident Response Plan for Municipal and Wastewater Utilities a field-usable, IEC 62443 and NIST SP 800-61–aligned remediation guide that gives OT operations leads, SCADA engineers, utility directors, and municipal IT security teams a structured, ready-to-adopt playbook for detecting, containing, and recovering from a cyber incident without losing control of the physical process. This is not policy language written for a compliance binder. Every role, severity threshold, decision tree, and scenario playbook in this guide is built around how a water utility actually operates under pressure.
Why this Remediation Guide matters
OT incident response at a water utility carries a consequence that most cybersecurity playbooks were never built to handle: a control-system compromise can directly affect public health, not just uptime or data confidentiality. A ransomware note on a billing server and an unauthorized command sent to a chlorine dosing pump are fundamentally different problems, but almost every water utility responds to both the same way, because most existing IR documentation was written for corporate IT and simply relabeled for OT.
This guide corrects that. It separates containment into distinct IT and OT actions with different authorization thresholds, so a network isolation decision never overrides a safe-operations call from the OT Operations Lead. It classifies severity by public-health consequence rather than generic IT impact scoring, so a confirmed SCADA takeover is treated as critical by default, not scored the way a routine malware alert would be. And it treats the plant operator who notices a setpoint that doesn't match physical conditions as a frontline detection source, not an afterthought behind SIEM alerts and network monitoring dashboards.
Key Takeaways from the Remediation Guide
A dual-track containment model. IT and OT containment actions are split explicitly, with separate authorization thresholds, so isolating a network segment never happens without the OT Operations Lead confirming it won't remove visibility needed to run a treatment process safely.
Severity classification tied to public-health impact, not IT scoring. A confirmed chemical dosing change or SCADA takeover triggers immediate Incident Commander activation and executive notification within the hour, regardless of how contained the technical footprint looks.
Scenario-specific playbooks for the highest-consequence failure modes. Dedicated response procedures for SCADA compromise, PLC logic tampering, engineering workstation compromise, compromised vendor VPNs, chemical dosing anomalies, pump station disruption, and telemetry loss, the exact categories reflected in the Minnesota campaign.
Manual-operations readiness treated as a control, not a fallback. In nearly every recent water-sector incident, the ability to revert to trained, tested manual operation was the single factor that prevented a public-health consequence.
Decision trees for the judgment calls that matter most. Clear, pre-agreed guidance on isolating a segment versus a full process shutdown, and on when to notify regulators, law enforcement, or the public, so those calls aren't made from scratch under pressure.
Ready-to-use communication templates. Internal notifications, executive briefings, regulatory reports, media statements, and customer advisories, drafted in advance so nothing is written from a blank page during a live incident.
How Shieldworkz Strengthens Your OT Incident Response Readiness
Building the plan is one step. Proving it holds up under real conditions is another. Shieldworkz is an OT/ICS and industrial cybersecurity specialist that works directly with water and wastewater utilities to close the gap between a documented incident response plan and an organization that can actually execute one, mapped against the frameworks this checklist already references: NIST CSF 2.0, NIST SP 800-61 Rev. 3, IEC 62443, CISA's Cross-Sector Cyber Performance Goals, and AWWA's water sector guidance.
OT-aware security assessments: our OThello Assess methodology maps your actual SCADA, PLC, HMI, and telemetry architecture in sub-24-hour assessment cycles, building the current, accurate asset inventory this plan's Preparation phase depends on.
Continuous OT network detection and response: our NDR platform is built to catch the indicators this checklist relies on, unauthorized SCADA commands, PLC logic drift, anomalous vendor VPN activity, and multi-site telemetry loss, before an operator has to catch it manually.
Tabletop and functional exercises: run against the exact scenarios this plan's playbooks cover, SCADA compromise, chemical dosing anomalies, pump station disruption, and telemetry loss, so your team rehearses the decision, not just reads about it.
Vendor and remote-access risk reduction: assessments of standing VPN and remote-support access into OT, aligned with this plan's Section 8.4 and 8.5 playbooks on remote access abuse and compromised vendor connections
Patch and configuration management for legacy OT: practical remediation guidance for PLCs and RTUs that can't simply be patched like an IT asset, supporting the Eradication and Recovery phases of this plan.
Regulatory readiness support: translating CISA, EPA, state primacy agency, NIS2, IEC 62443, and NERC CIP obligations into procedures your operations team can follow without a lawyer standing next to them.
Utilities that engage us early aren't just building a document, they're building the muscle memory and technical visibility to respond the way the Minnesota utilities did: fast, calm, and grounded in verified facts rather than guesswork.
Be Ready to Respond, Download the Water & Wastewater Cyber Incident Response Plan
This plan is built for utility decision-makers, IT and OT security leaders, SCADA engineers, plant and operations managers, and incident response teams responsible for protecting water treatment, wastewater, pumping, distribution, and other critical operational systems. It provides a structured, field-ready approach to preparing for, detecting, containing, eradicating, and recovering from cybersecurity incidents while maintaining safe and reliable utility operations.
Fill in the form to download the complete Water & Wastewater Utility Incident Response Plan and gain a practical framework covering OT-specific response procedures, SCADA and PLC compromise, remote-access threats, chemical dosing anomalies, pump station disruption, telemetry loss, incident decision trees, communications, business continuity, operational checklists, and recovery validation.
Download your copy today!
Get the free Water & Wastewater Utility Incident Response Plan and strengthen your readiness for OT cyber incidents.
