INDUSTRY / WATER & WASTEWATER UTILITIES
Ratepayers expect the water to run. Ransomware doesn't care that it's critical infrastructure.
A small IT team keeps billing, work orders, and the systems that actually run the plant going, often with a budget that hasn't grown to match the target on its back. Water and wastewater utilities are a stated priority for ransomware groups, and the line between the operational systems that run the plant and the business systems that run the office is often thinner than it should be. Cyber6 helps you keep those systems separated, keep service running, and answer resident and ratepayer requests without adding headcount you don't have.
7 min read
Security timeline
- ResolvedRansomware attempt blocked on billing server
- ActionWork order backlog: 34 open, 6 overdue
- ResolvedBackup of billing database verified
- AlertSCADA network segment showing traffic from business VLAN
WE GET IT
We know what your week looks like
- 01
One IT person covering billing and the plant
The same person who resets a billing system password also has some visibility into the SCADA network, because there's no one else to do it. There's no backup when they're out.
- 02
Business IT and operational technology on the same network
A vendor laptop plugged in for a billing system update can, without much friction, reach the same network segment as equipment that controls a pump or a valve.
- 03
A ransomware note that means more than data loss
For a manufacturer, ransomware means a stopped line. For a utility, it can mean an inability to bill, dispatch, or in the worst case, safely operate a treatment process, which is exactly why utilities are a stated target.
- 04
Work orders that outrun the crew
Main breaks, meter issues, and service requests come in faster than a small crew can close them out, and the backlog is tracked on a whiteboard or a spreadsheet nobody updates in real time.
- 05
Resident and ratepayer requests with no clear owner
A ratepayer calls about a high bill or a resident reports a water main issue, and the request bounces between the office and the field before anyone owns it.
- 06
Public records requests on a legal clock
A resident or reporter requests emails or records related to a project or an incident, and someone has to search old file servers and inboxes by hand against a legal deadline.
- 07
A vendor with more access than anyone remembers granting
The SCADA integrator or the billing software vendor has remote access into your network set up years ago, and nobody has reviewed what it can still reach.
- 08
Leadership finding out too late
An incident happens, and the general manager or the board hears about it from a resident or a reporter before IT has had the chance to brief them.
THE IMPACT
What it's costing you
Service ratepayers can't do without
Water and wastewater service isn't optional. An outage or a billing system failure doesn't just cost money, it stops people from getting clean water or having their bills processed correctly.
Public trust and safety concerns
An incident that touches operational systems raises safety questions a utility can't wave off, and a ransomware note that makes the news damages trust that took years to build.
Staff time on manual work
Hours spent tracking work orders on a whiteboard or routing resident calls by hand are hours not spent on the maintenance and service work only your crew can do.
Grant and insurance eligibility
State and federal infrastructure funding, along with most cyber insurance policies, increasingly expect baseline security controls, including network separation. Without them, funding and coverage options shrink.
Regulatory and legal exposure
Missing a public records deadline, or failing to show reasonable safeguards after an incident, brings scrutiny and legal exposure a small utility isn't set up to absorb.
COMPLIANCE
Rules you have to follow
EPA cybersecurity expectations for water systems
- What it is
- EPA guidance and increasing regulatory attention requiring water and wastewater systems to assess and address cybersecurity risk, including to operational technology.
- Who it applies to
- Public water systems, with expectations scaling to system size.
- What it expects of you
- A documented risk and resilience assessment, an emergency response plan, and evidence of reasonable safeguards for both business and operational systems.
- How Cyber6 helps
- We run the assessment, document your emergency response plan, and put the network separation and monitoring behind it in place.
State public records and privacy laws
- What it is
- State laws governing public records requests and notification if resident or ratepayer data is exposed, which vary by state.
- Who it applies to
- Every public utility, though specific deadlines and thresholds differ by state.
- What it expects of you
- Timely response to public records requests, and notification to affected residents and the state following a data exposure.
- How Cyber6 helps
- We help you find records faster during a request, and build the incident response plan that meets your state's notification timelines.
CISA critical infrastructure guidance
- What it is
- Federal guidance identifying water and wastewater as a critical infrastructure sector with specific ransomware and OT security recommendations.
- Who it applies to
- All water and wastewater utilities, regardless of size.
- What it expects of you
- Network segmentation between IT and OT, monitoring, and an incident response plan that accounts for operational systems, not just office systems.
- How Cyber6 helps
- We assess your current IT/OT separation, close the gaps, and build monitoring that covers both sides of the network.
This is general information, not legal advice.
THE FIX
How Cyber6 helps
AUTOMATE
Fill the gaps automatically
- Get found
The right customers find you on Google, AI search, and social, in your own voice.
- Get customers
Every call, text, form, and quote turns into booked work.
- Serve customers
Customers hear from you at the right time, without your team chasing them.
- Get paid
Money you've already earned comes in sooner, without awkward phone calls.
- Run the business
Less retyping and waiting, more time for the work that matters.
Work order tracking
Work orders are logged, assigned, and tracked automatically, with a live view of what's open and what's overdue.
Resident and ratepayer request routing
Requests are logged and routed to the right person automatically, with a tracking number the resident or ratepayer can check.
Public records search assistance
Records across email and connected systems become searchable from one place, with the legal deadline tracked automatically.
PROTECT
Protect what you're trusted with
- 01
Real separation between operational and business systems
We assess how your SCADA and control systems connect to your business network today, and build the network segmentation that keeps a compromised office laptop from ever reaching the systems that run the plant.
What this means for you: A phishing email opened in the billing office can't become an incident at the treatment plant.
- 02
24/7 monitoring across both networks
A watches both your business network and the boundary of your operational network around the clock, so an intrusion attempt at 2 AM Saturday gets stopped, not discovered Monday.
What this means for you: You get monitoring coverage no small utility staff can provide alone.
- 03
Backups that survive a ransomware attack
Billing, work order, and business systems are backed up on a schedule, kept separate from your main network where ransomware can't reach them, and tested so you know they'll actually restore.
What this means for you: An attack becomes a recovery task measured in hours, not a service disruption measured in weeks.
- 04
An incident response plan that accounts for operations, not just IT
We write the plan for who does what during an incident, including when to isolate operational systems, who notifies the state, and who briefs the board, and walk your leadership through it before you need it.
What this means for you: Nobody is improvising a decision about the plant during an active incident.
- 05
Vendor access reviewed and locked down
We review remote access held by SCADA integrators, billing software vendors, and other contractors, and confirm access is limited to what's currently needed and shut off when it isn't.
What this means for you: An old vendor login stops being a quiet way into your network.
EMPOWER
Train the people doing the work
Office and field staff
Staff security awareness training
Short, practical sessions on phishing, fake vendor invoices, and what to do when something on a screen or a device looks wrong, in language that doesn't assume an IT background.
Office staff and management
Safe AI use training
What can and can't go into tools like ChatGPT, so ratepayer data and operational details don't end up outside the utility's control.
General managers, department heads, and board members
Leadership and board briefings
Plain-language updates on what's being monitored, what's improved, and what decisions leadership needs to make before an incident, not during one.
A DAY WITH CYBER6
A day at your utility with Cyber6
7:50 AMPROTECT
A phishing email impersonating a state agency is flagged and quarantined before the billing office opens it.
9:20 AMAUTOMATE
A main break report and a high-bill inquiry, submitted through different channels, are automatically logged and routed to the right team.
11:45 AMPROTECT
An attempted connection from the business network toward the SCADA segment is blocked and logged for review, exactly as the segmentation is designed to do.
3:30 PMEMPOWER
The general manager gets a short briefing ahead of the board meeting on what's being monitored and what improved this quarter.
YOUR TOOLS
Systems we commonly see
- SCADA/control systems
- utility billing software
- work order and asset management systems
- Microsoft 365
We work alongside the systems you already use. We'll confirm what connects during your assessment.
QUESTIONS
Questions from water & wastewater utilities
No. We work alongside your IT staff, handling monitoring, segmentation, and response they don't have hours for, so the one person you have isn't covering everything alone.
We assess how it connects to your broader network and build the separation and monitoring around that boundary. Changes to control systems themselves happen carefully, in coordination with your operations team and any system integrator.
Yes. We isolate and monitor older systems more closely instead of requiring an immediate replacement, and help you plan the eventual upgrade.
Your incident response plan and tested backups mean recovery is measured in hours, with a clear process for isolating affected systems and notifying the state.
Yes. Records across email and connected systems become searchable from one place, and the legal deadline is tracked automatically.
We work alongside the systems you already run and confirm exactly what connects during the assessment.
In plain language, focused on what's being monitored, what's improved, and what decisions they need to make, not technical detail they don't need.
Nothing. It's a free review of your network separation and where your team's time is going, with a written summary of what to address first.
WHO WE'VE WORKED WITH
- A statewide cybersecurity assessment program
- Credit unions
- A water and wastewater utility
- Housing organizations
- Nonprofits and churches
- Small businesses
- A health and wellness startup
Every result is measured against your own starting point.
How we prove it →PART OF ONE PARTNER
One partner for all three.
Protect · IT & Cybersecurity
IT and cybersecurity, managed around the clock.
You're here
Empower · Training for Businesses & Individuals
Training that builds skills for your team and your career.
Explore Empower
WHY CYBER6
Why businesses choose Cyber6.
One partner, not three vendors
The people automating your work also run and protect your IT and train your team, so nothing falls between companies.
Plain language and real people
You talk to people who explain things clearly, answer the phone, and tell you what they'd do in your place.
Measured against your own numbers
We record where you start before anything changes, then report results against that baseline.
Marquis Carroll, Founder & CEO. Marquis has spent years doing hands-on IT and security work through his own business, and runs a mentorship program that has helped people start careers in tech.
Our storyGETTING STARTED
Four steps from first call to results.
Explore
A relaxed 30-minute conversation about how your business runs and what's getting in the way. No cost, no pressure.
You get: honest answers on whether we can help.
Assess
We look at your systems, security, manual work, and training needs, and record your starting numbers.
You get: a plain-English picture of your risks and opportunities.
Set up
A prioritized plan and proposal, then a kickoff that introduces your team and sets up access safely.
You get: a shared timeline and who to call for what.
Enable
We roll out in phases, train your team, and walk you through your first results.
You get: your first plain-English report, measured with PROVE.
Let's look at your systems together.
A 30-minute call. No cost, no pressure, and honest answers.