Make water-system cyber resilience a service-continuity responsibility

Map critical treatment, pumping, monitoring, and chemical-control functions, including their IT, OT, vendor, and communications dependencies.

Document safe manual or degraded-mode procedures and exercise them with operators, executives, emergency management, and public-information staff.

Restrict and monitor remote access to OT environments; remove dormant accounts, enforce strong authentication where supported, and review vendor access regularly.

Create an incident contact tree with utility, government, law-enforcement, public-health, and equipment-provider roles, then test it outside business hours.

Use available sector guidance and partnership channels to identify high-impact gaps, but record which controls are implemented locally and which remain assumptions.