Water utility infrastructure and treatment environment

Industry

Water Utilities

Cybersecurity and documentation support for remote pumping stations, telemetry, legacy PLCs, mixed vendor estates, and ageing SCADA platforms.

Sector context

Water utilities operate critical infrastructure that directly affects public health, environmental protection and service continuity. Treatment works, pumping stations, reservoirs, chemical dosing systems, telemetry networks and wastewater sites all depend on reliable OT systems.

The cybersecurity challenge in water is often scale. A single organisation may operate hundreds or thousands of distributed assets, many of which are unmanned, remotely accessed and built around legacy control equipment.

Examples on this page are fictionalised, generalised or anonymised to show typical problem types without identifying real clients, real sites, real drawings, real systems or confidential project details.

Common OT cybersecurity problems in water utilities

Typical issues include

  • Large numbers of small remote sites
  • Weak visibility of connected assets
  • Legacy RTUs and PLCs
  • Shared or poorly governed remote access
  • Inconsistent network documentation
  • Limited separation between telemetry, control and business systems
  • Ageing HMIs or engineering workstations
  • Unclear ownership between operations, IT, suppliers and framework contractors

Relevant services

  • OT cybersecurity assessment
  • Asset visibility review
  • Remote access assessment
  • OT risk assessment
  • Documentation support
  • FAT/SAT cybersecurity checklist support

The common struggle

Water OT estates often include a mix of old and new systems. Some sites may have modern SCADA and telemetry arrangements, while others still rely on older RTUs, local panels, radio links, cellular routers or vendor-managed equipment.

The result is often an environment where operations know the process well, but the cybersecurity evidence is incomplete. These issues become difficult when the organisation needs to evidence risk reduction, support a regulatory review, prepare for a project gateway or respond to an internal audit.

Stakeholders involved

Water cybersecurity has several competing pressures. The work needs to be practical, repeatable and scalable across many site types.

Stakeholder pressures

  • Operations need continuity of supply and treatment
  • Environmental teams need confidence that process disruption will not lead to discharge incidents
  • Engineering teams need changes that can be delivered across many site types
  • IT and cyber teams need improved governance and monitoring
  • Capital delivery teams need standard requirements that suppliers can follow
  • Compliance teams need evidence mapped to recognised expectations

How Meridian can help

Meridian Consultants helps water utilities review OT cybersecurity risks in a way that reflects real operational constraints.

The focus is on making the OT environment easier to understand, manage and evidence.

Support can include

  • OT cybersecurity readiness reviews
  • Site and telemetry architecture reviews
  • Remote access assessments
  • Asset visibility gap reviews
  • IEC 62443-aligned zoning and conduit support
  • NCSC CAF evidence support
  • Supplier and project cybersecurity requirement reviews
  • FAT, SAT and handover cybersecurity checklists
  • Practical improvement plans for distributed estates

Practical outcome

A useful review should help a water utility focus limited time and investment on the areas that create the most operational and assurance value.

A useful review should help clarify

  • Which sites or systems create the highest exposure
  • Where remote connections enter the OT environment
  • Which assets are poorly documented
  • What controls can be standardised
  • What evidence is needed for assurance
  • What can be improved without disrupting operations

Illustrative scenario

Example scenario: A water utility required support assessing cybersecurity risks across remote sites where telemetry, PLCs, and SCADA systems were connected through mixed legacy and modern infrastructure.

The objective was to improve OT visibility, review remote access routes and produce practical evidence for project and assurance discussions without exposing sensitive site details.

Discuss water utilities OT cybersecurity

Book a technical discovery call to discuss the control system, project stage, documentation gap or assurance requirement without exposing sensitive site or client details.