Industry
Water Utilities
Cybersecurity and documentation support for remote pumping stations, telemetry, legacy PLCs, mixed vendor estates, and ageing SCADA platforms.
Sector context
Water utilities operate critical infrastructure that directly affects public health, environmental protection and service continuity. Treatment works, pumping stations, reservoirs, chemical dosing systems, telemetry networks and wastewater sites all depend on reliable OT systems.
The cybersecurity challenge in water is often scale. A single organisation may operate hundreds or thousands of distributed assets, many of which are unmanned, remotely accessed and built around legacy control equipment.
Common OT cybersecurity problems in water utilities
Typical issues include
- Large numbers of small remote sites
- Weak visibility of connected assets
- Legacy RTUs and PLCs
- Shared or poorly governed remote access
- Inconsistent network documentation
- Limited separation between telemetry, control and business systems
- Ageing HMIs or engineering workstations
- Unclear ownership between operations, IT, suppliers and framework contractors
Relevant services
- IEC 62443 Readiness Assessment
- OT cybersecurity assessment
- Asset visibility review
- Remote access assessment
- OT risk assessment
- Documentation support
- FAT/SAT cybersecurity checklist support
Stakeholders involved
Decisions and constraints
- Operations need continuity of supply and treatment
- Environmental teams need confidence that process disruption will not lead to discharge incidents
- Engineering teams need changes that can be delivered across many site types
- IT and cyber teams need improved governance and monitoring
- Capital delivery teams need standard requirements that suppliers can follow
- Compliance teams need evidence mapped to recognised expectations
Relevant engineering work
Activities
- OT cybersecurity readiness reviews
- Site and telemetry architecture reviews
- Remote access assessments
- Asset visibility gap reviews
- IEC 62443-aligned zoning and conduit support
- NCSC CAF evidence support
- Supplier and project cybersecurity requirement reviews
- FAT, SAT and handover cybersecurity checklists
- Practical improvement plans for distributed estates
Practical outcome
Decisions the review should support
- Which sites or systems create the highest exposure
- Where remote connections enter the OT environment
- Which assets are poorly documented
- What controls can be standardised
- What evidence is needed for assurance
- What can be improved without disrupting operations
Worked example
- Context
- A water operator needs a clearer understanding of cybersecurity exposure across remote sites using a mixture of telemetry, PLCs, communications infrastructure and SCADA.
- Review focus
- Meridian can review representative architectures and access arrangements, identify recurring gaps and develop practical controls and evidence that can be applied consistently across the wider estate.
Worked technical example only; it does not describe a completed Meridian client engagement.
Related OT cybersecurity topics
Related services
Choose this when your project needs specialist engineering capacity. A defined OT cybersecurity work package for risk, architecture, design review, supplier interfaces and assurance evidence within an active industrial project.
Start here if you are unsure what applies or where to begin. Establish the boundary, applicable lifecycle context, available evidence and next engineering work before a detailed IEC 62443 assessment or project decision.
Discuss water utilities OT cybersecurity
Make an enquiry about the control system, project stage, documentation gap or assurance requirement without exposing sensitive site or client details.