Water SCADA cyber security is no longer something to add after commissioning. Each upgrade that moves an outstation from dial-up to IP, adds remote access for a vendor, or connects SCADA to a corporate data platform changes the risk. The Drinking Water Inspectorate lists among its roles regulating the cyber security aspects of water supplies, and the NCSC's Cyber Assessment Framework is the yardstick most assessments use.
This article is written for control engineers and project managers, not security specialists. The goal is simple: deliver PLC, SCADA and telemetry upgrades that your security team can assess quickly and that do not create problems they have to fix later.
The framework your assessors will use
The NCSC Cyber Assessment Framework (CAF) version 4.0 was published in April 2024. It has 4 high-level objectives and 14 principles, broken into 41 contributing outcomes, each rated achieved, partially achieved or not achieved. It is written as outcomes rather than a checklist, which means design evidence matters: assessors want to see why a system is secure, not just that a box was ticked.
The NCSC's operational technology guidance makes a point every water engineer will recognise: in OT the priorities are often safety, reliability and availability, while IT has traditionally focused on confidentiality, integrity and availability. Security measures that stop a pump starting during a storm are not acceptable, so design choices need both views.
Design decisions that matter on control projects
| Area | Good practice in design | Evidence to hand over |
|---|---|---|
| Network zones | SCADA, PLC and telemetry in separate zones with controlled conduits | Zone and conduit drawing |
| Remote access | Through a managed gateway with MFA, no direct vendor links | Access method statement |
| Outstation comms | Private APN or VPN, never public IP | Comms architecture and firewall rules |
| Accounts | Named users, no shared default passwords | User and role matrix |
| Backups | Offline copies of PLC, HMI and SCADA projects | Backup register and restore test |
| Logging | Configuration changes and logins recorded | Log sources list |
Asset inventory starts with the I/O list
You cannot protect devices you do not know about. A control upgrade is the ideal moment to build an accurate inventory: every PLC, HMI, switch, router, outstation and drive with its firmware version, IP address and owner. Most of this information is already in the design documents. Put it in a format the security team can import rather than in a PDF drawing.
Standards to align with
Many water companies ask suppliers to follow the ISA/IEC 62443 series for industrial automation security, alongside their own security standard. For a control integrator the practical parts are zones and conduits, secure development practice and clear security requirements for each component. Your client's own standard always comes first.
Patching and firmware without stopping the plant
IT teams patch monthly. Control systems cannot, because every change to a PLC or SCADA server is a change to how the plant runs. The practical answer is a test environment. If the upgrade project builds a simulated plant for factory testing, keep it: it becomes the place to try firmware updates and SCADA patches before they reach a live works. Agree a patch policy with the security team that sets how quickly critical updates are tested and applied, and what compensating measures cover the gap.
Remote support done safely
Remote access is how most control suppliers, including us, support commissioning and fault-finding. It is also a common route into industrial networks. Insist on access that your organisation controls: requested per job, approved by a named person, time-limited, recorded and routed through your own gateway. Avoid permanent VPNs to vendors and remote desktop tools installed on engineering stations. A supplier who objects to these controls is telling you something.
The same applies to engineering laptops. A laptop that programs PLCs at three different water companies in a week should be treated as untrusted. Many clients now provide a dedicated engineering workstation inside the control network and ask suppliers to connect to it rather than plug in their own machines. It slows the first day slightly and removes a whole class of risk.
Telemetry: the biggest change in AMP8
Thousands of network sites are moving from analogue lines to IP as the PSTN closes. Each one becomes a networked device in a field kiosk. Use private mobile networks or VPNs, keep configuration ports closed, and make sure outstations do not accept configuration changes from the network unless authorised. Our telemetry outstation replacement guide covers the wider project.
Securing the Shop Floor: OT Cybersecurity for Global Industrial Operations
Siemens
This video is hosted on YouTube. Playing it loads content from Google, which may set cookies.
Watch on YouTubeWhat we do and what we do not do
Wartens designs and programmes PLC, SCADA and telemetry systems to your engineering and security standards, and hands over the evidence your assessors need. Formal security assessments, penetration tests and CAF self-assessments should be run by your security team or a specialist provider. Keeping those roles separate gives a cleaner audit trail.
For the bigger picture on the investment cycle driving these upgrades, read AMP8 automation.
Next step
If you have a SCADA or telemetry upgrade coming up, send us the architecture drawing and your security requirements. We will show how the design meets them in our scope through our water and wastewater controls service, or talk to our team.
