Remote access can help a water operator support equipment across several sites. It also creates a route that needs a clear owner, a defined purpose, and controls suited to the process. A review should establish which devices can be reached, who can reach them, and what happens if that access is misused.
Build a current connection inventory
A July 2026 FBI and EPA alert described attacks on exposed water-sector controllers. The alert concerns reported incidents, not a finding about every water system. Its relevance to a local utility depends on the equipment and connections in use.
The first useful question is whether the organization has a current picture of those connections, including access arranged by maintenance providers and equipment suppliers.
Review exposure with the operational owner
Begin with an inventory prepared alongside the people responsible for operations. Record the device, its function, the person or provider responsible, and the approved path for remote support. Include cellular connections and equipment at smaller sites that may sit outside the main office network. Keep sensitive configuration details in an agreed secure location rather than distributing them through an ordinary contact form or public document.
Ask the technical and operational teams to review any direct internet exposure. The federal alert recommends removing that exposure through appropriate secure connectivity. The method needs to fit the equipment and operating requirements. A qualified team should plan the work, confirm responsibilities, and preserve a recovery route before changing a live connection. Operators should understand how the change affects monitoring, alarms, and remote assistance.
Plan reporting and recovery responsibilities
Access controls are only part of the discussion. Review the records needed to recognize an unauthorized change and the process for deciding what to do about it. Staff should know how to reach the people responsible for the equipment, including outside normal office hours. A response plan needs contact details that remain available if the usual network or mailbox cannot be used.
Discuss manual operation and recovery with the operators who would carry them out. The aim is to understand readiness and identify gaps, rather than to improvise instructions for controlling equipment. Any exercise should follow the utility's established safety procedures and the appropriate technical guidance. Record the questions raised, who will resolve them, and which findings require a provider's assessment before a decision can be made. Ask the operator and provider to confirm who keeps the inventory current when support arrangements or equipment ownership changes.
Keep ownership current when providers change
The useful starting document is a connection record, not a list of equipment names alone. For each support arrangement, the responsible team should be able to identify the provider, the approved purpose, and the person who can authorize access. If the operator and supplier describe the arrangement differently, treat that as a question to resolve before deciding on a technical change.
Include the end of the maintenance relationship in the discussion. Who confirms that access is no longer needed, who performs the authorized change, and how does the organization record completion? A supplier contract ending does not by itself explain which operating arrangements must change. The people responsible for the equipment need to participate in that decision.
Use the next review meeting to check the unresolved items. Ask for the evidence or decision needed to move each item forward, rather than accepting a general statement that remote access has been reviewed. This keeps the work connected to a particular service and its responsible team.
Arrange a scoped technical conversation
All Ways Better can help organize that scoping conversation and identify the relevant assessment or implementation support. We will ask about the service, the people involved, and the constraints a provider needs to understand. The specialist team confirms its role, delivery scope, timing, and fees. The initial discussion can help the utility request work that addresses a defined concern.
Sign up today to receive a free initial implementation consultation. Provide a general description of the concern and a suitable business contact. Our team will follow up to arrange a call. The offer covers the initial conversation; it does not include an engineering assessment, operational instructions, emergency response, or implementation services.
