All Ways Better (AWB) · Articles

Water-system security and operational risk

A security finding becomes useful when the responsible team can connect it to a service, an owner and a decision. These articles cover remote access, risk registers and assessment follow-up for water systems. They provide questions for planning with the responsible technical and operational teams, with sources linked in each article.

Discuss a scoped assessment conversation

4 articles

A July 30, 2026 FBI/EPA alert described water-sector incidents reported in at least seven states since July 27, including degraded operations. At least seven states had reported water-sector incidents since July 27, 2026, as of this alert. A dated alert, not a current national total.

Water systems4 min read

Water-system remote access needs a current owner

Use the federal controller alert to frame an inventory and an authorized review of remote connections.

Read article

An EPA OIG assessment identified critical or high-risk cybersecurity vulnerabilities at 97 drinking-water systems serving about 26.6 million people in October 2024. Scan: Oct. 8, 2024. Assessed systems served 50,000+ people each. Vulnerability findings, not confirmed attacks or affected customers.

Water systems3 min read

A water-security finding needs an owner and a decision

Separate a reported exposure from a confirmed incident, then define evidence for completion.

Read article

CISA’s July 30, 2026 alert linked attacks on exposed water-sector PLCs with operator lockouts, boil-water notices and sustained manual operations. Consequences described in the dated CISA alert. No claim that every incident caused every consequence.

Water systems4 min read

What does a security finding mean for the water service?

Bring operational context into the priority discussion and record what the technical team still needs to establish.

Read article

EPA OIG’s 2024 scan identified 97 drinking-water systems with critical/high-risk findings and another 211 with medium/low-risk findings. Assessment covered 1,062 systems serving 50,000+ people each. People served are not confirmed affected people; findings are not attacks.

Water systems4 min read

A useful water-risk register tells you the next decision

Give each concern evidence, a service owner and a clear definition of completion.

Read article