Article
How to strengthen cyber resilience in utilities: Start with operational readiness
Cyberattacks are always dangerous, and the stakes are especially high for utilities. Communities depend on them every minute of every day. Reliability is non-negotiable.
As more cyberattacks target the operational technology (OT) that supports monitoring, control, pressure management, and facility operations, cyber resilience demands more than addressing technical vulnerabilities. It hinges on operational readiness.
Are your continuity, emergency management, and disaster recovery capabilities ready for today’s complex cyber threats?
Federal warnings outline new risks for utilities
In July 2026, the FBI and EPA warned that malicious cyber actors are targeting water and wastewater utilities’ operational technology devices. Some of these attacks have degraded operations, risking monitoring and control functionality, pressure loss, and flooding.
Given this, these federal agencies are stressing manual operations maintenance and testing, business continuity and disaster recovery planning, backups, fail-safe mechanisms, and standby systems. The message is clear. Cyber incidents can move quickly from technical problems to operational readiness tests.
Traditional cyber resilience isn’t operational readiness
Utilities know that cyber disruption can be consequential, even if incidents don’t disrupt service or harm public health. Most have safeguards to protect against cyberattacks, including incident response teams, outage playbooks, and business continuity or disaster recovery procedures.
It’s a strong foundation. But it’s not always enough anymore. Cyber incidents are increasingly stressing utilities in ways that traditional defenses can’t protect against. The risk is higher for utilities with:
- Integrated systems. Connected information technology (IT) and OT systems.
- Far-reaching disruptions. Disruptions in remote access.
- Troubling trust gaps. Uncertainty around which systems can be trusted.
Cyber disruption is an operational readiness test
A cyber incident can create immediate uncertainty. Operators may lose visibility into equipment. Remote access may need to be restricted. System integrity may be unclear.
Responding effectively requires intentional, cross-functional coordination. Operations, engineering and technical teams, control systems personnel, emergency managers, utility leaders, communications staff, and critical vendors all have a role to play. They have to work together restore trusted capabilities.
The immediate challenge goes beyond restoring systems. Utilities must sustain service while they assess the operational impact and contain the disruption. This involves determining which information and systems are reliable and whether to isolate affected systems, operate manually, or begin recovery.
Five operational principles to pressure-test now
Five principles should underpin how utilities approach strengthening operational readiness.
1
Principle 1: Develop a picture of the OT environment
Pressure-testing operational readiness starts with a clear view of the operational foundation that sustains service, including all functions, assets, systems, dependencies, and people.
- Map the services that depend on which systems.
- Pinpoint all available manual or failure-mode procedures.
- Calculate how long operations can run without available or reliable technology.
2
Principle 2: Determine manual operations capability
Utilities should know which critical functions can continue if monitoring or control systems are disrupted.
- Identify all manual procedures.
- Analyze staffing requirements, safety considerations, and equipment dependencies.
- Assess the practical limits of manual operations.
3
Principle 3: Codify cross-functional decision-making
Cyber incidents move quickly. Utilities need clear decision rights across operations, IT, executive leadership, legal, procurement, communications, and external partners.
- Know who can authorize system isolation.
- Formalize vendor engagement procedures.
- Create processes for public notification and mutual aid requests.
- Address emergency purchasing and continuity plan activation.
Key questions for operational readiness
- Which operational functions should be sustained first?
- Which systems are connected to remote access, vendor tools, or enterprise networks?
- Which functions can move to manual operation, for how long?
- Which procedures depend on a small group of experienced employees?
- Which vendors are essential to response and recovery?
- Which communications channels are available if business systems go down?
- Which decisions can be made locally, and which require executive approval?
4
Principle 4: Create readiness and continuity exercises
Uncovering “hidden” readiness gaps helps utilities address unclear roles, outdated contact lists, fragile vendor dependencies, missing manual procedures, inconsistent escalation paths, and training needs. It also builds confidence across teams that rarely work together but must move fast during a disruption.
- Conduct tabletop exercises.
- Run functional simulations.
- Prioritize after-action reviews and improvement plans.
5
Principle 5: Plan to communications amid uncertainty
Cyber incidents can create public concern quickly, especially when water service, pressure, quality, wastewater operations, or power are involved. Utilities need specific communications protocols for sharing accurate and timely information with stakeholders while facts are still developing:
- Inform customers about what is known, what may be affected, actions to take, and when to expect communications.
- Prepare employees to route questions, report issues and clarify information
- Ensure regulators receive timely notice of potential service, quality, or operational impacts.
- Provide elected officials with talking points to answer community questions
- Communicate with emergency management partners on operational status, public safety considerations, resource needs and mutual aid triggers
Practice is the best protection from cyberattacks
Following these principles and creating a plan for operational resilience is only the beginning. The advantage comes from continually practicing and refining these plans as cyber risk evolves. The goal for utilities isn’t controlling every threat. This simply isn’t possible. Instead, the goal is to control how prepared they are to keep essential services moving when the inevitable disruption occurs.
