{"resourceId":"nist-nccoe-water-ot-remote-access-sp1800-45-2026","versions":[{"version":"external-32a67e06b4ee63f9bdd4f59e2d74ce2f56ee63835b51a214951cef746c0a3c7d","resource":{"id":"nist-nccoe-water-ot-remote-access-sp1800-45-2026","title":"NIST NCCoE: securing water and wastewater OT remote access after mid-2026 PLC attacks","organization":"NIST National Cybersecurity Center of Excellence (NCCoE)","sector":"Water and wastewater OT cybersecurity guidance","geography":"United States","publishedAt":"NIST Cybersecurity Insights blog, 1 Oct 2026","publicationDate":"2026-10-01","eventDate":null,"sourceName":"NIST","sourceLabel":"Federal cybersecurity guidance blog","sourceUrl":"https://www.nist.gov/blogs/cybersecurity-insights/securing-water-and-wastewater-operational-technology-environments","evidenceClass":"standards-guidance","outcomeClass":"cautionary","topics":["data-security","infrastructure","governance-procurement"],"finding":"NIST's 1 Oct 2026 blog, responding to late-July 2026 water-sector OT attacks on internet-facing PLCs reported via CISA/FBI/EPA alerts, explains that attackers changed settings and locked out operators. It points utilities to NIST SP 1800-45 architectures for secure OT remote access: conventional firewalls plus remote-access servers; cloud-brokered access for resource-constrained systems; and encrypted system-to-system links for machine-to-machine flows. Core practices stressed include asset inventory, reducing internet exposure, MFA, segmentation, least privilege and logging.","sledRelevance":"Authoritative US guidance that municipal water and wastewater utilities can implement now, and that sets the baseline any later AI detection or agentic tooling must assume.","evidence":"Federal NCCoE blog summarising SP 1800-45 build architectures and tying them to 2026 incident reporting. Not a controlled evaluation of a single product.","architectureImplications":"Prefer layered remote-access patterns (jump/bastion, MFA, role-based access, hardware encryption for M2M) over flat VPN or exposed PLC web interfaces.","governanceImplications":"Gives boards and primacy agencies a concrete reference architecture set to demand in audits and capital plans.","securityPrivacyImplications":"Directly addresses password/IP changes on exposed PLCs; logging and identity management are mandatory companions to connectivity.","caveats":"Guidance and lab reference architectures, not measured outcomes at a named utility; capacity to implement varies widely by system size.","streamIds":["utility-management"],"roles":{"sales":"Sales framing: after mid-2026 PLC lockouts, NIST is telling water utilities to fix remote access with SP 1800-45 patterns before adding analytics. Ask whether PLCs are internet-reachable and whether MFA and jump hosts exist. A bounded offer is an SP 1800-45 gap assessment and remediation design. Do not bundle AI detection as the first step.","engineering":"Engineering framing: map every current remote path to one of the three NCCoE patterns and remove direct PLC management exposure from the internet. Confirm a living asset inventory, MFA on all remote OT sessions, network segmentation and session logging before cutover. Proof of value is an external scan showing no unauthenticated controller paths plus a successful moderated vendor-access test with full session capture.","delivery":"Delivery framing: OT and IT share the work; schedule maintenance windows for firewall and identity changes. Proposed acceptance criteria are zero direct internet PLC management ports and MFA on all remote OT sessions. Risks are vendor pushback, brittle legacy devices and incomplete inventories."},"roleDetails":{"sales":{"customerProblem":"Internet-facing PLCs were exploited to change settings and lock out water operators.","stakeholders":["OT manager","IT/network lead","Plant superintendent","Vendor support"],"discoveryQuestions":["Which controllers are internet-reachable?","Is MFA required for all remote OT access?","Is there a current asset inventory?"],"valueHypothesis":"Implementing SP 1800-45-style remote access reduces lockout and tampering risk before AI tools add value.","potentialEngagement":"SP 1800-45 architecture gap assessment and remediation plan.","unsupportedClaims":["Guidance alone stops all attacks","Cloud pattern fits every utility","No operational downtime needed"]},"engineering":{"fit":"Community water/wastewater systems with remote vendor or operator access needs.","architectureIntegration":"Firewall + remote access server, or cloud-brokered access, or encrypted M2M; MFA and role-based controls throughout.","prerequisites":["Asset inventory","Network diagrams","Identity provider or cloud IdP"],"constraints":["Legacy devices","Vendor access habits","Small staff"],"security":"Remove public PLC interfaces; enforce MFA, least privilege, session logging.","proofOfValue":["External scan shows no open PLC management","MFA-enforced vendor session test","Log review of remote sessions"]},"delivery":{"work":"Inventory, redesign remote access, implement MFA/jump paths, retrain vendors.","dependencies":["Firewall changes","Identity platform","Vendor cooperation"],"ownership":"OT manager with IT security.","skillsAdoption":"Operator and vendor training on new access workflow.","governanceCheckpoints":["Architecture approval","Cutover plan","Post-cutover access audit"],"acceptanceCriteria":["Proposed: no direct internet PLC management","Proposed: MFA on all remote OT sessions","Proposed: session logs retained per policy"],"risks":["Incomplete inventory","Vendor workaround channels","Legacy device incompatibility"]}},"retrievedAt":"2026-11-05T22:08:37-06:00","enrichedAt":"2026-11-05T22:14:19-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Cloud-brokered pattern is explicitly offered for low-capacity utilities that cannot run full on-prem remote-access stacks.","procurementImplications":"Supports buying commercial remote-access and logging components that match the example architectures rather than bespoke exposure.","operatingModelImplications":"Treats secure remote support as an ongoing operating practice with governance policies, not a one-time firewall rule.","sourceVerification":{"responseId":"p6.html","openedUrl":"https://www.nist.gov/blogs/cybersecurity-insights/securing-water-and-wastewater-operational-technology-environments","referenceExcerpt":"programmable logic controllers (PLCs) were remotely accessed in an unauthorized manner","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}