From the Utility Management edition of November 5, 2026
NIST NCCoE: securing water and wastewater OT remote access after mid-2026 PLC attacks
NIST National Cybersecurity Center of Excellence (NCCoE) · Water and wastewater OT cybersecurity guidance · United States
- Publisher
- NIST
- Original publication
- NIST Cybersecurity Insights blog, 1 Oct 2026
- Source retrieved
- 2026-11-06
What happened
NIST's 1 Oct 2026 blog, responding to late-July 2026 water-sector OT attacks on internet-facing PLCs reported via CISA/FBI/EPA alerts, explains that attackers changed settings and locked out operators. It points utilities to NIST SP 1800-45 architectures for secure OT remote access: conventional firewalls plus remote-access servers; cloud-brokered access for resource-constrained systems; and encrypted system-to-system links for machine-to-machine flows. Core practices stressed include asset inventory, reducing internet exposure, MFA, segmentation, least privilege and logging.
Why it matters
Authoritative US guidance that municipal water and wastewater utilities can implement now, and that sets the baseline any later AI detection or agentic tooling must assume.
Evidence and measured results
Federal NCCoE blog summarising SP 1800-45 build architectures and tying them to 2026 incident reporting. Not a controlled evaluation of a single product.
Limitations and uncertainty
Guidance and lab reference architectures, not measured outcomes at a named utility; capacity to implement varies widely by system size.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Internet-facing PLCs were exploited to change settings and lock out water operators.
- Stakeholders
- OT manager
- IT/network lead
- Plant superintendent
- Vendor support
- Discovery questions
- Which controllers are internet-reachable?
- Is MFA required for all remote OT access?
- Is there a current asset inventory?
- Value hypothesis
- Implementing SP 1800-45-style remote access reduces lockout and tampering risk before AI tools add value.
- Potential engagement
- SP 1800-45 architecture gap assessment and remediation plan.
- Unsupported claims
- Guidance alone stops all attacks
- Cloud pattern fits every utility
- No operational downtime needed
Pre-sales engineering
Role takeaway
- Fit
- Community water/wastewater systems with remote vendor or operator access needs.
- Architecture and integration
- Firewall + remote access server, or cloud-brokered access, or encrypted M2M; MFA and role-based controls throughout.
- Prerequisites
- Asset inventory
- Network diagrams
- Identity provider or cloud IdP
- Constraints
- Legacy devices
- Vendor access habits
- Small staff
- Security
- Remove public PLC interfaces; enforce MFA, least privilege, session logging.
- Proof of value
- External scan shows no open PLC management
- MFA-enforced vendor session test
- Log review of remote sessions
Delivery
Role takeaway
- Work
- Inventory, redesign remote access, implement MFA/jump paths, retrain vendors.
- Dependencies
- Firewall changes
- Identity platform
- Vendor cooperation
- Ownership
- OT manager with IT security.
- Skills and adoption
- Operator and vendor training on new access workflow.
- Governance checkpoints
- Architecture approval
- Cutover plan
- Post-cutover access audit
- Acceptance criteria
- Proposed: no direct internet PLC management
- Proposed: MFA on all remote OT sessions
- Proposed: session logs retained per policy
- Risks
- Incomplete inventory
- Vendor workaround channels
- Legacy device incompatibility
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Prefer layered remote-access patterns (jump/bastion, MFA, role-based access, hardware encryption for M2M) over flat VPN or exposed PLC web interfaces.
Governance
Who approves, reviews and stays accountable for outcomes?
Gives boards and primacy agencies a concrete reference architecture set to demand in audits and capital plans.
Security and privacy
What data, permissions and controls need testing?
Directly addresses password/IP changes on exposed PLCs; logging and identity management are mandatory companions to connectivity.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Cloud-brokered pattern is explicitly offered for low-capacity utilities that cannot run full on-prem remote-access stacks.
Procurement
What should contracts, pricing and exit terms secure?
Supports buying commercial remote-access and logging components that match the example architectures rather than bespoke exposure.
Operating model
Which teams own the service once it runs?
Treats secure remote support as an ongoing operating practice with governance policies, not a one-time firewall rule.
Publication history
- 2026-11-05Utility Management · Issue 087 resources
Stable resource ID: nist-nccoe-water-ot-remote-access-sp1800-45-2026