Frequently asked questions.

Apply through our utility sign-up form — either as a self-signup for you or to sign up on behalf of your utility admin with whom we will meet. You'll be asked for the utility's name and, if known, its PWSID (Public Water System ID) or town/state, plus contact information for the utility's admin contact and, if you're nominating on someone else's behalf, your own.

Enrollment happens in phases based on available capacity, so applications aren't necessarily onboarded immediately — further discussion happens at your intake meeting, where things like your existing IT/MDR relationships (see below) and the specifics of your environment get worked out. You can also reach us anytime through the contact form with questions before applying.

The situation is unique to every utility, and during initial phases like the pilot, resources are limited. That said, we make every effort to accommodate as many utilities as we can because the complex variety of situations is exactly what we need — it is exactly what helps us improve the service and work out additional details before moving on to the next phase of deployment to a wider audience of utilities. Our intake meeting, scheduled as a direct result of the application, is where we evaluate what phase makes the most sense for all involved.

We recommend applying regardless of phase or capacity concerns because then we have visibility into the needs of the utility community. Once you've applied, you'll be able to track your status and communicate with us through the applicant portal, and see exactly where your application stands at all times.

MSSP stands for Managed Security Service Provider. Rather than a one-time audit, a security product sale, or an occasional consulting engagement, an MSSP provides ongoing, continuous monitoring, threat detection, and response — functioning as an outsourced security team rather than a single deliverable.

Water Watch Center describes itself as a nationwide, not-for-profit MSSP focused specifically on small and rural drinking water and wastewater systems. That means enrolled utilities get continuous monitoring of their environment (both IT and the OT/ICS systems covered elsewhere on this page), not a report that goes stale the day it's delivered.

Water Watch Center is built for small and rural drinking water and wastewater systems in the U.S. and Puerto Rico — the utilities least likely to have dedicated in-house cybersecurity staff and most likely to be under-resourced relative to the threat they face.

Enrollment happens in phases with agreed-upon capacity limits at each stage, rather than all at once — applications are placed into a phase based on available capacity, and further specifics get worked out at your intake meeting. You can apply for your own utility or nominate another utility through the utility sign-up form.

Water Watch Center isn't a standalone vendor asking utilities to take it on faith — it's a joint initiative of the National Rural Water Association and DEF CON Franklin, developed with the University of Chicago Harris School of Public Policy, and supported by philanthropic funders including the William and Flora Hewlett Foundation and Craig Newmark Philanthropies. NRWA in particular already has decades of trusted, on-the-ground relationships with the rural water systems it serves through its network of Circuit Riders and field staff — WWC is delivered through that existing relationship, not a cold introduction from an unfamiliar company.

Beyond the founding organizations, WWC works with named, vetted security providers (see the full list on our About page) rather than operating as a single opaque entity, and holds its own systems to the same standard it advocates for enrolled utilities — see the privacy question below for specifics on how utility and website data is handled. If you'd like to verify any of this independently, every founding organization, security provider, and sponsor listed on the About page links directly to that organization's own site.

This isn't hypothetical — see our News page for real, independently reported incidents. A few patterns show up repeatedly:

• Business disruption. American Water, the largest U.S. water utility, took its billing systems offline after detecting unauthorized network activity affecting more than 14 million customers.
• Ransomware against small, under-resourced systems. Starr-Iva Water and Sewer District, serving roughly 9,500 residents in South Carolina, was hit by the Medusa ransomware group — a reminder that attackers don't only target large utilities.
• Direct access to control systems. Multiple 2026 reports describe intrusions reaching water utility control systems directly, not just office networks, with federal officials describing a "significant escalation" in attacks against internet-exposed water system controllers.
• Attempted manipulation of treatment parameters. The most widely cited example remains the 2021 incident at a Florida water treatment facility, where an intruder briefly and remotely increased the sodium hydroxide (lye) setpoint before an operator caught and reversed it in real time — a case that's become a standard reference point for why OT monitoring, not just IT monitoring, matters for water systems specifically.

The common thread: these aren't sophisticated, multi-stage breaches of well-defended networks. Most succeed through a single unsegmented path — remote access, exposed controllers, or a compromised office network with an unrestricted path into the control system — which is exactly the class of gap this FAQ's ICS/OT questions below are about.

IT (Information Technology) is the ordinary business-computing side of a utility: email, billing systems, office computers, general internet access. OT (Operational Technology) is the equipment and systems that directly monitor and control the physical treatment process — the ICS/SCADA systems and PLCs covered in the next question.

The two have different priorities by design. IT security generally prioritizes confidentiality (don't leak the data) and can tolerate a reboot or a patch window. OT prioritizes availability and safety — a SCADA system controlling a live treatment process usually can't just be rebooted mid-operation the way an office laptop can, and OT equipment routinely stays in service, unpatched, for 15-20 years or longer. Different priorities and different equipment lifespans mean OT needs a different security approach than IT does — not a lighter one, a different one.

ICS stands for Industrial Control System — the equipment, networks, and software used to monitor and directly control physical processes: pumps, valves, chemical dosing systems, treatment equipment, and electrical switchgear. In a water or wastewater utility, the ICS is the layer that actually opens a valve or starts a pump, as distinct from the office network used for email, billing, or web browsing.

SCADA (Supervisory Control and Data Acquisition) is the specific type of ICS most water and wastewater utilities run day to day. PLCs (Programmable Logic Controllers) are the small industrial computers within a SCADA system that carry out the physical instructions — open this valve, start that pump, alarm if this tank level gets too high.

Industrial control systems communicate using their own set of network protocols — different from the web/email/file-sharing traffic on a typical office network — each with its own standard TCP or UDP port. Some of the most common ones seen at water and wastewater facilities:

• Modbus TCP — port 502. One of the oldest and most widely deployed ICS protocols, used to poll and command PLCs. Simple and reliable, but has no built-in authentication or encryption.
• DNP3 (Distributed Network Protocol) — port 20000. Very common in water/wastewater and electric utility SCADA specifically, designed for reliable polling over unreliable long-distance links like radio or leased telephone lines. Like Modbus, no built-in security in its base form.
• EtherNet/IP — ports 44818 (TCP/UDP) and 2222 (UDP). Common on Allen-Bradley/Rockwell Automation PLCs, a frequent vendor in water treatment settings.
• BACnet — port 47808. Mostly used for building automation (HVAC, lighting) rather than process control, but often present at utility facilities for the building itself.
• OPC UA — port 4840. A newer protocol designed with real security in mind (authentication, encryption), increasingly used as a bridge between ICS equipment and IT/business systems.
• S7comm — port 102. The protocol used by Siemens PLCs.

Why this matters: almost none of the classic ICS protocols above (Modbus, DNP3, EtherNet/IP) were designed with authentication or encryption in mind — they assume a physically isolated network where anything that can send a packet is trusted. That assumption breaks down the moment an ICS network has any path, even an indirect one, to the internet or the corporate IT network. This is exactly why network segmentation matters so much more in ICS environments than in ordinary business IT — see the next question.

The Purdue Model (formally the Purdue Enterprise Reference Architecture, or PERA) is a widely used framework for organizing an industrial network into layers, separating the systems that directly control physical equipment from the systems that run ordinary business IT. It originated in manufacturing in the early 1990s and was later folded into the ISA-95 standard; today it's one of the most commonly referenced models in ICS/OT security guidance, including CISA's own recommendations for critical infrastructure.

The full model defines six layers, from the physical process itself up through corporate enterprise systems:

• Level 0 — Physical process. The actual pumps, valves, sensors, and equipment.
• Level 1 — Basic control. PLCs and controllers directly operating that equipment.
• Level 2 — Area supervisory control. HMIs (human-machine interfaces) and local SCADA software operators use to monitor and adjust the process.
• Level 3 — Site operations. Plant-wide historian, reporting, and operations management systems.
• Level 3.5 — The DMZ. A buffer zone between OT and IT — the only place data is meant to cross between the two sides, typically through a firewall with tightly controlled rules.
• Level 4/5 — Business and enterprise IT. Email, billing, office file shares, general internet access.

The practical takeaway for a smaller utility isn't that you need all six layers implemented precisely — it's the underlying principle: there should be no direct, unrestricted path between the network that controls your treatment process and the network that has email or internet access. Even a simplified two- or three-zone version of this model closes most of the real-world attack paths seen in actual water-sector incidents, since the large majority of successful attacks exploit exactly one thing — a single unsegmented path from remote access or office IT straight into SCADA control — not a sophisticated multi-stage breach of a well-segmented network.

Having existing IT support is a good foundation, and it's still worth the conversation. General IT support is usually focused on the business side — email, computers, the office network — and may not have deep, hands-on experience with the specific ICS/SCADA protocols and equipment described above, which behave very differently from ordinary IT and require their own approach to monitoring and defense.

Water Watch Center is built to work alongside whoever already supports your utility, not replace them. Bringing your IT contact into the conversation means:

• They benefit from the same threat intelligence and technical information Water Watch Center shares across the utilities it monitors — visibility into what's actually being seen in the water sector right now, not just generic IT threat feeds.
• Any gaps between what your existing IT support covers and what OT/ICS-specific monitoring requires can be identified together, rather than assumed away on either side.
• Your utility ends up with coordinated coverage across both the business network and the control-system network, instead of two separate efforts that may not be talking to each other.

If you have an existing IT contact, bringing them into the intake conversation is a good next step — not a replacement for it.

Water Watch Center is built on philanthropic and founding-partner support, not a fee charged to the utilities it protects. As described on our About page, WWC connects federal, state, philanthropic, academic, and private capability — including support from the William and Flora Hewlett Foundation and Craig Newmark Philanthropies — so that capability can reach small and rural utilities directly, rather than depending on each utility funding this kind of monitoring on its own out of an already-thin budget.

Reach out through our contact form for specifics on what's involved for your utility.

Yes. At the onboarding discussion, we can talk through your existing MDR (Managed Detection and Response) relationship and begin the process of bringing your provider on board as part of your utility's coverage. Water Watch Center is always looking to add more industry partners, not narrow the field to a fixed list.

Our full Privacy Policy covers waterwatchcenter.org itself — what we collect through the contact form, mailing list, and ticket system, and how it's handled. That policy is explicit that it covers only the public website: the operational security-monitoring services we provide to enrolled utilities are governed separately by each utility's own service agreement, worked out during onboarding.

In general: information submitted to us is stored in a database we operate ourselves on AWS infrastructure, access is restricted to the specific application that needs it, and we don't use a third-party CRM, marketing platform, or data broker. As a cybersecurity-focused organization, we hold our own systems to the same standard we advocate for the utilities we serve.