When you lose your server, people lose email. When you lose operational technology (OT), people lose access to water. As such, OT must be included in an emergency manager’s continuity plan, as opposed to simply being an item on the IT to-do list.
What is Operational Technology (OT)?
Operational Technology (OT) is the layer of computers that manages the physical components of your infrastructure — programmable logic controllers (PLCs), pumps, valves, breakers, sensors, and monitors in the control room. If your OT fails, it could result in:
- Traffic lights stopping or freezing
- Lack of potable water or boil-water notice
- Sewage backing up in streets and households
- Fuel pipelines and terminals shutting down
- Manufacturing lines — including those producing food, pharmaceuticals, and chemicals — stopping
- Inability to manage dams, floodgates, and levees
- No signaling or cargo systems at ports, railways, and airports
IT Security asks whether data was protected. OT asks whether the pump works. Availability of systems is essential to OT, and failure in availability results in health hazards, not reduced productivity.
Old Machines on New Networks
Most of today’s operational technology consists of devices built decades ago. At that time, the control network was a standalone system, and the expected life span of devices was 20-30 years. Many controllers lack the capability for updates, and many are not designed for them.
Additionally, many require basic user names and passwords, or no passwords whatsoever. Twenty years ago, all of these devices were connected to the business network and then to the Internet for remote monitoring and vendor support. IT specialists incorporated OT equipment into their network design developed for conventional computers and servers.
Thus, thirty-year-old controllers now exist on the Internet, and they are protected by nothing more than a password generated in 1998.
The Threat Is Here, Not Hypothetical
Hackers are well aware of this vulnerability. The following are three examples of attacks that occurred within the last three years:
Texas Panhandle, January 2024. Hackers, who were part of a Russian group, gained unauthorized access to Muleshoe’s water SCADA system via a remote login provided by the vendor. They caused the controller tank to remain open for 30-45 minutes before Muleshoe shut down the system and operated in manual mode. Hale Center, Texas, had approximately 37,000 firewall login attempts in four days and disconnected its SCADA system as well. Mandiant later determined that the identity associated with the login attempts belonged to Sandworm, a unit of Russian GRU.
Bremanger, Norway, April 2025. Pro-Russian hackers gained unauthorized access to a dam’s Internet-connected control panel using a weak password. They subsequently forced a discharge valve to remain open for four hours. Norwegian Police Security Service stated that Russia committed sabotage in August 2025.
12 States in the U.S., July and August 2026. Beginning on July 26th, hackers gained unauthorized access to Internet-connected programmable logic controllers (PLCs) belonging to water and wastewater utilities located in at least 12 states. More than 30 instances occurred in Minnesota alone. They changed the passwords and IP addresses on the devices thereby rendering them inaccessible to their respective operators. Reported consequences included pressure loss, flooding, boil-water notices, and manual operation modes. Federal authorities suspected Iranian-affiliated actors, and CISA recommended immediate disconnection of all PLCs from the Internet.
All of the above incidents did not involve sophisticated malware; rather they began with control devices connected to the Internet and with weak/default/stolen passwords.
All of these incidents have one thing in common: Loss of opportunity to control and observe processes resulted in emergency situations despite no change in water quality in some cases.
Four Fixes that Really Matter
Disconnect OT from the Internet. Neither PLCs nor control screens nor remote access boxes should respond to requests from IP addresses. Remote access should occur via firewalls and monitored gateways (jump boxes), and vendor connections should remain active only when required, and terminated upon completion of their tasks. Multi-Factor Authentication (MFA) must be employed on gateways, and passwords must be changed at least quarterly.
Change your OT Passwords Regularly. Simply because you believe your system is isolated from the Internet does not imply that it is secure. Do not share accounts and ensure your employees are aware of this policy.
Keep the Key in the RUN Position. A PLC running in run mode will not accept any additional logic; therefore keep it in this position until changes are made via programming or remote mode at specific times.
Learn How to Run Manually. All of the above incidents concluded with turning valves manually in the plant. Verify that your employees are capable of performing this task and that procedures exist and are practiced.
Frameworks Briefly
Emergency managers need not possess knowledge of all aspects of these standards; however they should be cognizant of their existence and associated requirements.
ISA/IEC 62443 is an international standard for OT security. It establishes seven foundational requirements for OT security including access control, auditability, etc., as well as defines assets zones separated by controlled conduits.
The Purdue Model is a standard representation of an OT network. Level 0 represents the physical world (sensors, valves, motors); Levels 1 & 2 represent controllers and operator screens; Level 3 represents site operations; Levels 4 & 5 represent the business network. Traffic within an OT network can only flow between levels through firewalls; consequently a phishing email opened at Level 4 will not impact the pump at Level 0. Understanding which level was compromised during an incident enables identification of trustworthy elements within the network.
Safety is the Primary Concern. In OT environments, cyber incidents are process-safety incidents. Safety Instrumented Systems (SIS) designed to shut down processes when hazards exist are governed by ISA/IEC 61511 standard. ISA/IEC 62443 was created to complement this standard. Ensure that your safety systems are located in separate zones, do not provide remote access to them, and consider any unexpected change to a safety setpoint as an incident.
NIST SP 800-82 Rev 3 is the U.S. government guideline for OT security and aligns with the NIST Cybersecurity Framework 2.0 (Govern-Identify-Protect-Detect-Respond-Recover).
Zero Trust Architecture (ZTA) authenticates every user/device/connection each time rather than assuming that all elements within an OT network are trustworthy.
Sector-Specific Regulations Provide Enforcement Mechanisms: NERC CIP for electric utilities and TSA Security Directives for pipelines.
Help is Being Organized
Texas established Texas Cyber Command via House Bill 150 (2025). The estimated $345 million budgeted agency will be located in San Antonio and led by Retired Vice Admiral Timothy “TJ” White. Texas Cyber Command will build a threat intelligence center, incident response unit, and digital forensics laboratory and will assume responsibility for cybersecurity functions from the Department of Information Resources by December 31, 2026.
Federally, National Cyber Strategy (March 2026) mandates critical infrastructure owners to identify, prioritize, and harden their systems and reduce reliance on vendors with ties to adversaries. Executive Order 14409 (June 2, 2026) directs CISA to expand access to Artificial Intelligence-enabled cyber defense tools for state/local governments and other operators such as local utilities/rural hospitals and develop a voluntary vulnerability clearinghouse.
Where Emergency Management Fits In
Agencies/directives do not create communities; people/plans do. Cyber professionals are relatively rare in EOCs/incident command/continuity planning, and water-related cyber incidents of 2026 illustrate how significant this problem is. There was no requirement to poison water in order to cause problems; simply losing control over PLCs caused boil-water notices/manual operation mode. It is as much an incident command problem as it is an IT problem.
Three questions enable assessment of readiness:
- Does your organization have a designated cyber point of contact (not merely a telephone number)?
- Is this point of contact documented in your organization’s Emergency Operations Plan (EOP) Annex for Cyber Incidents with specific roles/triggers/information sharing protocols?
- Has this Annex been exercised/tested/revised?
An undocumented plan is merely speculative. Tabletop/functional exercises allow you to collaborate with cyber responders/EOC/command staff while there is still time to meet one another. Training represents the second half of preparedness.
During Cybersecurity Awareness Month, ask yourself: If machines fail tomorrow, whom do we contact, and do they recognize our names?
