CISA Warns of PLC Cyberattacks on Water Utilities: CIRCIA and NIS2 Compliance Imperatives

Introduction: A Wake-Up Call for Water Utilities

CISA has issued a public alert warning of a significant increase in cyberattacks targeting water utilities, specifically involving programmable logic controllers (PLCs) and other operational technology (OT). The agency urges facilities to remove exposed PLCs from the internet immediately, following a coordinated attack on more than 30 Minnesota community water systems, with investigators probing potential links to Iran.

Attackers have locked out operators by changing passwords and disrupted PLCs by altering IP addresses, leading to boil water notices and manual operations. CISA, the FBI, and the EPA are involved in the response, with incidents reported in at least seven states. This is a stark reminder that water utility cybersecurity is no longer just an IT concern—it is a matter of public safety and regulatory compliance.

For compliance officers and security leaders, the incident underscores two urgent questions: Are we prepared to detect and respond to OT-focused attacks? And do we meet the reporting obligations under CIRCIA and NIS2? This article analyzes the threat, the regulatory landscape, and provides actionable steps to strengthen your defenses.

Understanding the Threat: PLC Cyberattacks and OT Vulnerabilities

PLCs are the workhorses of industrial control systems (ICS), managing everything from water treatment to distribution. When attackers gain access, they can alter chemical dosing, disrupt pressure, or shut down pumps—causing real-world harm. In the recent incidents, attackers modified passwords and changed IP addresses, effectively locking out operators and disconnecting PLCs from the control network.

CISA emphasizes that even mature organizations should validate external connections, including undocumented cellular modems. Many utilities have legacy OT systems that were never designed for modern cyber threats, and they often lack visibility into their own network edges.

The targeting of water utilities is a global concern. In the EU, similar OT vulnerabilities exist across critical infrastructure sectors, and regulators are responding with binding directives. The key takeaway: PLC cyberattacks are not hypothetical—they are happening now, and compliance frameworks are evolving to force better security.

CIRCIA Compliance: Reporting Cyber Incidents to CISA

The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), enacted in 2022, mandates that critical infrastructure entities—including water utilities—report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. The final rule is expected in 2025-2026, but utilities should prepare now.

Key CIRCIA requirements for water utilities:

• Covered entities: Those in critical infrastructure sectors, including water and wastewater systems.
• Incident definition: Substantial loss of confidentiality, integrity, or availability of information systems, or serious impact on safety and resilience.
• Reporting timeline: 72 hours from 'reasonable belief' that an incident occurred.
• Ransomware payments: Must report within 24 hours of making a payment.

For the Minnesota attacks, a utility would likely be required to file a report if it experienced a significant operational disruption. Even if the final rule is not yet in force, early adoption of these reporting practices is prudent. CIRCIA compliance also requires maintaining records and potentially sharing information with CISA.

To streamline incident reporting, organizations can leverage AI-driven platforms that automate SAR/incident report generation and provide evidence briefs. For example, RisksRadarAI can help detect cross-domain anomalies and generate structured incident reports, reducing the burden on security teams.

NIS2 Directive: OT Security Obligations in the EU

In the EU, the NIS2 Directive (Directive (EU) 2022/2555) sets a higher bar for OT security in critical infrastructure, including water utilities. Member states had to transpose it by 17 October 2024, and it applies to 'essential' and 'important' entities across 18 sectors, including water supply.

NIS2 requires:

• Risk management measures: Including supply chain security, incident handling, and business continuity.
• Incident reporting: Early warning within 24 hours, notification within 72 hours, and a final report within one month.
• Management accountability: Board members can be held personally liable for non-compliance.
• Penalties: Up to EUR 10 million or 2% of global turnover for essential entities.

For water utilities operating in the EU, NIS2 is a game-changer. It forces a shift from voluntary best practices to mandatory, enforceable obligations. The directive also emphasizes supply chain security, meaning utilities must vet their OT vendors and ensure that remote access is controlled.

Compared to CIRCIA, NIS2 is broader in scope and includes proactive security measures, not just reporting. However, both share a common goal: improving resilience of critical infrastructure.

US vs EU Approaches: A Comparative Analysis

While CIRCIA and NIS2 both aim to strengthen critical infrastructure cybersecurity, they differ in philosophy and implementation:

For multinational utilities, the challenge is to meet both sets of obligations. A pragmatic approach is to adopt a 'high-water mark' strategy, implementing the more stringent requirements from either framework. This ensures compliance across jurisdictions.

Practical Checklist for Water Utility OT Security and Compliance

Based on CISA's advisory and regulatory requirements, here is a checklist for water utility cybersecurity:

1. Inventory and Exposure: Identify all internet-facing PLCs and OT devices. Remove them from direct internet access immediately.
2. Validate External Connections: Audit all remote access points, including cellular modems, and disable undocumented ones.
3. Implement Network Segmentation: Separate IT and OT networks, and use firewalls to limit east-west traffic.
4. Enforce Strong Authentication: Change default passwords, use MFA for remote access, and implement role-based access control.
5. Develop Incident Response Plan: Include OT-specific scenarios, and ensure 24/7 monitoring with clear escalation paths.
6. Prepare for Reporting: Define internal processes for CIRCIA/NIS2 reporting, including 72-hour timelines.
7. Conduct Regular Assessments: Run vulnerability scans and penetration tests on OT environments.
8. Train Staff: Educate operators on phishing and social engineering risks.

To operationalize these steps, consider leveraging geopolitical intelligence platforms like AIGovHub's SENTINEL module, which monitors threat sources and can alert you to emerging risks relevant to your sector.

Key Takeaways

• CISA's warning highlights a surge in PLC-targeted attacks on water utilities, requiring immediate action to secure OT.
• CIRCIA will mandate 72-hour incident reporting for critical infrastructure, and utilities should prepare now.
• NIS2 imposes proactive OT security obligations and strict penalties in the EU, with similar reporting timelines.
• US and EU approaches differ in scope and enforcement, but both demand robust incident response and reporting.
• Practical steps like network segmentation, strong authentication, and external connection audits can significantly reduce risk.

Conclusion: Act Now to Protect Critical Infrastructure

The cyber threats facing water utilities are real and escalating. Compliance with CIRCIA and NIS2 is not just a legal requirement—it is a critical step in safeguarding public health and safety. By adopting the checklist above and leveraging advanced tools like RisksRadarAI for threat detection and incident reporting automation, utilities can enhance their resilience.

For a proactive edge, explore AIGovHub's SENTINEL module to monitor geopolitical and supply chain risks that could impact your operations. Staying ahead of threats requires continuous vigilance and the right technology. Learn more about SENTINEL.

This content is for informational purposes only and does not constitute legal advice.