Build a water-utility cybersecurity incident response plan (CIRP) by adapting the U.S. Environmental Protection Agency’s April 2025 template to your actual IT and operational technology (OT), linking it to your Emergency Response Plan (ERP), assigning decision-makers, and documenting how essential water operations will continue if systems are disrupted. The template is a starting point—not a finished plan or a guarantee of compliance or readiness.
How do I build a cybersecurity incident response plan for a water utility?
Start with the EPA’s water-sector cybersecurity planning resources and its Drinking Water and Wastewater Systems Cybersecurity Incident Response Plan Template Instructions (EPA 810-F-25-017, April 2025). Save the template, then replace generic material with the utility’s systems, people, procedures, contacts, and applicable requirements. EPA describes a CIRP as the strategies, resources, plans, and procedures used to prepare for and respond to a cybersecurity incident that threatens life, property, or the environment. It supplements—not replaces—the ERP.
As an Amazon Associate I earn from qualifying purchases.
An existing utility plan can also work as the foundation if it covers the same practical needs. Compare it with the EPA template and checklist: does it address local IT/OT risks, clear authority, safe continuity procedures, notification and communication responsibilities, and recovery? Fill gaps rather than maintaining two conflicting plans.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Gather the utility-specific information before drafting
Use the utility’s risk and resilience assessment (RRA) to decide which services and systems need the strongest response planning. EPA recommends carrying RRA findings and countermeasures into the CIRP. An optional free cybersecurity evaluation program is also described in EPA’s instructions; use it as an input, not as a substitute for the utility’s own assessment and decisions.
- Critical functions and systems: Identify mission-critical business, process-control, and communications systems, and the operators who understand them.
- Technical references: Collect current inventories, network diagrams, configuration records, operating procedures, and relevant access or recovery information. The CIRP should point responders to controlled, current copies rather than assume they can find them during an outage.
- Plans and communications: Align the CIRP with the ERP, public and internal communications plans, and other emergency procedures. Decide how staff will communicate if normal email, phones, or network services are unavailable.
- External dependencies: Document what IT and OT contractors, software providers, integrators, and other vendors support; record how to reach them and what authority or access they have. Coordinate response expectations before an incident.
- Requirements: Identify applicable state rules and relevant contract, privacy, regulatory, and insurance obligations. The responsible utility should verify which duties apply to its location and incident.
Understand the federal planning requirement that applies to the system
Under SDWA section 1433, as amended by AWIA section 2013, community water systems serving 3,301 or more people must certify completion of an RRA and ERP. EPA says smaller community systems, non-community systems, and wastewater systems are not required to certify under this provision, while encouraging them to plan. Covered systems should coordinate with local emergency planning committees to the extent possible and retain RRA and ERP copies for five years after certification. See EPA’s AWIA Section 2013/SDWA Section 1433 guidance and check applicable law and state requirements for the specific system.
EPA does not require a particular third-party standard, method, or tool for the statutory RRA and ERP, provided the system satisfies section 1433. A CIRP template alone does not establish that the utility has met those requirements.
Rank #2
Put people, authority, and contact routes in writing
For each response function, name a primary and alternate where practical. Use roles that fit the utility’s size; one person may hold several roles, but decision authority and handoffs should remain explicit.
Recommended Free Tools
- Incident lead: Coordinates response, convenes the team, maintains the incident record, and escalates decisions that exceed delegated authority.
- Operations and OT: Assess the effect on treatment, collection, storage, and conveyance; advise whether process data and controls can be trusted; and implement approved safe operating procedures.
- IT and cybersecurity: Triage affected business and communications systems, preserve relevant information, and coordinate technical containment and recovery with OT and vendors.
- Utility leadership: Make or approve decisions about service priorities, emergency resources, public messaging, and operational changes according to the utility’s authority structure.
- Communications, legal, and compliance: Coordinate staff, customer, regulator, and other notices; review applicable obligations; and ensure messages are approved and consistent.
- Contractors and vendors: Provide defined technical support under pre-agreed contact and authorization procedures. Do not leave responders to determine access or decision rights for the first time during an incident.
Write down how staff report a suspected event, who can declare or escalate an incident, who can authorize isolation or operational changes, and who contacts leadership and external partners. Keep a printed or otherwise separately accessible contact list. EPA’s Water Sector Incident Action Checklist – Cybersecurity identifies CISA’s incident-reporting channel and 1-844-Say-CISA (1-844-729-2472), and recommends recording contacts for the FBI, state, National Guard cyber resources, and mutual-aid partners.
Rank #3
Write response steps without assuming every system should be handled the same way
The plan should give responders a usable order of work while leaving technical choices to the people who understand the affected environment and safety consequences. A compromised process-control system may require different action from a phishing incident affecting office email. Avoid a universal instruction to disconnect or restore equipment: an action that limits cyber risk can also affect safe operations if it is not coordinated with qualified OT staff.
- Detect and report: Define what staff should report, where to report it, and what information to capture, such as time observed, affected service or system, and operational symptoms. Provide an alternate reporting route if ordinary communications are down.
- Triage and escalate: Identify who assesses the scope and urgency, brings together IT and OT, and alerts leadership. Include scenarios such as disabled or manipulated process controls, loss or theft of operational or financial data, and exposure of sensitive information.
- Decide on safe operations and containment: Require coordination between incident leadership and qualified operators before changes that may affect treatment or delivery. Record the decision, its rationale, the approving authority, and the operational effect. The appropriate containment action depends on the utility’s control environment and conditions at the time.
- Notify and coordinate: Assign responsibility for contacting vendors, emergency partners, regulators, law enforcement, CISA, and affected audiences as appropriate. Applicable deadlines and duties depend on jurisdiction, contract, incident facts, and other rules; there is no single deadline established here for every incident.
- Preserve records and costs: Start an incident record as response begins. Track decisions, actions, expenditures, receipts, relevant records, photographs, and staff time; EPA notes these materials may help justify costs and support a possible insurance claim.
- Recover and review: Define who can approve restoration, how recovery is coordinated with operations and vendors, and how the utility verifies that restored systems and processes are functioning as intended. Record remaining risks and follow-up actions.
Plan how to keep water operations running if OT is unavailable or untrusted
For each critical function, document whether it can continue manually, through an alternate process, or not at all—and what conditions make each option safe. Consider collection, storage, treatment, and conveyance rather than focusing only on a control-room screen or a single network. EPA’s checklist calls for manual-operation planning and training essential staff for critical functions.
- Describe the approved manual or alternate procedure, the person authorized to invoke it, and the people qualified to perform it.
- List the operational information, communications, equipment, staffing, and safeguards the procedure depends on.
- State how staff will monitor conditions, record actions, hand off shifts, and decide when the alternate mode should end.
- Practice the procedure with the staff assigned to it. A written procedure is not evidence that a function can be maintained safely without practice.
There is no single manual-versus-automated answer for all utilities. The utility’s operators and technical staff must determine which functions can safely continue and what additional controls are necessary for its processes.
Exercise the plan and turn gaps into updates
EPA recommends developing, practicing, and updating an incident response plan for cyber incidents that could affect water and wastewater operations. Begin with a tabletop discussion to test coordination and decisions; use operational drills where appropriate to test whether people can perform procedures. Include IT and OT staff, vendors, emergency partners, and communications, legal, or compliance personnel when available.
Best Value
EPA’s instructions identify free exercise resources from EPA and CISA. CISA’s scenarios include ransomware, insider threats, phishing, and industrial-control-system compromise. Choose a scenario that tests a real dependency or decision—for example, whether operators can maintain a critical function when OT data cannot be trusted—rather than treating completion of an exercise as the goal.
After each exercise or incident, record unclear authority, missing contacts, unavailable information, unrealistic procedures, and training needs. Assign an owner and target date to each corrective action, revise the CIRP and related plans, and distribute the current version to the people expected to use it. Set a review cadence that fits the utility’s risk and change processes, and revisit the plan when systems, vendors, staffing, procedures, or requirements change.
Use the EPA checklist as a final coverage check
Before approving the plan, verify that it identifies mission-critical business, process-control, and communications systems; names system operators and response contacts; trains essential staff for critical functions; addresses manual operations; and includes exercises. EPA’s cybersecurity incident action checklist is a practical cross-check, but local procedures, state requirements, and system-specific safety decisions still need to be addressed in the utility’s own plan.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
