Key takeaways
Water and wastewater sites are uniquely difficult to connect securely. They are distributed, often unmanned, frequently lack fibre, and run on PLCs and HMIs that were never designed to be on the public internet.
The combination of US EPA cybersecurity guidance, the recast EU Drinking Water Directive and IEC 62443 expectations means remote access is no longer something to add later. It is part of the build.
The architecture that works on solar farms and remote critical infrastructure works for water too. This post is part one of a three part Netcelero water utility series. We start with secure remote access, and follow with network segmentation and resilient connectivity.
The water industry has spent the last eighteen months under more cyber scrutiny than at any point in its history. US federal agencies have issued repeated alerts about exposed PLCs at treatment plants. Regulators on both sides of the Atlantic have tightened expectations on monitored remote access. Insurers are asking sharper questions. And yet the underlying operational reality at most water sites has not changed at all.
A typical water utility runs dozens, sometimes hundreds, of sites. Treatment plants, pumping stations, reservoirs, sewer overflow monitors, network valves. Most are unmanned for the great majority of the time. Engineering teams are small and shared across the estate. Site visits are expensive and slow. Remote access is not a nice to have. It is how the network is operated. Removing it is not realistic. The question is how to make it secure.
Why the Standard Enterprise Model Does Not Fit
The textbook enterprise approach to remote access assumes a central office, a corporate firewall, a clean IT inventory and a small number of well managed remote workers. Almost none of that maps onto a water utility.
The sites are not offices. They are concrete chambers, kiosks and small buildings in fields, beside rivers or under car parks. There is no corporate firewall. There is often no fibre, because the nearest cabinet is three miles away and there has never been a business case to lay one. The devices on site are not laptops. They are PLCs, HMIs, telemetry units and chemistry analysers that may be ten or fifteen years old and that were never designed for direct internet exposure.
Faced with this, many utilities have historically taken the path of least resistance. A 4G router, a public IP, a port forward to the PLC or HMI, and remote access is “done”. It works, it is cheap, and it is exactly the architecture that keeps appearing in federal cyber alerts. We covered the root cause of that pattern in a recent post on the 2026 water utility attacks, which is a useful companion read to this one.
What a Defensible Water Utility Site Actually Looks Like
The architectural answer for water is the same one that works for solar farms, substations and other distributed critical infrastructure. The principles are straightforward. They just have to be applied consistently.
The site has no inbound public listener. Nothing on the operational network is reachable from the public internet. The remote access path is initiated from the site outwards, over an encrypted tunnel, into a controlled core network where the utility’s engineers, the SCADA vendor and any third party support providers can be authenticated and authorised before they touch anything.
Control traffic is logically separated from everything else. CCTV, telemetry and any guest or contractor traffic sit on different networks from the SCADA path, so a compromise on the camera network cannot pivot into the treatment process. This is the topic of part two of this series.
Connectivity has more than one path. Where fibre is available it is the primary, with cellular or satellite as the failover. Where fibre is not available, which is the majority of water sites, cellular and Starlink combine to give a resilient pair of independent paths. This is the topic of part three.
None of this is new thinking. It is the practical application of IEC 62443 principles, which the water industry is now under increasing pressure to demonstrate. The advantage is that the same pattern satisfies EPA expectations in the US, NIS2 in the EU and the operational logic of running a distributed estate.
Where Netcelero Fits
The i-ctrl gives a water utility site a fixed public IP without exposing any of the control devices behind it. The site dials out to the Netcelero core network in Dublin or Amsterdam over a management VPN, and authorised remote access happens through that core network rather than directly to the site. Engineers, SCADA vendors and the central control room see a stable, addressable endpoint. The PLC sees no traffic from the internet at all.
For utilities that need to extend secure connectivity all the way to a corporate HQ, an aggregator or a SOC, IPSec via the Netcelero Secure Link service handles the end to end encryption even where the underlying connection is Starlink or cellular, both of which usually break traditional IPSec setups.
For sites where engineers still need direct access to legacy Modbus, Profibus or serial gear, the i-spi handles individual device level connectivity inside the same secure model. We covered this in our Modbus remote access post earlier this year, and the same pattern applies to water telemetry units.
What to Do This Week
If you operate, install or specify equipment for water and wastewater sites, three simple checks will tell you where you stand.
First, list the sites where the SCADA vendor reaches the PLC by connecting inwards to a public IP. Anything on that list is a candidate for the architectural shift described above.
Second, identify the sites with only a single connection. These are the ones where a cellular outage or a fibre cut takes the telemetry down completely. Resilience is part three of this series, but you can start the inventory now.
Third, find out which of your sites have CCTV and SCADA sharing the same network. Network segmentation is part two of this series, and again the inventory can start today.
Water utilities have run successfully on improvised connectivity for decades. The pressure now is to move from improvisation to a defensible architecture that can stand up to regulators, insurers and the next federal alert. The good news is that the building blocks are well understood, and the same approach Netcelero has deployed on hundreds of solar, security and critical infrastructure sites maps cleanly onto the water industry.
Contact us today if you would like to talk through how this architecture could work across your water estate, or to be notified when parts two and three of this series go live.
