Water and wastewater utilities operate some of the most distributed infrastructure in critical operations: treatment plants, pump stations, lift stations, and remote wells, often spread across hundreds of square miles with no technician on site. Remote access to PLCs, HMIs, and SCADA systems isn’t optional — it’s how these facilities stay running. It’s also, increasingly, how attackers get in. NIST’s National Cybersecurity Center of Excellence published SP 1800-45 in June 2026, a practice guide built with water utilities and technology vendors to demonstrate secure remote access architectures for operational technology in the sector. The guidance exists because the risk is no longer theoretical.
Distributed Infrastructure Expands the Attack Surface
A treatment plant doesn’t operate in isolation. Pump stations, reservoirs, and lift stations sit at the edges of the network, often connected over cellular or satellite links with limited bandwidth and no local IT presence. Every one of those endpoints is a potential entry point if remote access relies on open VPN tunnels or exposed device login pages. The operational requirement — reach a device with no one standing next to it — is the same condition that creates the exposure.
Controlled remote access closes that gap without removing the connectivity operations depend on. Outbound-only connections mean no inbound ports and no exposed services at the edge, so a pump station miles from the nearest facility doesn’t have to trade security for reachability.
Third-Party Access Has to Be Time-Bound, Not Standing
Equipment vendors, system integrators, and maintenance providers need access to water and wastewater OT systems regularly — but that access shouldn’t outlive the job it’s for. Standing credentials shared across multiple vendors, or generic admin logins left active between visits, are one of the most common ways OT networks get compromised without a targeted attack ever taking place.
Role-based, time-bound authorization changes that calculus. A vendor gets access to the specific system they’re there to service, for the duration of the job, under a policy the utility sets — not indefinite standing privilege they have to remember to revoke.
Legacy and Modern Systems Have to Coexist
Water infrastructure runs on long equipment lifecycles. A treatment plant commissioned two decades ago doesn’t get a full OT refresh because remote access software wants a modern operating system. Secure remote access has to work across that spread: legacy control systems installed years before the current cybersecurity posture existed, alongside newer SCADA and HMI platforms brought in since.
This is also where unattended recovery matters. A pump station with no on-site staff and a device that’s gone unresponsive shouldn’t require a technician to drive out and physically power-cycle it. Out-of-band access that reaches a device below the operating system — independent of whether the OS is even running — turns a truck roll into a remote fix.
Visibility and Audit Trails Are a Regulatory Requirement, Not a Convenience
Regulators expect utilities to demonstrate exactly who accessed which system, when, and what they did once connected. In the EU, drinking water and wastewater are both named sectors under NIS2 Annex I, which means the same access-control and audit obligations that apply to energy and transport operators apply here. In the US, NIST SP 1800-45 gives utilities and their evaluators a reference architecture for what secure remote access should look like in practice, built specifically for the sector rather than adapted from generic enterprise IT guidance.
Full session logging and recording turn that requirement into something a utility can act on: a complete, tamper-proof record ready for an audit or an incident investigation, not a gap that has to be explained after the fact.
Remote Troubleshooting Reduces Unnecessary Field Dispatch
Every technician sent to a remote lift station or pump station to diagnose a problem that could have been resolved from a console is a cost the utility didn’t need to absorb. Controlled remote access lets engineers reach the device, diagnose the fault, and resolve most issues without a vehicle leaving the depot — while every session stays logged and within policy.
Where Netop Fits
Netop gives water and wastewater utilities controlled, auditable remote access across the full spread of their operational environment: modern SCADA and HMI platforms, legacy control systems, and unattended remote sites, all through outbound-only connections that don’t require exposing devices to the internet. Access is authenticated, time-bound, and fully logged, whether the person connecting is an internal engineer or a third-party equipment vendor. Deployment can run on-premises, self-hosted, or air-gapped, depending on the utility’s own security and sovereignty requirements — the access model and audit trail stay the same regardless.
Book a demo to see how Netop applies to your treatment and distribution infrastructure.
