---
title: "Cybersecurity for water utilities"
description: "AWIA risk assessment and response plan for water systems: from $7,160 one-off, support from $6,000 a year. Certification due by 31.12.2026."
locale: en
canonical: https://finleadgen.com/en/public-sector/water-systems
source: https://finleadgen.com/en/public-sector/water-systems.md
price_reviewed: 2026-08-06
---

# Cybersecurity for water utilities

Assessment, plan and certification — before the deadline.

**Assessment and plan from $7,160. Support from $6,000 a year.**

## Who at your utility makes sure the pumps cannot be stopped from the network?

The shift operator, who has twenty other duties. The control panel runs on a computer with a shared password. Remote access was set up by a contractor four years ago, and nobody remembers whether his account was ever switched off. The configuration backup sits in an email from 2023.

## By the deadline you hold the plan and the paperwork

We walk the whole system: where the office network ends and the process network starts, who logs in remotely and how, what runs on the control panels, who is on call at night and what happens if a site goes offline.

You get a written risk assessment and a response plan: roles, phone numbers, the order of actions, recovery points and everything you must show at certification by 31 December 2026.

A plan has to work, not sit on a shelf: we test that backups restore, train the shift and work through alerts. That is support, and it is priced by the year.

## What the assessment covers

| What | State | Price |
| --- | --- | --- |
| Separating the office and process networks | included |  |
| An inventory of control panels and remote logins | included |  |
| Accounts of contractors and former staff | included |  |
| Configuration backups and a restore test | included |  |
| Physical access to sites and cabinets | included |  |
| Response plan: roles, phone numbers, order of actions | included |  |
| A written report and the list of papers for certification | included |  |

## Your price

| Plan | Price | Note |
| --- | --- | --- |
| Risk assessment and plan | $7,160–$22,400 one-off | 64–200 hours depending on the size of the system, from three weeks. |
| Support | from $6,000 a year | Attack monitoring, shift training and backup checks. |
**Risk assessment and plan**
- A survey of networks, panels and remote access
- A written risk assessment
- A response plan and what to show the inspector
**Support**
- Attack monitoring — $18 per endpoint a month
- A logged test that backups restore
- Alert triage and a quarterly report

## Extras

| What | State | Price |
| --- | --- | --- |
| Fractional chief information security officer | not included | $2,500 a month |
| Backups and a check that they actually restore | not included | $1,340 per site per year |
| If you are breached, we investigate — monthly | not included | $670 a month |
| External network penetration test | not included | $4,480 |
| Filling in a security questionnaire | not included | $1,350 per questionnaire |
| One-off engineer work | not included | $112 an hour |

### We serve 12,000 people. Does this apply to us?

Yes. The requirement covers systems serving 3,301 people and up; there are 8,534 of them in the country. The workload depends on the number of sites and control panels, not on whether you are a city or a district.

### What is the deadline?

The response plan must be certified by 31 December 2026. Assessment and plan take three weeks or more, so keep your margin in months, not weeks.

### We have no security specialist of our own.

Then we cover the role: a part-time security director costs $2,500 a month and owns the plan, the paperwork and incident reviews. An inspection asks for exactly such a person, and you do not need one on your payroll for that.

### What do you touch in a live system?

Nothing without your word. The assessment is reading and talking: settings, system logs, diagrams, conversations with the shift. Any change is agreed in writing and made when you say so.

## Where to send the quote

Tell us how many sites and panels you have — we will send a quote and the assessment timeline.