A Floor, Not a Ceiling: Rethinking Cyber Rules for Small Water Utilities
What my Georgia Tech capstone taught me about why one-size-fits-all cyber rules fail small water utilities, and why a tiered approach that starts with a hard floor works better.
For my Georgia Tech M.S. Cybersecurity capstone in 2025, I designed a tiered cybersecurity policy framework for U.S. water utilities. The case study on this site walks through what I built. This post is about the argument underneath it, and why I think it applies well beyond water.
The short version: a single rule for every water utility in the country fails in both directions. Set it high enough for a big city system and small towns can't meet it. Set it low enough for small towns and it means nothing to everyone else. What works better is a hard floor that nobody gets to skip, with a realistic path above it.
The basics were missing
It's easy to assume the hard part is advanced threats. That isn't what the public incidents showed.
In Oldsmar, Florida in 2021, the reported story was that someone used remote desktop software left running on the plant's control system and raised the sodium hydroxide level. An operator happened to be watching and reversed it. The FBI later said it couldn't confirm an outside intrusion, but the weaknesses were real and documented: a remote-access password shared across computers, unsupported Windows 7, and no firewall.
In Aliquippa, Pennsylvania in 2023, an Iranian-linked group called CyberAv3ngers got into a small water authority through a controller that was connected straight to the internet and, according to CISA, likely still using a default password. They defaced the screen with political messages.
In January 2024, hackers got into the remote-access system for a water tank in Muleshoe, Texas, and it overflowed for 30 to 45 minutes before staff switched to manual control. Nearby towns fended off similar attempts.
None of these needed custom malware or a zero-day. They came down to exposed remote access and weak or default passwords. An attacker doesn't have to be advanced when the basics are missing.
That changes the question. It stops being "what is the most advanced control we could require?" and becomes "why aren't the basics already in place everywhere?"
Why one rule for everyone keeps breaking
Part of the answer is money and people. Many water utilities, especially small and mid-sized ones, run aging operational technology with very little IT staff. Unlike the energy sector, water has no single enforceable standard like NERC CIP, and responsibility is split between the EPA and the states.
The other part is how rules get delivered. In March 2023, the EPA issued a memo directing states to include cybersecurity reviews in the sanitary surveys they already do for public water systems. The controls it pointed to were reasonable: multi-factor authentication, remote access controls, and incident response planning. But it wasn't issued through formal rulemaking, it came with no dedicated funding, and it skipped the notice-and-comment process. Arkansas, Iowa, and Missouri challenged it in court, joined by the American Water Works Association and the National Rural Water Association. The EPA withdrew it in October 2023.
My takeaway wasn't that the controls were wrong. It was that a mandate with no funding, no input from the people expected to carry it out, and no room for different starting points is fragile. Utilities were left with guidance instead of requirements, and the rural systems that most needed help got the least.
What a tiered approach changes
A tiered model separates two questions that a single rule mashes together: what every utility must do, and how fast everyone else is expected to go beyond that.
Tier 0 is the floor. It's the short list of cheap, high-impact controls that map directly to how the real attacks worked, and it applies to every utility regardless of size. Tier 1 is what most utilities can reach with moderate support. Tier 2 covers the controls that depend on local conditions, like geography and access to contractors.
The floor doesn't flex. The path above it does.
Other sectors already do versions of this. TSA's pipeline cybersecurity directives shifted in 2022 to performance-based requirements, where each operator gets a TSA-approved implementation plan that fits its own systems. CFATS, the chemical facility program, sorted facilities into risk tiers and used performance-based standards instead of one prescriptive checklist, though its authority lapsed in July 2023 and hasn't been renewed. NERC CIP is the most mature and enforceable model, with penalties of more than $1.5 million per violation per day, but I concluded that its heavier requirements would be too resource-intensive for many water utilities without state or federal support. Borrowing the structure made more sense than copying the burden.
Feasibility is a security property
The piece of the project that kept me most honest was the scoring matrix. It scores controls across nine weighted criteria. Risk reduction carries the most weight, but cost, legal authority, legacy compatibility, and political resistance are in there too.
When I scored the three public incidents, Oldsmar came out at 3.10 out of 5 and Aliquippa at 3.00. Rural Texas scored 2.30, with cost scoring 1 out of 5. A score near 3 suggested real improvement was possible with moderate investment and governance changes. A score near 2 pointed to structural gaps that need state or federal help.
That gap is the whole argument in one number. The utilities with the most exposure are often the least able to fix it alone. A policy that ignores feasibility doesn't make them more secure. It just leaves them out.
The same is true in leadership. A plan the team can't execute isn't a plan. Part of the job is sequencing the work so the most important things get done first, with the resources you actually have.
What I'd tell someone building a program
If I were sitting across the table from a utility leader, or honestly any security leader, I'd say three things.
First, define the floor and make it short. Every item on it should tie to how real attacks have worked.
Second, sequence everything else. Quick wins first, funded upgrades next, and structural fixes that need legislation or budget last.
Third, be upfront about what you don't know. My framework was validated in a simulated environment, through expert interviews and an exercise, not in a live utility. The water-sector bill I aligned it with, H.R. 2594, was still pending when I wrote the paper. (As of October 2026, it hadn't moved past committee referral, and as written it only covers systems serving 3,300 or more people, so the smallest utilities would still fall outside it.) Hawaii makes a good testbed because of its isolation, the cost of importing replacement equipment, and the limited number of cybersecurity specialists on island. The model is designed to scale, but it still has to prove itself outside a simulation.
As I move from the Army into industry, this is the principle I'm bringing with me. Whether it's a water utility or a cloud environment, set the floor first, make it non-negotiable, and turn everything above it into a roadmap people can actually follow.