J-1606000-04-02 SOP EPA Water Cybersecurity Assessment Tool 1.0.xlsx
XLSX spreadsheet 100 KB Posted
- Solicitation number
- N6945024R0037
About this file
This document is a Solicitation Notice for Base Operations Support (BOS) Services at Naval Support Activity (NSA) Mid-South, Millington, Tennessee and the outlying areas supported by this command. The procurement will be a single award Facilities Support Indefinite-Quantity contract with recurring work (firm-fixed price) and non-recurring work (indefinite delivery, indefinite quantity) Contract Line Item Numbers (CLINS). The contract term is anticipated to be a base period of one-year plus four one-year option periods, for a total contract performance period not to exceed five years. The requirement includes facility management, custodial, pest control, solid waste management, grounds maintenance, utilities management, environmental services, and other related services. This is a competitive 8(a) set-aside solicitation, and award will be made to the offeror whose total price and technical proposal offer the best value to the Government. The solicitation number is N6945024R0037, and the primary point of contact is Courtney Peterson, Contract Specialist.
View the file
Other files
Show 40 more
Latest 50 of 80 listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Introduction
| EPA Water Cybersecurity Assessment Tool (WCAT) |
| Please read the following instructions in their entirety prior to completing the assessment. |
How to Use This Tool
1) Open the 'Assessment Workbook' tab. For security reasons, the information fields at the top of the page may be completed so as to avoid identifying the utility: Utility ID - create a unique identifier; Public Water System (PWS) staff - include initials for all staff participating in the assessment; Assessment Date - self explanatory; Assessor Name - identify a lead individual from an outside agency (for 3rd party assessments) or the utility (for self-assessments) who is filling out the questionnaire. Complete the questionnaire by selecting from the available dropdown options for each question ("Yes", "No", or "In Progress"). Be sure to document explanatory notes in the "Explanation of Response" column for each response.
Note: If the answer to an assessment question is unknown, please select "No" as the response. The assessment can be updated later once an appropriate response is known.
2) Upon completion of the assessment, and before you move to the 'Assessment Report' tab, you must refresh the data in the tool to auto-complete the 'Assessment Report' and 'Risk Mitigation Plan' tabs. To do this, select "Data" from the ribbon at the top of the screen in Excel and click "Refresh All". Alternatively, you may press Alt+A+R.
3) Now open the 'Assessment Report' tab and export/paste the Cybersecurity Assessment Report into Word. To do this, press Ctrl+A twice and then Ctrl+C. Open a blank Word document and press Ctrl+V to export/paste the report into the document. The Cybersecurity Assessment Report displays all checklist questions regardless of response. You may edit the report as needed. The report content is displayed in one Word table.
4) Now open the 'Risk Mitigation Plan' tab and export/paste the Cybersecurity Risk Mitigation Plan to Word. To do this, press Ctrl+A twice and then Ctrl+C. Open to a blank Word document and press Ctrl+V to export/paste into the document. The Cybersecurity Risk Mitigation Plan will only display checklist items answered "No" or "In Progress" during the assessment. You may edit the plan as needed, as questions answered "yes" will create blank rows at the end of the plan. The plan content is displayed in one Word table.
| If you have questions on how to use this tool, please contact EPA's Cybersecurity Technical Assistance Program for the Water Sector at the link below: |
| https://www.epa.gov/waterriskassessment/forms/cybersecurity-technical-assistance-water-utilities |
EPA Cybersecurity Checklist Assessment for Public Water System Sanitary Surveys
What is the purpose of this checklist assessment?
| The purpose of this checklist assessment is to provide a method to evaluate cybersecurity at a PWS during a sanitary survey. When a PWS uses operational technology (OT)[1], such as an industrial control system (ICS)[2], as part of its equipment or operation of any required component of a sanitary survey[3], then the state[4] must evaluate the adequacy of the cybersecurity of that OT for producing and distributing safe drinking water. A commonly used OT at a PWS is a Supervisory Control and Data Acquisition (SCADA) system. | |
| The checklist assessment questions and recommended actions to address the questions are extracted directly from the Cybersecurity and Infrastructure Agency (CISA) 2022 Cross-Sector Cybersecurity Performance Goals. In this checklist assessment, the Cybersecurity Performance Goals are written in a more simplified question format to facilitate their use in evaluating a PWS. | |
| Link to Cybersecurity and Infrastructure Agency (CISA) 2022 Cross-Sector Cybersecurity Performance Goals below: | |
| https://www.cisa.gov/cpg |
The use of this checklist assessment during a sanitary survey is optional. Alternatively, the cybersecurity evaluation during a PWS sanitary survey may be conducted with other state-approved government or private-sector assessment methods, such as those from CISA[5], NIST[6], AWWA[7], ISO[8], and ISA/IEC[9].
How should this checklist assessment be used?
| The checklist assessment questions are intended to identify gaps or potential vulnerabilities in current cybersecurity practices. PWSs are encouraged to use the resources and technical assistance described in the EPA guidance document, Evaluating Cybersecurity in Public Water System Sanitary Surveys (link below) to address these gaps and reduce the risk that a cyberattack may compromise PWS operations. | |
| https://www.epa.gov/waterriskassessment/epa-cybersecurity-best-practices-water-sector | |
| A negative response to a question is not, by itself, intended to indicate a significant deficiency at a PWS. States retain their existing authority and discretion to determine when a cybersecurity gap identified during a sanitary survey or equivalent alternate process should be designated as a significant deficiency. To facilitate the State determination, EPA has designated certain checklist questions as potential significant deficiencies (the basis for this designation is described in the aforementioned guidance). Potential significant deficiencies are noted in the cybersecurity checklist assessment by double asterisks. In general, EPA recommends that states allow PWSs sufficient time to correct any cybersecurity gaps identified in assessments and only consider issuing a significant deficiency when a PWS fails to correct a critical vulnerability. States also approve the actions and timing for PWSs to address any significant deficiencies. |
References
| [1] | The term “operational technology” means hardware and software that detects or causes a change through the direct monitoring or control of physical devices, processes, and events in the enterprise. Internet of Things Cybersecurity Improvement Act of 2020, 15 U.S.C. § 271(3)(6) (Public Law 116-207). |
| [2] | An Industrial Control System is an information system used to control industrial processes such as manufacturing, product handling, production, and distribution. Industrial control systems include supervisory control and data acquisition systems, used to control geographically dispersed assets, as well as distributed control systems and smaller control systems using programmable logic controllers to control localized processes. |
Link to NIST Computer Security Resource Center below:
| https://csrc.nist.gov/glossary/term/ics | |
| [3] | 40 CFR §§ 142.16(b)(3) and 142.16(o)(2). Required elements are (1) source, (2) treatment, (3) distribution system, (4) finished water storage, (5) pumps, pump facilities, and controls, (6) monitoring, reporting, and data verification, (7) system management and operation, and (8) operator compliance with state requirements. |
| [4] | Includes tribes, territories, and EPA where they have primacy |
| [5] | CISA Cyber Resilience Review |
| https://www.cisa.gov/uscert/resources/assessments | |
| [6] | NIST Cybersecurity Framework |
| https://www.nist.gov/cyberframework | |
| [7] | AWWA, Cybersecurity Assessment Tool and Guidance |
| https://www.awwa.org/Resources-Tools/Resource-Topics/Risk-Resilience/Cybersecurity-Guidance | |
| [8] | ISO, 27001 Information Security Management |
| https://www.iso.org/isoiec-27001-information-security.html | |
| [9] | ISOA/IEC, 62443 series of standards |
| https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards |
| Version History |
| Version 1.0 - 2/16/2023: Workbook created |
https://www.epa.gov/waterriskassessment/forms/cybersecurity-technical-assistance-water-utilitieshttps://www.epa.gov/waterriskassessment/epa-cybersecurity-best-practices-water-sectorhttps://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standardshttps://csrc.nist.gov/glossary/term/icshttps://www.awwa.org/Resources-Tools/Resource-Topics/Risk-Resilience/Cybersecurity-Guidancehttps://www.epa.gov/waterriskassessment/forms/cybersecurity-technical-assistance-water-utilitieshttps://www.cisa.gov/cpghttps://www.cisa.gov/uscert/resources/assessmentshttps://www.nist.gov/cyberframeworkhttps://www.iso.org/isoiec-27001-information-security.html Assessment Workbook
EPA Cybersecurity Checklist for Sanitary Surveys
| Utility ID: |
| PWS Staff (Initials Only): |
| Assessment Date: |
| Assessor: |
| Topic | Topic Number | Checklist Number | Question | Response | Recommendation | Explanation of Response |
| Account Security | 1.0 | 1.1 | Does the PWS detect and block repeated unsuccessful login attempts? | Where technically feasible, System Administrators should be notified after a specific number of consecutive, unsuccessful login attempts in a short amount of time. At that point, future login attempts by the suspicious account should be blocked for a specified time or until re-enabled by an Administrator. | ||
| 1.2 | **Does the PWS change default passwords? | When feasible, change all default manufacturer or vendor passwords before equipment or software is put into service. | ||||
| 1.3 | **Does the PWS require multi-factor authentication (MFA) wherever possible, but at a minimum to remotely access PWS Operational Technology (OT) networks? | Deploy MFA as widely as possible for both information technology (IT) and operational technology (OT) networks. At a minimum, MFA should be deployed for remote access to the OT network. | ||||
| 1.4 | **Does the PWS require a minimum length for passwords? | Where feasible, implement a minimum length requirement for passwords. Implementation can be through a policy or administrative controls set in the system. | ||||
| 1.5 | Does the PWS separate user and privileged (e.g., System Administrator) accounts? | Restrict System Administrator privileges to separate user accounts for administrative actions only and evaluate administrative privileges on a recurring basis to be sure they are still needed by the individuals who have these privileges. | ||||
| 1.6 | Does the PWS require unique and separate credentials for users to access OT and IT networks? | Require a single user to have two different usernames and passwords; one set is to be used to access the IT network, and the other set is to be used to access the OT network. This reduces the risk of an attacker being able to move between both networks using a single login. | ||||
| 1.7 | **Does the PWS immediately disable access to an account or network when access is no longer required due to retirement, change of role, termination, or other factors? | Take all steps necessary to terminate access to accounts or networks upon a change in an individual’s status making access unnecessary. | ||||
| Device Security | 2.0 | 2.1 | Does the PWS require approval before new software is installed or deployed? | Only allow Administrators to install new software on a PWS-issued asset. | ||
| 2.2 | Does the PWS disable Microsoft Office macros, or similar embedded code, by default on all assets? | Disable embedded macros and similar executable code by default on all assets. | ||||
| 2.3 | **Does the PWS maintain an updated inventory of all OT and IT network assets? | Regularly review (no less than monthly) and maintain a list of all OT and IT assets with an IP address. This includes third-party and legacy (i.e., older) equipment. | ||||
| 2.4 | Does the PWS prohibit the connection of unauthorized hardware (e.g., USB devices, removable media, laptops brought in by others) to OT and IT assets? | When feasible, remove, disable, or otherwise secure physical ports (e.g., USB ports on a laptop) to prevent unauthorized assets from connecting. | ||||
| 2.5 | **Does the PWS maintain current documentation detailing the set-up and settings (i.e., configuration) of critical OT and IT assets? | Maintain accurate documentation of the original and current configuration of OT and IT assets, including software and firmware version. | ||||
| Data Security | 3.0 | 3.1 | Does the PWS collect security logs (e.g., system and network access, malware detection) to use in both incident detection and investigation? | Collect and store logs and/or network traffic data to aid in detecting cyberattacks and investigating suspicious activity. | ||
| 3.2 | Does the PWS protect security logs from unauthorized access and tampering? | Store security logs in a central system or database that can only be accessed by authorized and authenticated users. | ||||
| 3.3 | Does the PWS use effective encryption to maintain the confidentiality of data in transit? | When sending information and data, use Transport Layer Security (TLS) or Secure Socket Layer (SSL) encryption standards. | ||||
| 3.4 | Does the PWS use encryption to maintain the confidentiality of stored sensitive data? | Do not store sensitive data, including credentials (i.e., usernames and passwords) in plain text. | ||||
| Governance and Training | 4.0 | 4.1 | **Does the PWS have a named role/position/title that is responsible and accountable for planning, resourcing, and execution of cybersecurity activities within the PWS? | Identify one role/position/title responsible for cybersecurity within the PWS. Whoever fills this role/position/title is then in charge of all PWS cybersecurity activities. | ||
| 4.2 | Does the PWS have a named role/position/title that is responsible and accountable for planning, resourcing, and execution of OT-specific cybersecurity activities? | Identify one PWS role/position/title responsible for ensuring planning, resourcing, and execution of OT-specific cybersecurity activities. | ||||
| 4.3 | **Does the PWS provide at least annual training for all PWS personnel that covers basic cybersecurity concepts? | Conduct annual basic cybersecurity training for all PWS personnel. | ||||
| 4.4 | Does the PWS offer OT-specific cybersecurity training on at least an annual basis to personnel who use OT as part of their regular duties? | Provide specialized OT-focused cybersecurity training to all personnel who use OT assets. | ||||
| 4.5 | Does the PWS offer regular opportunities to strengthen communication and coordination between OT and IT personnel, including vendors? | Facilitate meetings between OT and IT personnel to provide opportunities for all parties to better understand organizational security needs and to strengthen working relationships. | ||||
| Vulnerability Management | 5.0 | 5.1 | **Does the PWS patch or otherwise mitigate known vulnerabilities within the recommended timeframe? | Identify and patch vulnerabilities in a risk-informed manner (e.g., critical assets first) as quickly as possible. | ||
| 5.2 | N/A | |||||
| 5.3 | N/A | |||||
| 5.4 | Does the PWS ensure that assets connected to the public Internet expose no unnecessary exploitable services (e.g., remote desktop protocol)? | Eliminate unnecessary exposed ports and services on public-facing assets and regularly review. | ||||
| 5.5 | **Does the PWS eliminate connections between its OT assets and the Internet? | Eliminate OT asset connections to the public Internet unless explicitly required for operations. | ||||
| 5.6 | N/A | |||||
| Supply Chain / Third Party | 6.0 | 6.1 | **Does the PWS include cybersecurity as an evaluation criterion for the procurement of OT and IT assets and services? | Include cybersecurity as an evaluation criterion when procuring assets and services. | ||
| 6.2 / 6.3 | **Does the PWS require that all OT and IT vendors and service providers notify the PWS of any security incidents or vulnerabilities in a risk-informed timeframe? | Require vendors and service providers to notify the PWS of potential security incidents and vulnerabilities within a stipulated timeframe described in procurement documents and contracts. | ||||
| Response and Recovery | 7.0 | 7.1 | Does the PWS have a written procedure for reporting cybersecurity incidents, including how (e.g., phone call, Internet submission) and to whom (e.g., FBI or other law enforcement, CISA, state regulators, WaterISAC, cyber insurance provider)? | Document the procedure for reporting cybersecurity incidents promptly to better aid law enforcement, receive assistance with response and recovery, and to promote water sector awareness of cybersecurity threats. |
Under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, CISA will establish procedures that may apply to public water systems. This recommendation will be revised as necessary when those procedures are issued.
| 7.2 | **Does the PWS have written cybersecurity incident response (IR) plan for critical threat scenarios (e.g., disabled or manipulated process control systems, the loss or theft of operational or financial data, exposure of sensitive information), which is regularly practiced and updated? | Develop, practice, and update an IR plan for cybersecurity incidents that could impact PWS operations. Participate in tabletop exercises to improve responses to any potential cyber incidents. | ||
| 7.3 | **Does the PWS backup systems necessary for operations (e.g., network configurations, PLC logic, engineering drawings, personnel records) on a regular schedule, store backups separately from the source systems, and test backups on a regular basis? | Maintain, store securely and separately, and test backups of critical PWS OT and IT systems. | ||
| 7.4 | **Does the PWS maintain updated documentation describing network topology (i.e., connections between all network components) across PWS OT and IT networks? | Maintain complete and accurate documentation of all PWS OT and IT network topologies to facilitate incident response and recovery. | ||
| Other | 8.0 | 8.1 | Does the PWS segment OT and IT networks and deny connections to the OT network by default unless explicitly allowed (e.g., by IP address and port)? | Require connections between the OT and IT networks to pass through an intermediary, such as a firewall, bastion host, jump box, or demilitarized zone, which is monitored and logged. |
| 8.2 | Does the PWS keep a list of threats and adversary tactics, techniques, and procedures (TTPs) for cyberattacks relevant to the PWS and have the capability to detect instances of key threats? | Receive CISA alerts and maintain documentation of TTPs relevant to the PWS. | ||
| 8.3 | Does the PWS use email security controls to reduce common email-based threats, such as spoofing, phishing, and interception? | Ensure that email security controls are enabled on all corporate email infrastructure. |
Assessment Report
Cybersecurity Assessment Report
| Utility ID: | [PWS Name] |
| Assessment Date: | [Assessment Date] |
| Print Date: | 8/6/24 |
| Contents |
| Account Security |
Device Security Data Security Governance and Training Vulnerability Management Supply Chain / Third Party Response and Recovery Other
| Purpose |
| This Cybersecurity Assessment Report provides a summary of results for [PWS Name] from the completed Cybersecurity Assessment for Public Water System Sanitary Surveys (the Checklist). The table below includes all questions, responses, and explanation of responses from the Checklist including 'Yes', 'No', and 'In Progress' responses. |
| Questions marked with double asterisks ('**') and answered 'No' by the PWS indicate cybersecurity controls that EPA has suggested as potential significant deficiencies for consideration by the PWS Primacy Agency where the gap remains unaddressed. |
| Account Security | |||
| Checklist Number | Question | Response | Explanation of Response |
| 1.1 | Does the PWS detect and block repeated unsuccessful login attempts? | ||
| 1.2 | **Does the PWS change default passwords? | ||
| 1.3 | **Does the PWS require multi-factor authentication (MFA) wherever possible, but at a minimum to remotely access PWS Operational Technology (OT) networks? | ||
| 1.4 | **Does the PWS require a minimum length for passwords? | ||
| 1.5 | Does the PWS separate user and privileged (e.g., System Administrator) accounts? | ||
| 1.6 | Does the PWS require unique and separate credentials for users to access OT and IT networks? | ||
| 1.7 | **Does the PWS immediately disable access to an account or network when access is no longer required due to retirement, change of role, termination, or other factors? | ||
| Device Security | |||
| Checklist Number | Question | Response | Explanation of Response |
| 2.1 | Does the PWS require approval before new software is installed or deployed? | ||
| 2.2 | Does the PWS disable Microsoft Office macros, or similar embedded code, by default on all assets? | ||
| 2.3 | **Does the PWS maintain an updated inventory of all OT and IT network assets? | ||
| 2.4 | Does the PWS prohibit the connection of unauthorized hardware (e.g., USB devices, removable media, laptops brought in by others) to OT and IT assets? | ||
| 2.5 | **Does the PWS maintain current documentation detailing the set-up and settings (i.e., configuration) of critical OT and IT assets? | ||
| Data Security | |||
| Checklist Number | Question | Response | Explanation of Response |
| 3.1 | Does the PWS collect security logs (e.g., system and network access, malware detection) to use in both incident detection and investigation? | ||
| 3.2 | Does the PWS protect security logs from unauthorized access and tampering? | ||
| 3.3 | Does the PWS use effective encryption to maintain the confidentiality of data in transit? | ||
| 3.4 | Does the PWS use encryption to maintain the confidentiality of stored sensitive data? | ||
| Governance and Training | |||
| Checklist Number | Question | Response | Explanation of Response |
| 4.1 | **Does the PWS have a named role/position/title that is responsible and accountable for planning, resourcing, and execution of cybersecurity activities within the PWS? | ||
| 4.2 | Does the PWS have a named role/position/title that is responsible and accountable for planning, resourcing, and execution of OT-specific cybersecurity activities? | ||
| 4.3 | **Does the PWS provide at least annual training for all PWS personnel that covers basic cybersecurity concepts? | ||
| 4.4 | Does the PWS offer OT-specific cybersecurity training on at least an annual basis to personnel who use OT as part of their regular duties? | ||
| 4.5 | Does the PWS offer regular opportunities to strengthen communication and coordination between OT and IT personnel, including vendors? | ||
| Vulnerability Management | |||
| Checklist Number | Question | Response | Explanation of Response |
| 5.1 | **Does the PWS patch or otherwise mitigate known vulnerabilities within the recommended timeframe? | ||
| 5.4 | Does the PWS ensure that assets connected to the public Internet expose no unnecessary exploitable services (e.g., remote desktop protocol)? | ||
| 5.5 | **Does the PWS eliminate connections between its OT assets and the Internet? | ||
| Supply Chain / Third Party | |||
| Checklist Number | Question | Response | Explanation of Response |
| 6.1 | **Does the PWS include cybersecurity as an evaluation criterion for the procurement of OT and IT assets and services? | ||
| 6.2 / 6.3 | **Does the PWS require that all OT and IT vendors and service providers notify the PWS of any security incidents or vulnerabilities in a risk-informed timeframe? | ||
| Response and Recovery | |||
| Checklist Number | Question | Response | Explanation of Response |
| 7.1 | Does the PWS have a written procedure for reporting cybersecurity incidents, including how (e.g., phone call, Internet submission) and to whom (e.g., FBI or other law enforcement, CISA, state regulators, WaterISAC, cyber insurance provider)? | ||
| 7.2 | **Does the PWS have written cybersecurity incident response (IR) plan for critical threat scenarios (e.g., disabled or manipulated process control systems, the loss or theft of operational or financial data, exposure of sensitive information), which is regularly practiced and updated? | ||
| 7.3 | **Does the PWS backup systems necessary for operations (e.g., network configurations, PLC logic, engineering drawings, personnel records) on a regular schedule, store backups separately from the source systems, and test backups on a regular basis? | ||
| 7.4 | **Does the PWS maintain updated documentation describing network topology (i.e., connections between all network components) across PWS OT and IT networks? | ||
| Other | |||
| Checklist Number | Question | Response | Explanation of Response |
| 8.1 | Does the PWS segment OT and IT networks and deny connections to the OT network by default unless explicitly allowed (e.g., by IP address and port)? | ||
| 8.2 | Does the PWS keep a list of threats and adversary tactics, techniques, and procedures (TTPs) for cyberattacks relevant to the PWS and have the capability to detect instances of key threats? | ||
| 8.3 | Does the PWS use email security controls to reduce common email-based threats, such as spoofing, phishing, and interception? |
Cybersecurity Assessment Report CONFIDENTIAL - DO NOT DISTRIBUTE Print Date: &D Page &P
Risk Mitigation Plan
Cybersecurity Risk Mitigation Plan
| Utility ID: | [PWS Name] | |
| Assessment Date: | [Assessment Date] | |
| Print Date: | 8/6/24 | |
| Plan Preparation/Last Modified Date: |
| Contents |
| Account Security |
Device Security Data Security Governance and Training Vulnerability Management Supply Chain / Third Party Response and Recovery Other
| Purpose |
| This Cybersecurity Risk Mitigation Plan documents actions [PWS Name] is taking or intends to take to address cybersecurity risks. The actions in this plan are responsive to the cybersecurity risk assessment conducted using the EPA Cybersecurity Checklist for Public Water System Sanitary Surveys (the Checklist). The table below includes all questions from the Checklist where [PWS Name] representatives responded either 'No' or 'In Progress' during the assessment. |
| Cybersecurity Risk Mitigation Plan Actions |
| For each question in this table, PWS representatives should describe the “Current Status,” “Target Completion Date,” “PWS Personnel Responsible,” “Involved Departments and/or Agencies”, and “PWS Notes”. Notice that the “PWS Notes” column has been automatically filled out with the information gathered during the initial assessment. In the “Current Status” cell, PWS representatives can describe progress, such as listing “Not Started,” “In Progress,” or “Completed.” The PWS can provide more detail on the current status (e.g., any explanatory notes, resources) by updating the “PWS Notes” field as appropriate. This Plan is intended to be a living document that the PWS regularly updates to reflect progress with implementing the risk mitigation actions. |
For more information on how to implement the planned risk mitigation actions, review the factsheet that corresponds to each Checklist question in the Guidance document at the link below:
https://www.epa.gov/waterriskassessment/epa-cybersecurity-best-practices-water-sector
Questions marked with an “**” and answered “no” by the PWS indicate cybersecurity controls that EPA has suggested as potential significant deficiencies for consideration by the PWS Primacy Agency where the gap remains unaddressed.
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
| Question: |
| Planned Risk Mitigation Action: |
| Current Status: |
| Target Completion Date: |
| PWS Personnel Responsible: |
| Involved Departments and/or Agencies: |
| PWS Notes: |
Cybersecurity Risk Mitigation Plan CONFIDENTIAL - DO NOT DISTRIBUTE Print Date: &D Page &P https://www.epa.gov/waterriskassessment/epa-cybersecurity-best-practices-water-sector _DataTable
| PivotTable Source | ||||||||||
| Topic | Topic Number | Checklist Number | Question | Response | Recommendation | Yes | No | In Progress | Index | PWS Notes |
| Filter Functionality_Yes | 0.0 | 0.1 | Filter Functionality_Yes | Yes | Filter Functionality_Yes | 1 | 0 | 0 | 1 | Filter Functionality_Yes |
| Filter Functionality_No | 0.0 | 0.2 | Filter Functionality_No | No | Filter Functionality_No | 0 | 1 | 0 | 2 | Filter Functionality_No |
| Filter Functionality_In Progress | 0.0 | 0.3 | Filter Functionality_In Progress | In Progress | Filter Functionality_In Progress | 0 | 0 | 1 | 3 | Filter Functionality_In Progress |
| Account Security | 1.0 | 1.1 | Does the PWS detect and block repeated unsuccessful login attempts? | 0 | Where technically feasible, System Administrators should be notified after a specific number of consecutive, unsuccessful login attempts in a short amount of time. At that point, future login attempts by the suspicious account should be blocked for a specified time or until re-enabled by an Administrator. | 0 | 0 | 0 | 4 | No PWS Notes for 1.1 |
| Account Security | 1.0 | 1.2 | **Does the PWS change default passwords? | 0 | When feasible, change all default manufacturer or vendor passwords before equipment or software is put into service. | 0 | 0 | 0 | 5 | No PWS Notes for 1.2 |
| Account Security | 1.0 | 1.3 | **Does the PWS require multi-factor authentication (MFA) wherever possible, but at a minimum to remotely access PWS Operational Technology (OT) networks? | 0 | Deploy MFA as widely as possible for both information technology (IT) and operational technology (OT) networks. At a minimum, MFA should be deployed for remote access to the OT network. | 0 | 0 | 0 | 6 | No PWS Notes for 1.3 |
| Account Security | 1.0 | 1.4 | **Does the PWS require a minimum length for passwords? | 0 | Where feasible, implement a minimum length requirement for passwords. Implementation can be through a policy or administrative controls set in the system. | 0 | 0 | 0 | 7 | No PWS Notes for 1.4 |
| Account Security | 1.0 | 1.5 | Does the PWS separate user and privileged (e.g., System Administrator) accounts? | 0 | Restrict System Administrator privileges to separate user accounts for administrative actions only and evaluate administrative privileges on a recurring basis to be sure they are still needed by the individuals who have these privileges. | 0 | 0 | 0 | 8 | No PWS Notes for 1.5 |
| Account Security | 1.0 | 1.6 | Does the PWS require unique and separate credentials for users to access OT and IT networks? | 0 | Require a single user to have two different usernames and passwords; one set is to be used to access the IT network, and the other set is to be used to access the OT network. This reduces the risk of an attacker being able to move between both networks using a single login. | 0 | 0 | 0 | 9 | No PWS Notes for 1.6 |
| Account Security | 1.0 | 1.7 | **Does the PWS immediately disable access to an account or network when access is no longer required due to retirement, change of role, termination, or other factors? | 0 | Take all steps necessary to terminate access to accounts or networks upon a change in an individual’s status making access unnecessary. | 0 | 0 | 0 | 10 | No PWS Notes for 1.7 |
| Device Security | 2.0 | 2.1 | Does the PWS require approval before new software is installed or deployed? | 0 | Only allow Administrators to install new software on a PWS-issued asset. | 0 | 0 | 0 | 11 | No PWS Notes for 2.1 |
| Device Security | 2.0 | 2.2 | Does the PWS disable Microsoft Office macros, or similar embedded code, by default on all assets? | 0 | Disable embedded macros and similar executable code by default on all assets. | 0 | 0 | 0 | 12 | No PWS Notes for 2.2 |
| Device Security | 2.0 | 2.3 | **Does the PWS maintain an updated inventory of all OT and IT network assets? | 0 | Regularly review (no less than monthly) and maintain a list of all OT and IT assets with an IP address. This includes third-party and legacy (i.e., older) equipment. | 0 | 0 | 0 | 13 | No PWS Notes for 2.3 |
| Device Security | 2.0 | 2.4 | Does the PWS prohibit the connection of unauthorized hardware (e.g., USB devices, removable media, laptops brought in by others) to OT and IT assets? | 0 | When feasible, remove, disable, or otherwise secure physical ports (e.g., USB ports on a laptop) to prevent unauthorized assets from connecting. | 0 | 0 | 0 | 14 | No PWS Notes for 2.4 |
| Device Security | 2.0 | 2.5 | **Does the PWS maintain current documentation detailing the set-up and settings (i.e., configuration) of critical OT and IT assets? | 0 | Maintain accurate documentation of the original and current configuration of OT and IT assets, including software and firmware version. | 0 | 0 | 0 | 15 | No PWS Notes for 2.5 |
| Data Security | 3.0 | 3.1 | Does the PWS collect security logs (e.g., system and network access, malware detection) to use in both incident detection and investigation? | 0 | Collect and store logs and/or network traffic data to aid in detecting cyberattacks and investigating suspicious activity. | 0 | 0 | 0 | 16 | No PWS Notes for 3.1 |
| Data Security | 3.0 | 3.2 | Does the PWS protect security logs from unauthorized access and tampering? | 0 | Store security logs in a central system or database that can only be accessed by authorized and authenticated users. | 0 | 0 | 0 | 17 | No PWS Notes for 3.2 |
| Data Security | 3.0 | 3.3 | Does the PWS use effective encryption to maintain the confidentiality of data in transit? | 0 | When sending information and data, use Transport Layer Security (TLS) or Secure Socket Layer (SSL) encryption standards. | 0 | 0 | 0 | 18 | No PWS Notes for 3.3 |
| Data Security | 3.0 | 3.4 | Does the PWS use encryption to maintain the confidentiality of stored sensitive data? | 0 | Do not store sensitive data, including credentials (i.e., usernames and passwords) in plain text. | 0 | 0 | 0 | 19 | No PWS Notes for 3.4 |
| Governance and Training | 4.0 | 4.1 | **Does the PWS have a named role/position/title that is responsible and accountable for planning, resourcing, and execution of cybersecurity activities within the PWS? | 0 | Identify one role/position/title responsible for cybersecurity within the PWS. Whoever fills this role/position/title is then in charge of all PWS cybersecurity activities. | 0 | 0 | 0 | 20 | No PWS Notes for 4.1 |
| Governance and Training | 4.0 | 4.2 | Does the PWS have a named role/position/title that is responsible and accountable for planning, resourcing, and execution of OT-specific cybersecurity activities? | 0 | Identify one PWS role/position/title responsible for ensuring planning, resourcing, and execution of OT-specific cybersecurity activities. | 0 | 0 | 0 | 21 | No PWS Notes for 4.2 |
| Governance and Training | 4.0 | 4.3 | **Does the PWS provide at least annual training for all PWS personnel that covers basic cybersecurity concepts? | 0 | Conduct annual basic cybersecurity training for all PWS personnel. | 0 | 0 | 0 | 22 | No PWS Notes for 4.3 |
| Governance and Training | 4.0 | 4.4 | Does the PWS offer OT-specific cybersecurity training on at least an annual basis to personnel who use OT as part of their regular duties? | 0 | Provide specialized OT-focused cybersecurity training to all personnel who use OT assets. | 0 | 0 | 0 | 23 | No PWS Notes for 4.4 |
| Governance and Training | 4.0 | 4.5 | Does the PWS offer regular opportunities to strengthen communication and coordination between OT and IT personnel, including vendors? | 0 | Facilitate meetings between OT and IT personnel to provide opportunities for all parties to better understand organizational security needs and to strengthen working relationships. | 0 | 0 | 0 | 24 | No PWS Notes for 4.5 |
| Vulnerability Management | 5.0 | 5.1 | **Does the PWS patch or otherwise mitigate known vulnerabilities within the recommended timeframe? | 0 | Identify and patch vulnerabilities in a risk-informed manner (e.g., critical assets first) as quickly as possible. | 0 | 0 | 0 | 25 | No PWS Notes for 5.1 |
| Vulnerability Management | 5.0 | 5.4 | Does the PWS ensure that assets connected to the public Internet expose no unnecessary exploitable services (e.g., remote desktop protocol)? | 0 | Eliminate unnecessary exposed ports and services on public-facing assets and regularly review. | 0 | 0 | 0 | 26 | No PWS Notes for 5.4 |
| Vulnerability Management | 5.0 | 5.5 | **Does the PWS eliminate connections between its OT assets and the Internet? | 0 | Eliminate OT asset connections to the public Internet unless explicitly required for operations. | 0 | 0 | 0 | 27 | No PWS Notes for 5.5 |
| Supply Chain / Third Party | 6.0 | 6.1 | **Does the PWS include cybersecurity as an evaluation criterion for the procurement of OT and IT assets and services? | 0 | Include cybersecurity as an evaluation criterion when procuring assets and services. | 0 | 0 | 0 | 28 | No PWS Notes for 6.1 |
| Supply Chain / Third Party | 6.0 | 6.2 / 6.3 | **Does the PWS require that all OT and IT vendors and service providers notify the PWS of any security incidents or vulnerabilities in a risk-informed timeframe? | 0 | Require vendors and service providers to notify the PWS of potential security incidents and vulnerabilities within a stipulated timeframe described in procurement documents and contracts. | 0 | 0 | 0 | 29 | No PWS Notes for 6.2 / 6.3 |
| Response and Recovery | 7.0 | 7.1 | Does the PWS have a written procedure for reporting cybersecurity incidents, including how (e.g., phone call, Internet submission) and to whom (e.g., FBI or other law enforcement, CISA, state regulators, WaterISAC, cyber insurance provider)? | 0 | Document the procedure for reporting cybersecurity incidents promptly to better aid law enforcement, receive assistance with response and recovery, and to promote water sector awareness of cybersecurity threats. |
Under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, CISA will establish procedures that may apply to public water systems. This recommendation will be revised as necessary when those procedures are issued.
| 0 | 0 | 0 | 30 | No PWS Notes for 7.1 | ||||||
| Response and Recovery | 7.0 | 7.2 | **Does the PWS have written cybersecurity incident response (IR) plan for critical threat scenarios (e.g., disabled or manipulated process control systems, the loss or theft of operational or financial data, exposure of sensitive information), which is regularly practiced and updated? | 0 | Develop, practice, and update an IR plan for cybersecurity incidents that could impact PWS operations. Participate in tabletop exercises to improve responses to any potential cyber incidents. | 0 | 0 | 0 | 31 | No PWS Notes for 7.2 |
| Response and Recovery | 7.0 | 7.3 | **Does the PWS backup systems necessary for operations (e.g., network configurations, PLC logic, engineering drawings, personnel records) on a regular schedule, store backups separately from the source systems, and test backups on a regular basis? | 0 | Maintain, store securely and separately, and test backups of critical PWS OT and IT systems. | 0 | 0 | 0 | 32 | No PWS Notes for 7.3 |
| Response and Recovery | 7.0 | 7.4 | **Does the PWS maintain updated documentation describing network topology (i.e., connections between all network components) across PWS OT and IT networks? | 0 | Maintain complete and accurate documentation of all PWS OT and IT network topologies to facilitate incident response and recovery. | 0 | 0 | 0 | 33 | No PWS Notes for 7.4 |
| Other | 8.0 | 8.1 | Does the PWS segment OT and IT networks and deny connections to the OT network by default unless explicitly allowed (e.g., by IP address and port)? | 0 | Require connections between the OT and IT networks to pass through an intermediary, such as a firewall, bastion host, jump box, or demilitarized zone, which is monitored and logged. | 0 | 0 | 0 | 34 | No PWS Notes for 8.1 |
| Other | 8.0 | 8.2 | Does the PWS keep a list of threats and adversary tactics, techniques, and procedures (TTPs) for cyberattacks relevant to the PWS and have the capability to detect instances of key threats? | 0 | Receive CISA alerts and maintain documentation of TTPs relevant to the PWS. | 0 | 0 | 0 | 35 | No PWS Notes for 8.2 |
| Other | 8.0 | 8.3 | Does the PWS use email security controls to reduce common email-based threats, such as spoofing, phishing, and interception? | 0 | Ensure that email security controls are enabled on all corporate email infrastructure. | 0 | 0 | 0 | 36 | No PWS Notes for 8.3 |
_ChecklistNumbers
| Response | (Multiple Items) |
| Row Labels | Sum of Index |
| 0.2 | 2 |
| 0.3 | 3 |
_Question
| Response | (Multiple Items) |
| Row Labels | Sum of Index |
| Filter Functionality_No | 2 |
| Filter Functionality_In Progress | 3 |
_Recommendation
| Response | (Multiple Items) |
| Row Labels | Sum of Index |
| Filter Functionality_No | 2 |
| Filter Functionality_In Progress | 3 |
_PWSNotes
| Response | (Multiple Items) |
| Row Labels | Sum of Index |
| Filter Functionality_No | 2 |
| Filter Functionality_In Progress | 3 |
image1.png image2.png
File details come from the government source that posted it. Updated .