Skip to main content
TRY Academy home

Cybersecurity course · Operators, technicians, SCADA/IT & managers

Cybersecurity Training for Water and Wastewater Treatment Plants

Protect SCADA, PLCs and plant networks: CISA and EPA guidance, AWIA risk assessments, access control, segmentation, detection, incident response and recovery for water and wastewater utilities.

Cybersecurity Training for Water and Wastewater Treatment Plants is an online, self-paced course from TRYeTECH Academy covering why water and wastewater utilities are targeted, SCADA and control system architecture, cyber frameworks and assessments, governance and risk, identity and access control, network defense and OT hardening, monitoring and detection, incident response and reporting, and backup and recovery. It has 10 modules and 70 lessons — about 150 hours of study — and every lesson combines narrated slides with Key details, pre-task checklists, field scenarios, worked examples, quizzes and flashcards, backed by cybersecurity calculators and narrated module videos. Lessons follow public guidance by name: the EPA/CISA/FBI “Top Cyber Actions for Securing Water Systems”, CISA’s Cross-Sector Cybersecurity Performance Goals, EPA’s water-sector cybersecurity guidance, the NIST Cybersecurity Framework 2.0 and NIST SP 800-82 Rev. 3, ISA/IEC 62443 and the AWWA Cybersecurity Guidance & Assessment Tool.

  • 10 modules
  • 70 lessons
  • ≈150 hours
  • Online, self-paced
Illustration of a padlock protecting a PLC and its control network

Who this course is for

Starting out

For operators, maintenance and I&C technicians, lab and office staff who use plant computers. Every term is explained in plain language, each lesson opens with a pre-task checklist and the scenarios build safe cyber habits from day one.

Experienced & supervising

For SCADA and IT staff, supervisors, emergency planners and managers. You get citations to CISA, EPA, NIST and AWWA guidance, numbers you can use in planning, program-level scenarios and tracked active study hours for your training records.

What’s included

Course sequence: Cybersecurity for Water & Wastewater Plants

2 numbered courses, 150 hours in total. Take them in order — each one prepares you for the next. Download the two-page sheet for any course, or the full course syllabus (PDF).

  1. Cybersecurity Foundations: Threats, SCADA Architecture, CISA & EPA Frameworks, Governance & Access Control

    Foundation · 75 hours · 5 modules · 35 lessons

    Why water systems are targets, how plant control systems are built, the CISA, EPA, NIST and AWWA guidance and assessments utilities use, cyber governance and risk, and controlling who can reach your systems.

    • Explain why water and wastewater systems are targeted and how OT differs from IT, using real water-sector incidents.
    • Describe SDWA §1433 (AWIA) cybersecurity duties, EPA enforcement findings, CIRCIA status and Virginia's 24-hour reporting rule.
    • Map PLCs, RTUs, HMIs, historians, protocols, remote sites and vendor access onto the Purdue model and an industrial DMZ.

    Download the CYB 101 course sheet (PDF)

  2. Network Defense, Detection, Incident Response, Recovery & Building a Utility Cyber Program

    Advanced · 75 hours · 5 modules · 35 lessons

    Remove internet exposure, segment and harden OT, patch safely, detect attacks at the network and the HMI, respond and report, recover from ransomware and build a program that keeps improving.

    • Find and remove internet exposure, segment OT with firewalls, zones and conduits and secure radio and cellular telemetry.
    • Harden PLCs, HMIs and servers, manage OT vulnerabilities with CISA KEV and advisories, and control removable media.
    • Decide what to log, monitor OT networks and recognize abnormal HMI and process behavior as an operator.

    Download the CYB 102 course sheet (PDF)

Course outline

10 modules · 70 lessons · about 15 hours per module. Lesson 1 of every module is free with an account. Download the syllabus (PDF).

  1. Module 1: Cybersecurity Foundations for Water & Wastewater Utilities

    Module 1 · 7 lessons · ≈15 h

    Water and wastewater plants now run on computers, and attackers know it. This module gives every operator, technician, supervisor and manager the foundation for the rest of the course. You will learn why utilities are targets, how plant control systems (OT) differ from office IT, who the threat actors are and what really happened in published water-sector incidents. We cover the federal rules under SDWA §1433…

    You will be able to:

    • Explain why drinking-water and wastewater utilities are attractive targets and what a cyber incident can do to public health, the environment and the utility.
    • Describe the main ways attackers reach a utility, including internet-exposed PLCs and HMIs, remote access, phishing, vendors and removable media.
    • Compare IT and OT priorities, lifecycles, patching limits and failure consequences, and explain why OT security puts safety and availability first.
    • Identify the main threat actor types (nation-state, hacktivist, criminal, insider, accidental) and their typical motives and methods.

    Lessons

    1. Why water & wastewater systems are targets Free sample
    2. IT vs OT: how plant control systems differ
    3. Threat actors, motives & real water-sector incidents
    4. Federal requirements: SDWA §1433 (AWIA), EPA enforcement & CIRCIA
    5. Partners: CISA, EPA, FBI, WaterISAC & Virginia agencies
    6. Roles & responsibilities: everyone defends the plant
    7. Cyber hygiene basics for every employee
  2. Module 2: SCADA & Control System Architecture

    Module 2 · 7 lessons · ≈15 h

    You cannot defend a plant control system you do not understand. This module walks through how SCADA really works at a water or wastewater utility: the PLCs, RTUs, HMIs, historians and engineering workstations that run the process; the industrial protocols they speak, such as Modbus, DNP3, EtherNet/IP and OPC UA; and how the Purdue model and an industrial DMZ organize the network into levels. You will trace telemetry…

    You will be able to:

    • Identify the main components of a water or wastewater control system and describe what each one does.
    • Explain how PLCs and RTUs read field instruments, run logic and drive pumps, valves and chemical feeders.
    • Describe why engineering workstations, project files and PLC run/program modes deserve special protection.
    • Compare Modbus, DNP3, EtherNet/IP and OPC UA, including which have built-in security and which do not.

    Lessons

    1. Control system components: PLCs, RTUs, HMIs, historians & engineering workstations Free with account
    2. Industrial protocols: Modbus, DNP3, EtherNet/IP & OPC UA
    3. The Purdue model, network levels & the industrial DMZ
    4. Remote sites: pump stations, telemetry, radio & cellular links
    5. Remote access & vendor connection pathways
    6. Safety systems, hardwired interlocks & manual fallback
    7. OT asset inventory & network documentation
  3. Module 3: Frameworks, Standards & Cyber Assessments

    Module 3 · 7 lessons · ≈15 h

    Cybersecurity guidance for water utilities can feel like alphabet soup: CSF, CPG, WCAT, CSET, 62443, 800-82, AWIA. This module sorts it out for plant people. You will learn how NIST CSF 2.0 gives a common structure with six functions, how CISA's Cybersecurity Performance Goals (CPG 2.0) set a short list of high-impact practices, and how the AWWA guidance and assessment tool turn your technology use into a…

    You will be able to:

    • Describe the six NIST CSF 2.0 functions and give a plant example for each.
    • Build a simple CSF Current Profile and Target Profile and identify the gaps.
    • Explain the purpose of CISA's Cross-Sector Cybersecurity Performance Goals (CPG 2.0) and how they map to the CSF.
    • Choose an AWWA assessment path (Small System, AWWA Assessment or CSET import) for a given utility.

    Lessons

    1. NIST Cybersecurity Framework 2.0 Free with account
    2. CISA Cybersecurity Performance Goals
    3. AWWA Cybersecurity Guidance & Assessment Tool
    4. ISA/IEC 62443 & NIST SP 800-82 for OT
    5. EPA cybersecurity checklist & the Water Sector Cybersecurity Evaluation Program
    6. CISA no-cost services: CSET, scanning, architecture reviews & advisors
    7. Cybersecurity in the AWIA risk & resilience assessment
  4. Module 4: Cyber Governance, Risk Management & Policy

    Module 4 · 7 lessons · ≈15 h

    Cybersecurity at a water or wastewater utility fails most often for reasons that are not technical: nobody owns it, risks are never written down, policies sit in a binder, vendors connect however they like, and leaders never see a clear picture. This module builds the management system that keeps plant-floor security working. You will set up governance with a named cyber lead and clear accountability, score risks by…

    You will be able to:

    • Explain why cybersecurity governance is a leadership duty and how the NIST CSF 2.0 Govern function and CISA CPG 2.0 frame it.
    • Define the role, authority and reporting line of a named cybersecurity lead, including OT responsibilities shared with operations.
    • Build a simple RACI that assigns cyber tasks across leadership, IT, operations, maintenance, vendors and the cyber lead.
    • Score cyber risks with likelihood and consequence scales and place them on a risk matrix that puts public health first.

    Lessons

    1. Governance: leadership, a named cyber lead & accountability Free with account
    2. Cyber risk assessment: likelihood, consequence & the risk register
    3. Policies, standards & procedures a utility needs
    4. Vendor, integrator & supply-chain risk
    5. Budgeting & funding cybersecurity: SRF, grants & phased plans
    6. Workforce training & security awareness programs
    7. Metrics, reporting to leadership & continual improvement
  5. Module 5: Identity, Access & Physical Security

    Module 5 · 7 lessons · ≈15 h

    Most water-sector cyber incidents start with an account, not exotic malware: a default password left on an internet-facing PLC, one login shared by every operator, a former employee who can still sign in, or a vendor remote-access tool that is always on. EPA's May 2024 Enforcement Alert found exactly these gaps at many inspected systems. This module teaches plant staff how to control who can do what on SCADA, HMIs…

    You will be able to:

    • Explain least privilege and role-based access and apply them to operator, supervisor, technician, engineer, IT and vendor roles.
    • Build a simple access matrix that maps plant roles to HMI, SCADA, PLC and business-system permissions.
    • Identify default, weak and shared credentials and describe why EPA and CISA rank changing them as a top action.
    • Calculate password and passphrase strength in bits and compare length with complexity.

    Lessons

    1. Accounts, roles & least privilege Free with account
    2. Passwords, default credentials & passphrases
    3. Multifactor authentication, including phishing-resistant MFA
    4. Privileged & shared accounts in control systems
    5. Onboarding, role changes & offboarding (joiners, movers, leavers)
    6. Secure remote access: VPNs, jump hosts & session control
    7. Physical security that protects cyber assets
  6. Module 6: Network Defense & OT Hardening

    Module 6 · 7 lessons · ≈15 h

    Many 2024-2026 attacks on water and wastewater control systems needed no clever malware. They reached a PLC, HMI or cellular modem that was directly on the internet, often with a default or weak password. This module shows plant staff how their control network works and how to defend it. You will learn IP addresses, ports, switches and routers in plain terms; how to find and remove internet exposure with free CISA…

    You will be able to:

    • Explain IP addresses, subnets, gateways, ports, switches, routers and firewalls using plant examples.
    • Calculate usable host counts for common subnet sizes and read a simple plant network drawing.
    • Identify the common ways control systems become reachable from the internet, including port forwarding, cellular modems and vendor remote tools.
    • Describe how to confirm and remove internet exposure using the asset inventory, firewall reviews and CISA Cyber Hygiene scanning of the utility's own addresses.

    Lessons

    1. Network basics for plant staff: IP addresses, ports, switches & routers Free with account
    2. Finding and removing internet exposure
    3. Segmentation, firewalls, zones & conduits
    4. Wireless, radio & cellular telemetry security
    5. Secure configuration & hardening of PLCs, HMIs and servers
    6. Vulnerability & patch management in OT
    7. Endpoint protection, allowlisting & removable media
  7. Module 7: Monitoring, Detection & Threat Awareness

    Module 7 · 7 lessons · ≈15 h

    Most water-sector cyber incidents are found late, by an operator who notices something odd or a vendor who calls with bad news. This module teaches how a utility sees trouble early. You will learn which IT and OT logs to collect and keep, how passive network monitoring and OT-aware intrusion detection watch plant protocols without touching the process, and how operators act as sensors for abnormal HMI and process…

    You will be able to:

    • List the IT and OT log sources a water or wastewater utility should collect, and explain why accurate time stamps and protected storage matter.
    • Estimate log storage needs from event rate, event size and retention period.
    • Explain how passive network monitoring with SPAN ports or network TAPs and OT-aware intrusion detection work without sending traffic to controllers.
    • Describe a network baseline and the OT alerts that matter most, such as new devices, new connections, PLC program downloads and mode changes.

    Lessons

    1. Logging: what to collect in IT and OT Free with account
    2. Network monitoring & OT intrusion detection
    3. The operator as a sensor: spotting abnormal HMI and process behavior
    4. Phishing, social engineering & ransomware warning signs
    5. Threat intelligence: advisories, WaterISAC & MITRE ATT&CK for ICS
    6. Verifying process integrity: lab, field & independent checks
    7. Security monitoring options for small utilities
  8. Module 8: Cyber Incident Response & Reporting

    Module 8 · 7 lessons · ≈15 h

    A cyber incident at a water or wastewater utility is first a public-health and environmental event, then an IT problem. This module teaches plant staff how to respond when something looks wrong on the HMI or the business network. You will build and staff a written cyber incident response plan tied to the AWIA emergency response plan, take safe first actions, run the plant in manual with field and lab checks, and…

    You will be able to:

    • Describe the parts of a cyber incident response plan and how it links to the SDWA §1433 emergency response plan.
    • Assign incident response roles, including an incident commander, OT lead, IT lead, communications lead and an after-hours call tree.
    • Recognize the signs that an HMI, PLC or business-system problem may be a cyber incident and escalate it without delay.
    • Take safe first actions: protect the process, go to manual when integrity is in doubt, contain without wiping, and write down what you see.

    Lessons

    1. The cyber incident response plan & team Free with account
    2. First actions when a cyberattack is suspected
    3. Manual operation & keeping water safe during an incident
    4. Reporting: CISA, FBI, EPA, state primacy & the Virginia Fusion Center
    5. Evidence preservation & working with investigators
    6. Communications: staff, customers, media & public notification
    7. Tabletop exercises & after-action improvement
  9. Module 9: Backup, Recovery & Cyber Resilience

    Module 9 · 7 lessons · ≈15 h

    Every utility will eventually lose a server, a PLC program or a whole network to ransomware, a bad update or a failed disk. What matters is how fast you can get back to safe, normal operation. This module shows how to build a 3-2-1 backup strategy with offline and immutable copies, and how to capture PLC logic, HMI projects, firmware and network device configurations. You will run a business impact analysis, set RTO…

    You will be able to:

    • Explain the 3-2-1 backup rule and why at least one copy must be offline or immutable.
    • Compare full, incremental and differential backups, snapshots and image backups for IT and OT systems.
    • Build an OT backup list that covers PLC and RTU logic, HMI and SCADA projects, historians, firmware and network device configurations.
    • Verify a backup with a hash, a program compare and a documented restore test.

    Lessons

    1. Backup strategy: 3-2-1, offline & immutable copies Free with account
    2. Backing up PLC logic, HMI projects & device configurations
    3. Business impact analysis, RTO & RPO
    4. Ransomware recovery: decisions & sequence
    5. Restoring and validating OT systems before return to service
    6. Cyber in the emergency response plan & continuity of operations
    7. Cyber insurance, legal & contract considerations
  10. Module 10: Building & Sustaining a Utility Cybersecurity Program

    Module 10 · 7 lessons · ≈15 h

    Cybersecurity is not a one-time project; it is a program a utility runs every year, like lab QA or asset management. This capstone module shows small and medium water and wastewater utilities how to turn the practices from Modules 1 to 9 into a phased, funded roadmap. You will learn to build security into new projects and procurement specifications, including SRF-funded work, and to manage cloud, IoT, AMI and…

    You will be able to:

    • Build a phased 30-, 90- and 365-day cybersecurity roadmap for a small or medium utility using the EPA/CISA/FBI Top Cyber Actions and the 2025 Primary Mitigations for OT.
    • Rank roadmap actions by risk reduction, cost and effort, starting with internet exposure, default passwords and remote access.
    • Write cybersecurity requirements into design, bid and integration contracts using CISA Secure by Demand and the EPA Cybersecurity Procurement Checklist.
    • Explain how SRF and other funding programs can pay for cybersecurity components of projects, and where to verify current eligibility.

    Lessons

    1. A practical roadmap for small and medium utilities Free with account
    2. Secure-by-design projects, procurement specifications & SRF-funded work
    3. Cloud, IoT, AMI & smart-water technologies
    4. Emerging threats: nation-state prepositioning, AI & PLC campaigns
    5. Measuring maturity: self-assessments, audits & corrective actions
    6. Working with IT, integrators, contractors & neighboring utilities
    7. Cyber careers, professional development & course wrap-up

Regulations, guidance & standards

Prepared with AI assistance. Training only — verify against current CISA, EPA and FBI guidance, your state primacy agency, your utility’s written cybersecurity, incident response and emergency response plans, and vendor instructions.

Access

Access is by invitation for utilities and organizations; terms are set by agreement. Questions about any module or course: info@tryetech.com.

Frequently asked questions

Who is the Cybersecurity for Water & Wastewater Plants course for?

It is written for two groups at once: operators, maintenance and I&C technicians and other staff who use plant computers get plain-language explanations of every term, and SCADA and IT staff, supervisors, emergency planners and managers get citations to CISA, EPA, NIST and AWWA guidance, program-level detail and harder scenarios. No prerequisites are required.

Do I need IT or cybersecurity experience before I start?

No. CYB 101 starts from the basics — what a PLC, an HMI, a network port or multifactor authentication is — and explains every term for plant staff. CYB 102 builds on CYB 101, so take the two courses in order. Knowing your own plant’s control system helps, but it is not required.

Is this a hacking course?

No. The course is defensive only. It explains how attacks on water systems work at the level of public CISA, EPA and FBI advisories, then focuses on prevention, detection, response and recovery. It does not teach anyone to attack, scan or break into systems, and it stresses that any test or change on a production control system needs written authorization, operations approval and a rollback plan.

Does the course meet SDWA §1433 (AWIA) requirements or replace a cybersecurity assessment?

No. It helps staff understand the cybersecurity parts of the risk and resilience assessment and emergency response plan that community water systems prepare under Safe Drinking Water Act §1433, as amended by America’s Water Infrastructure Act, but completing it does not satisfy any legal requirement and it is not an assessment. Assessments are done by your utility or by qualified assessors working for it. CISA and EPA offer no-cost help, such as CISA Cyber Hygiene vulnerability scanning and EPA’s Water Sector Cybersecurity Evaluation Program — check current availability with each agency.

Is the course endorsed by CISA or EPA?

No. TRYeTECH Academy is independent training. Lessons cite and explain public guidance from CISA, EPA, the FBI, NIST, AWWA and WaterISAC by name, but none of these organizations has reviewed, approved or endorsed the course.

Can I try it for free?

Yes. Lesson 1 of Module 1 opens without an account. A free account unlocks Lesson 1 of every module. Full access unlocks every lesson, calculator, flashcard deck and certificate.

How many hours is the course, and does it count for continuing education?

Plan on about 150 hours (≈15 hours per module across 10 modules and 70 lessons). The Academy records your active study time and issues module certificates that list your study hours. Certificates record completion; CEU/CPE credit is subject to approval by your licensing board or employer.

Which guidance and standards does it follow?

The course is written to: SDWA §1433 (AWIA) · EPA water-sector cyber guidance · CISA CPGs 2.0 · NIST CSF 2.0 · NIST SP 800-82r3 · ISA/IEC 62443 · AWWA Cybersecurity Guidance. Each lesson cites the document or edition it uses. Always verify against the current CISA, EPA, FBI and NIST publications, your state primacy agency and your utility’s written policies and plans.

Does it work on a phone or tablet in the plant?

Yes. The course runs in any modern browser on a phone, tablet or desktop, follows your light or dark setting, is fully keyboard accessible and keeps your place between devices when you are signed in.

Do I get a certificate?

You earn a module certificate when all lessons in a module are complete and the module quizzes average 80% or better. Each certificate lists your active study hours and a verification code anyone can check on the Academy site.

How do I get access for my team?

The Academy is open by invitation to utilities and organizations. Email info@tryetech.com with the courses or modules you are interested in; access and terms are arranged by agreement.

Start with a free lesson

See how the course works before you request access — Module 1, Lesson 1 opens right away.

Certificates record completion; CEU/CPE credit is subject to approval by your licensing board or employer. Independent training, not affiliated with or endorsed by any licensing board or standards body.