OT security for water and wastewater
Protect the water, from the treatment plant to the wastewater plant
Water treatment plants, wastewater plants and pumping stations are run by SCADA systems and PLCs. Many stations are far away and reached over the mobile network. XoT protects them without you replacing the equipment.
The situation
Why water and wastewater are especially exposed
The NIST draft of SP 800-82 Rev. 4 has its own section on water and wastewater. It points to the same risks that we see.
Scattered stations
Pumping stations, reservoirs and booster stations are spread out. They are often connected over the mobile network, radio links or leased lines.
Long service life
The control systems must work for many years. Many rarely get security updates, and some get none at all.
Vendors and service partners
Many smaller utilities let a vendor or service partner run their control systems. The contract often does not state clearly who is responsible for cybersecurity.
Water quality
The control systems dose chemicals and control treatment. An attack can affect water quality and people's health.
Laws
Several laws apply to the same organisation
The examples below come from Sweden. Other EU countries have similar laws, because NIS2 and CER are EU directives.
NIS2
Drinking water and wastewater are sectors in NIS2. In Sweden the requirements apply through the Cybersecurity Act since 15 January 2026.
CER
Drinking water and wastewater are also part of CER, which is about resilience. Sweden is introducing CER through a new law.
Protective Security Act
Many water and wastewater utilities matter to Sweden's national security. Then the Swedish Protective Security Act also applies.
Confidentiality
Information about sites, control systems and networks may be confidential. This also applies to information in remote access systems.
Read about NIS2Read about CERRead about the Protective Security Act
Svenskt Vatten
The requirements in the security handbook and what XoT does
Svenskt Vatten, the Swedish water and wastewater association, has a security handbook for the sector. The handbook is not a law. It gathers requirements from laws and standards and adapts them to water and wastewater.
The table shows some of the handbook's requirements for control systems. The wording is our simplification. Rows where XoT helps are highlighted in green.
| Requirement in the handbook | What XoT does | XoT |
|---|---|---|
| External connections do not go directly into critical networks | The Lock only connects outbound. No inbound ports are opened, and access applies to one machine at a time. | Yes |
| The network is divided so that faults and malware do not spread | One Lock per device or group divides the network into smaller parts. | Yes |
| Vendors do not reach critical networks without control, and their work is followed up | Access after approval and for a set time. Every connection is logged. | Yes |
| No unauthorised connections from critical systems to the internet | The Lock can stop traffic out of the equipment. | Yes |
| Encrypted traffic between subsystems | Lock to Lock encrypts the traffic. Nothing changes in the equipment. | Yes |
| Old control systems are protected until they are replaced | Hide and Protect makes the equipment invisible to anyone without an authorisation. It is a compensating control. | Yes |
| Personal sign-in and access rights that are reviewed | Each person has their own identity. The Policy Graph shows who can reach what. You do the review. | Partly |
| Logs that are protected against changes and reviewed | The XMS logs every connection and every policy change. Logs can be sent to your SIEM. You do the review. | Partly |
| Alarms when communication changes abnormally | The Lock can send a copy of the traffic to an intrusion detection system. XoT does not raise alarms itself. | Partly |
| Operation without the network, and manual operation that is practised | This is work in your organisation. | No |
Remote stations
Protect pumping stations and other remote stations
A pumping station is connected to the SCADA system. From the station, it is often possible to reach other parts of the process. That makes the stations a possible way in for an attacker.
A Lock in every station
The Lock sits between the station's equipment and the network. The equipment becomes invisible to anyone without an authorisation.
Encrypted connection to the SCADA system
The Lock in the station has an encrypted connection to a Lock at the SCADA system. Nothing is installed in the station's equipment or in the SCADA system.
Only the traffic that is needed
A policy in the XMS decides which traffic may pass between the station and the SCADA system. The stations cannot reach each other unless a policy allows it.
Works over mobile networks
XoT works over any IP network, including mobile networks. The Lock can also be installed directly in Teltonika routers.
Vendors
Give the vendor access to the right station
Without XoT
The vendor connects to the operations network over VPN. From there, many stations can often be reached. If the vendor is attacked, the attacker can reach them too.
With XoT
The vendor gets access to specific equipment for a set time. An operator can approve each connection. Everything is logged.
A service partner can run the XMS for several smaller utilities. Each utility sees only its own equipment.
Where XoT runs
Information about your sites stays with you
The XMS holds information about your equipment and your policies. Such information may be confidential or need protective security.
That is why all of XoT can run under your own control, in your own data centre or fully separated from the internet. XoT is developed in Sweden, and the XoT-S1 hardware is designed and manufactured in Sweden.
Common questions
Can we start with one pumping station?
Yes. A Lock in the station and a Lock at the SCADA system are enough to start. Then you can add more stations.
Do we have to rebuild the network?
No. The Lock sits in front of the equipment, and the equipment does not need to change.
Does XoT replace backup and manual operation?
No. Critical functions must be able to run without the network. That is work in your organisation.
Is XoT enough to comply with NIS2?
No. XoT helps with several of the measures, but the law requires more. We have gone through which ones.
What we write about laws and the security handbook is our interpretation. It is not legal advice.
Start with one station
Choose the station that is hardest to protect today.