> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/regulatory-framework-mappings/awwa-security-guidance/process-control-system-security-guidance-for-the-water-sector-witaf-503.md). # WITAF #503 ## Remote Access & Process Control System Security Guidance for the Water Sector ### To get Dispel's complete mapping, download our document here: {% file src="/files/-MXhC8ZCz7LHfHKauWVc" %} Download {% endfile %} ![](https://2668873066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LqlTpechIfonX0FqSV8%2F-MXhByA0NgCmYLoeUE56%2F-MXhCMcn6kfVEM-AwPJq%2FScreenshot%202021-04-07%20104052.png?alt=media\&token=b7f5833a-c20b-4130-a804-29118dc25a7f) ### Introduction The American Water Works Association’s *Process Control System Security Guidance for the Water Sector* (WITAF #503, shortened here to **Security Guidance**) provides a guide for members of the water industry seeking voluntary adoption of the NIST Cybersecurity Framework (**CSF**) and adherence to Executive Order 13636 *Improving Critical Infrastructure Cybersecurity*. The Water Sector Coordinating Council, the USEPA and NIST have recognized the AWWA *Security Guidance* as the foundation of a voluntary, sector-specific approach to implementing the NIST Cybersecurity Framework. Released by the American Water Works Association (**AWWA**) in early 2014, *Security Guidance* was designed to make the NIST CSF’s complete—but highly generalized—framework actionable for water utility chief information security officers, general managers, and utility directors seeking to reduce vulnerabilities in process control systems. ### How it works The Security Guidance focuses on how a utility uses their process control systems. Acting as a guided tool, the result provides a means of self-evaluating for how a utility could better manage cyber risks. Covering 82 cybersecurity controls, Security Guidance determines under which circumstances a utility might need to implement new cybersecurity practices and technologies. Risks are priorities on a severity scale of 1-4—where a 1 denotes immediate action necessary, while a 4 means an issue is important, but not critical. ### What *Security Guidance* is not The AWWA designed *Security Guidance* to help the water sector adopt the NIST CSF through water-industry specific courses of action. The *Guidance* is not itself a cybersecurity framework. For those interested in water security frameworks, there exists the ANSI/AWWA G430-14 *Security Practices for Operations & Management*, ANSI/AWWA J100-10(R13) *Risk & Resilience Management of Water & Wastewater Systems*, and ANSI/AWWA G440-11 *Emergency Preparedness Practices*. In addition to adopting the NIST CSF, water and wastewater utilities must also address §2013 of *America’s Water Infrastructure Act* (AWIA) of 2018. The U.S. Environmental Protection Agency (EPA) also provides two resources: the [Drinking Water or Wastewater Utility Risk Assessment Vulnerability Self-Assessment Tool](https://www.epa.gov/waterriskassessment/conduct-drinking-water-or-wastewater-utility-risk-assessment) (VSAT), and the [Water Health and Economic Analysis Tool](https://www.epa.gov/waterriskassessment/find-out-about-health-and-economic-impacts-water-utility-emergencies) (WHEAT). ### Security Guidance sections There are 12 areas referred to as “Practice Categories” covered in the *Security Guidance*. The descriptions below are taken directly from the *Security Guidance*: #### **1. Governance and Risk Management** This category is concerned with the management and executive control of the security systems of the organization; it is associated with defining organizational boundaries and establishing a framework of security policies, procedures, and systems to manage the confidentiality, integrity, and availability (CIA) of the organization. One of the key components of system governance is developing and maintaining an accurate, up-to date inventory of PCS components. From the perspective of long-term security, this is the most important category because it creates a managed process for increasing security. It also engages the executive team by including security risks as an important part of the management of the enterprise. Although this category of recommendations represents an essential part of an organization’s security posture, the related cybersecurity controls have been assigned a slightly lower priority in order to emphasize actionable recommendations that can have significant short-term effects. #### **2. Business Continuity and Disaster Recovery** This category is concerned with ensuring that the control system continues running even when faults occur and with fast recovery after disruptions in service. Business Continuity Planning is a structured method for an organization to prepare for and reduce the probability and impact of systems and operational failure. A key component of Business Continuity Planning is the Disaster Recovery Plan, which deals with longer disruptions from more impactful events. Both plans require a managed process that identifies potentially disruptive events, estimates their impact, and then develops and monitors mitigation strategies. #### **3. Server and Workstation Hardening** This category is concerned with securing servers and workstations against cyber-attacks; it identifies best practices to minimize the probability 4 of unauthorized access to servers, and to maintain the CIA properties of the servers and the systems within them. For example, this category includes whitelisting which restricts the applications that are allowed to run in servers and workstations throughout the enterprise. #### **4. Access Control** This category is concerned with ensuring that only authorized personnel can access computing resources within the organization; it pertains to best practices for restricting access to computing resources and information to authorized users. For example, Single Sign On (SSN) is an access control mechanism that requires users to sign on only once; the SSN system can then use those credentials to control access to a variety of applications. However, care should be taken to ensure that different passwords are used to access PCS systems that those used to access enterprise systems. #### **5. Application Security** This category is concerned with ensuring that computer programs do only what they are supposed to do; for example, suppose that a module of a SCADA system is supposed to receive data from a PLC and save it. Application security contains best practices to ensure that the module is not susceptible to buffer-overflow attacks and that the data it receives does not get corrupted as it is handled by the module. Application Security is a complex and extensive area involving the design, implementation, and testing of program modules as well as the testing and monitoring of integrated systems after implementation. Utilities should develop standard design and implementation requirements that define the testing required by software vendors and system integrators, as well as doing their own testing of the integrity of results. #### **6. Encryption** This category is concerned with ensuring that only appropriate encryption schemes are used within an organization’s security systems and that the cryptography is used wherever it is needed. For example, there is general confusion of what is an appropriate encryption scheme: sometimes packing or compression algorithms are called encryption. Also, cryptographic systems must be used wherever they are needed, for example, if the data will be traveling on a public channel or via a wireless circuit, or if there is a need to provide non-repudiation of a message or a document (by using a cryptographic signature). Weak encryption schemes are particularly dangerous because they provide little protection and create a false sense of security and complacency. Proprietary encryption schemes should be avoided since they typically have not gone through comprehensive testing and often contain flaws. Also, only encryption schemes that are referenced by appropriate standards and use keys of proper length should be considered secure. #### **7. Telecommunications, Network Security, and Architecture** This category is concerned with the security of the network infrastructure from the data connector on the wall to the enterprise switches, routers, and firewalls. This includes the physical security of the cables, the telecom closets, and the computer rooms and the protection of the data as it travels on public channels and wireless circuits. Spam filtering and website blocking are also included in this category. The focus of this category is establishing a layered defense architecture with the PCS network at its core. It also addresses adherence to new standards for PCS network security, particularly network topology requirements within the vicinity of PCS systems and PLC controls. Another area addressed in this category is network management, including port level security. #### **8. Physical Security of PCS Equipment** Physical security is a basic requirement for all PCS Systems. Once physical access to a network device or server is achieved, compromising equipment or systems is usually a trivial matter. The recommended practices in this category focus 5 on preventing and restricting physical access to only authorized personnel with a need to perform some action on the hardware. The recommendations in this group are also related to monitoring, detecting, and responding to unauthorized physical access. #### **9. Service Level Agreements (SLA)** This category is concerned with the definition and management of contracts that specify services requirements to the organization. The contract manager under the direction of the executive team is responsible to define, negotiate, execute, and monitor these contracts to ensure appropriate service delivery to the organization. An SLA is a contract which requires minimum levels of performance for services provided. For example, the Committed Information Rate (CIR) is part of a typical Wide-Area Network (WAN) services SLA and specifies the minimum bandwidth that a data circuit may have. SLAs for PCS network systems typically focus on quality of service (QoS) rather than bandwidth. PCS systems do not require high bandwidth but cannot operate properly if the bandwidth falls below certain known thresholds. #### **10. Operations Security (OPSEC)** OPSEC is concerned with refining operational procedures and workflows to increase the security properties (CIA) of an organization. For example, a utility may want to restrict what employees post on their Facebook pages about the organization’s security procedures. OPSEC also includes access granting policies and procedures, security guard rotation schedules, backup recovery procedures, etc. #### **11. Education** This category is concerned with bringing security awareness to the employees, clients, and service providers of the organization. Education involves identifying best practices and providing formal training on the security policies and procedures of the enterprise as well as security awareness and incident response. It involves test practice of the key security processes and actions to ensure quick and accurate response to security incidents within the enterprise. #### **12. Personnel Security** This category is concerned with the personal safety of employees, clients, contractors, and the general public. Personnel security starts as part of the hiring process and ends after the employee leaves the organization. It handles periodic reaccreditation of employees and updates of the policies and procedures that govern staff. The purpose of personnel security is to ensure the safety and integrity of staff within the organization. Personnel security also applies to external contractors and service personnel, with the objective to ensure appropriate, lower privileged access to facilities. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.dispel.com/regulatory-framework-mappings/awwa-security-guidance/process-control-system-security-guidance-for-the-water-sector-witaf-503.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.