Securing Municipal Networks: Lessons From the FBI’s Water-System Alert

A network incident can interrupt a physical service

The FBI and EPA’s July 30, 2026 alert describes cyberattacks against internet-facing programmable logic controllers used in water and wastewater operations. Attackers changed device IP addresses and passwords, disrupting monitoring and control. The alert identifies certain Rockwell Automation/Allen-Bradley controllers and recommends that operators also consider the exposure of other controller brands.

For Michigan townships, villages, and cities, the practical question extends beyond the office computers: which connections can reach systems that support essential services? Operational technology, or OT, monitors or controls physical processes. If your municipality operates water or wastewater infrastructure, bring its operations lead, IT provider, and control-system vendor into the same review. Each needs to understand the connections and the service consequences.

Include field sites and cellular connections in the inventory

The joint CISA, EPA, and FBI water-system guidance recommends inventorying both IT and OT assets. Begin with the sites and services your municipality operates, then identify the equipment and connections supporting them. Record the device model, purpose, location, responsible operator, supporting vendor, and available manufacturer support. Keep the technical details in an approved location accessible to the responsible team.

For a hypothetical village, the review might include the hall’s office network, a utility control workstation, and a remote lift station. Ask how each site connects and whether a vendor-installed cellular modem creates a separate access path. Do not assume that reviewing the hall’s main firewall covers every remote site. Have the technical team reconcile diagrams, vendor records, and actual configurations through an assessment appropriate to operating equipment.

Replace direct controller exposure with controlled access

The FBI alert recommends removing PLCs from direct public internet exposure. The joint secure-connectivity guidance explains using a brokered connection through a secure gateway in a separate controlled network segment when external parties need access. Ask your qualified technical team to identify exposed interfaces and document the approved route for remote maintenance, including how it is authenticated, monitored, and maintained.

Make this an operations-approved engineering change. Removing an existing connection can affect monitoring, alarms, or a vendor’s ability to support the site. Agree on the service impact, change window, validation steps, and recovery procedure with the operator and control-system vendor before implementation. Municipal staff can request the review and track its completion; controller and network changes belong with the authorized specialists responsible for safe operation.

Verify the boundary between office work and operations

The secure-connectivity guidance identifies network segmentation and restricted communication as important OT boundary controls. Have IT and the operations team identify which systems genuinely need to exchange information and through what approved path. Ask how unnecessary access from office, guest, and other connected networks is prevented. A diagram should explain the intended boundaries, while the assessment verifies that the configuration enforces them.

Define the direction, purpose, and owner of each necessary connection. For example, staff may need an approved reporting view without needing direct access to controller administration. Have the specialists design the appropriate arrangement and validate the operational workflow after a change. Keep the resulting rules and connection map with the support records so a later installation does not quietly bypass the boundary.

Give vendor access an owner and a review process

Ask which vendor and municipal accounts can reach each operational system, what each account can do, and who approves access. The joint water-system guidance calls for replacing default or insecure passwords with strong, unique credentials and using multifactor authentication where possible. Have the provider explain how the supported authentication controls fit the devices and remote-access gateway in your environment.

The OT boundary guidance also recommends limiting privileges and applying security requirements to third parties. Record the approved vendor access path and how access changes when a contract, technician, or municipal role changes. Identify who reviews remote connections and relevant logs. Include gateway and modem maintenance in the responsibility list, alongside a replacement or isolation plan for unsupported equipment.

Plan recovery with the people who operate the service

The joint water-system guidance recommends incident-response planning and backups that support a known, safe recovery state. Ask the operations lead and control-system vendor how approved configurations are preserved, who can validate them, and what is needed to recover a site. Agree on the contact path for unexpected configuration changes, lost monitoring, or suspicious remote activity before an incident occurs.

Practice the coordination through a discussion exercise and arrange any live operational testing through the responsible specialists. The FBI alert emphasizes safe manual operation and checking controller project files for unauthorized changes; it also says backups must be checked for malicious logic before deployment. Ask the vendor how those checks and any manual fallback are performed safely for the particular process. Track missing contacts, documentation, or recovery capabilities as assigned actions.

Turn the alert into an assigned network review

Managed IT in Michigan should include a clear conversation about the systems and vendors around the office network. Use your next Michigan IT services review to identify the operations owners needed to answer these questions.

• Have all relevant sites, controllers, gateways, and cellular paths been identified?
• Has the qualified team checked for direct internet exposure?
• Are office, guest, and operational network boundaries verified?
• Are vendor access, credentials, and supported authentication controls documented?
• Who maintains boundary devices and plans for unsupported equipment?
• Can operators reach the response team and validate safe recovery procedures?