Secure Remote Access for Water Utilities: EPA and CISA December 2024 Controls

Yes. The RRA documents the exposure. The ERP documents how you address it. Session recordings with timestamps, user attribution, and asset-specific access logs document the technical controls that close the vendor remote access finding. MFA enforcement at the gateway addresses the authentication gap. The architecture satisfies what EPA/CISA December 2024 guidance recommends and provides the documentation an ERP requires.

No binding technical mandate exists. EPA AWIA requires a risk assessment and emergency response plan but does not prescribe specific controls. EPA and CISA joint guidance (December 2024) describes recommended controls. These are not legally enforceable. Water utilities implementing the recommended controls are positioned for CIRCIA mandatory incident reporting (expected 2025-2026) and demonstrate documented good-faith compliance in any EPA inspection or post-incident review context.

Yes. The gateway deploys in 20 minutes per site without network changes to OT topology or control system configurations. Network firewall policies may require minor updates to enable the CSG connection path. One administrator manages access policies, reviews session recordings, and enforces controls across every connected facility from a single console. The operational model is designed for utilities where security management is a part-time responsibility, not a dedicated function. Supported protocols include Telnet, VNC, HTTP/HTTPS, Modbus, DNP3, and SCADA-specific legacy protocols.

The CSG operates on-premises without a cloud dependency in the access path. Local access controls are enforced whether or not the upstream connection to Centralizer is active. Session data logs locally and synchronizes when connectivity is restored. Session Hold (v5.5 feature) maintains active sessions through network interruptions without requiring reauthentication. Rural and remote facilities with intermittent connectivity are a supported architecture.

The vendor submits an access request through Centralizer. Vendor access requires explicit administrator approval before each session begins. Centralizer enforces time-limited, asset-scoped sessions. The CSG enforces session isolation: the vendor accesses the Modbus-connected dosing controller through the gateway interface. No SCADA network access beyond the authorized asset. The session is recorded with full timestamps and user attribution. Access terminates automatically at session end. No persistent vendor connection remains.

The attacker's connection attempt through an unapproved remote desktop tool would be rejected before reaching the HMI. No authorized session exists for that user through the gateway. If a vendor session were active at the time, it would be isolated: the authorized vendor sees only the assets within the scope of that session. The attacker gains no access. The session recording shows the authorized vendor's activity, and any unauthorized attempt is logged as a rejected access event. The operator no longer needs to watch for an unexpected mouse cursor.

CIRCIA will require critical infrastructure operators to report qualifying cyber incidents to CISA within defined timeframes. Final rulemaking is expected 2025-2026. Utilities with documented access controls, session recordings, and user attribution already have the forensic evidence baseline that incident reporting requires. Implementing controls now means the reporting infrastructure is in place before the mandate takes effect.

Centralizer provides centralized governance across every connected facility. One administrator manages access policies, reviews session recordings, and enforces controls for all 8 treatment plants from a single console. Each facility has a locally deployed CSG that operates independently of the others. Session Hold (v5.5) handles the intermittent connectivity that is standard across rural water infrastructure. Deploy at each facility in 20 minutes without sending an IT team.