Build a water-utility cybersecurity incident response plan (CIRP) by adapting EPA’s April 2025 template to your actual IT and operational technology (OT), assigning decision-makers, documenting safe continuity procedures, and practicing the plan with staff and partners. The CIRP should supplement—not replace—the utility’s emergency response plan (ERP).
How do I build a cybersecurity incident response plan for a water utility?
Start with the U.S. Environmental Protection Agency’s Cybersecurity Planning resources, including its April 2025 Drinking Water and Wastewater Systems Cybersecurity Incident Response Plan Template Instructions. The template is a customizable starting point, not a finished plan or a guarantee of compliance or readiness. Adapt it to the systems, staffing, hazards, procedures, and requirements of your utility.
EPA defines a CIRP as the utility’s strategies, resources, plans, and procedures for preparing for and responding to a cybersecurity incident that threatens life, property, or the environment. It supplements the ERP, so the two plans should fit together rather than give staff conflicting instructions.
- Download and adapt the EPA template. Use the template and instructions as a working structure; replace generic entries with your utility’s names, contacts, systems, authorities, and procedures.
- Gather the material the plan must reflect. Bring together your risk and resilience assessment (RRA), ERP, communications plan, mission-critical system inventory, network diagrams, configuration records, incident procedures, and relevant contracts or vendor arrangements.
- Identify local requirements and dependencies. Check applicable state and local requirements, including privacy-related obligations where relevant. Confirm in advance how IT, OT, communications, and other contractors will support response and recovery.
- Assign authority and responsibilities. Name the incident-response lead, internal reporting path, decision-makers, and the people responsible for operations, IT, OT, leadership, communications, legal, and compliance functions as appropriate to the utility.
- Write response and continuity procedures. Define how staff will detect and report a suspected incident, assess operational and safety impacts, escalate decisions, communicate, preserve records, and coordinate restoration. Set out safe manual or alternate procedures for critical functions if OT is unavailable or cannot be trusted.
- Prepare external contacts and notifications. Maintain current contacts for relevant government, law-enforcement, state, National Guard cyber, mutual-aid, vendor, and emergency partners. Identify who determines whether notifications are required and who makes them.
- Exercise, learn, and revise. Run a discussion-based exercise and, where appropriate, an operational drill. Include relevant staff and external partners, record gaps, and update procedures and contacts as the utility’s systems and risks change.
What should the plan be based on?
A useful CIRP reflects the utility’s actual risk and operating environment. Use RRA findings to identify likely consequences and countermeasures, then connect those findings to systems, roles, and response actions. EPA also identifies a free cybersecurity evaluation program as an optional planning resource in its template instructions.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Keep the plan aligned with the documents and people responders will need during an incident:
- Operational references: inventories of business, process-control, and communications systems; network diagrams; configuration settings; and procedures for critical processes.
- Emergency and communications plans: the ERP and communications plan, including how cybersecurity response connects to emergency management and public messaging.
- Vendor and contractor arrangements: points of contact, support responsibilities, and coordination expectations for IT, OT, and other service providers.
- Applicable obligations: state and local requirements, relevant contracts, and privacy-related duties. Reporting obligations can vary by jurisdiction and incident; do not assume one deadline applies to every event.
EPA’s Cybersecurity Planning page says community water systems serving 3,301 or more people must certify completion of an RRA and ERP under SDWA section 1433, as amended by AWIA section 2013. EPA says smaller community systems, non-community systems, and wastewater systems are not required to certify under that provision, while encouraging them to plan. Covered systems should coordinate with local emergency planning committees to the extent possible and retain RRA and ERP copies for five years after certification. EPA does not require a particular third-party standard, method, or tool for the statutory RRA and ERP, but the system remains responsible for meeting the law’s requirements. Verify the rules that apply to your utility rather than treating this summary or the CIRP template as legal advice.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Who needs a role in the response?
List people by name and role, with alternates for essential responsibilities. The plan should make clear who can declare or escalate an incident, who can approve operational changes, and how staff report suspected problems. A contact list alone is not enough if responders do not know who has authority to make safety-critical decisions.
- Incident-response lead: coordinates the response, maintains the incident record, and ensures decisions are escalated to the right authority.
- Operations and OT staff: assess process impacts and determine, with the relevant decision-makers, what is safe to operate, isolate, or shift to an alternate procedure.
- IT and cybersecurity support: investigate affected business and communications systems and coordinate with OT staff before actions that could affect operations.
- Utility leadership: provides decision authority, resources, and coordination with emergency management and governing bodies as needed.
- Communications, legal, and compliance roles: coordinate internal and external messages and evaluate notification duties for the specific incident.
- Contractors and response partners: provide agreed technical support and coordination; record how to reach them if normal systems are disrupted.
EPA’s Water Sector Incident Action Checklist – Cybersecurity prompts utilities to identify system operators, keep emergency contacts current, and train essential staff to perform critical functions.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
What should responders do during an incident?
Write a response sequence that fits your utility’s process-control environment and safety needs. EPA recommends written procedures for scenarios including disabled or manipulated process-control systems, loss or theft of operational or financial data, and exposure of sensitive information. The plan should tell staff how to coordinate and make decisions; it should not prescribe a universal technical containment step that may be unsafe for a particular system.
- Detect and report. Specify what staff should report, how to reach the response lead if normal communications are affected, and what information to capture without delaying actions needed to protect people or operations.
- Triage operational impact. Identify the relevant operators and decision-makers. Assess which business, process-control, and communications systems may be affected, whether process information can be trusted, and what immediate operational or public-safety concerns exist.
- Escalate and coordinate. Use the written authority structure to involve operations, IT, OT, leadership, contractors, and emergency partners. Make clear who approves technical or operational changes that could affect treatment, storage, collection, or conveyance.
- Contain and maintain safe service. Follow utility-specific procedures for limiting harm and continuing critical functions. If OT is unavailable or untrusted, use only the manual or alternate operating procedures developed and practiced for that process.
- Make notifications as applicable. Consult the plan’s contact list and determine obligations based on the incident, jurisdiction, contracts, and applicable rules. EPA’s checklist names CISA’s incident-reporting channel and 1-844-Say-CISA (1-844-729-2472), and recommends recording relevant FBI, state, National Guard cyber, and mutual-aid contacts.
- Document decisions, actions, and costs. Start an incident record as response begins. Log decisions, actions, costs, receipts, records, photographs, and staff time; EPA notes that these records may help justify costs and support a possible insurance claim.
- Restore and review. Define who coordinates recovery and how return to normal operations is authorized. Afterward, capture lessons and update the plan and procedures to address identified gaps.
How can a water utility keep operating if its process-control systems are compromised?
Decide in advance which mission-critical functions can continue safely if automated control is unavailable or cannot be trusted. EPA’s checklist calls for identifying critical business, process-control, and communications systems, while its instructions and cybersecurity guidance recommend planning for manual operations and training essential staff.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
For each critical function—such as collection, storage, treatment, or conveyance—document the applicable alternate procedure, who is trained and authorized to perform it, how operators will communicate, and what conditions require escalation. The safe method depends on the utility’s processes and equipment; do not assume a manual workaround is suitable simply because it is possible. Practice the procedure with the staff who would use it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should a utility exercise and maintain the plan?
Use exercises to test decisions and coordination, not just whether a document exists. EPA recommends developing, practicing, and updating an incident response plan for cyber incidents that could affect water and wastewater operations in its Factsheet 2.S: Protect—Incident Response (IR) Plans.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
| Exercise type | What it tests | Useful participants |
|---|---|---|
| Tabletop exercise | Discussion of roles, escalation, decisions, communications, and coordination during a scenario. | Leadership, operations, IT/OT, communications, legal or compliance staff, vendors, and response partners as available. |
| Operational drill | Whether people can carry out selected procedures, such as reporting, contact-tree activation, or an appropriate alternate operating procedure. | Staff assigned to the procedure and any partner whose coordination is necessary. |
EPA’s instructions point to free exercise resources from EPA and CISA. CISA’s listed scenarios include ransomware, insider threats, phishing, and industrial-control-system compromise. After each exercise, record what worked, where decisions or contacts were unclear, and which procedures need revision. Set a review cadence that fits your utility’s change and risk processes, and revisit the plan when systems, vendors, staffing, or requirements change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
