Protect treatment, pumping and distribution without taking the plant offline. For municipal, county and regional systems across New Jersey, we secure the control systems behind every stage, from intake to tap and from collection to outfall, and watch them around the clock with Culper-I, our Early Warning System (EWS) for industrial control systems.
Water and wastewater solution briefPDF, 2 pages
Built for
A water system is not one control system. It is ten, built by different vendors in different decades and spread from the intake to the last smart meter in town. Most of them now talk to each other and to the internet. An attacker only needs one.
The highlighted system follows you as you read. Select any tag in the drawing to jump to it.
Culper-INetwork managementIncident management
Culper-IAsset management
Culper-IAccess managementIncident management
Culper-IIncident management
Culper-INetwork managementAsset management
Culper-INetwork management
Culper-IAsset managementAccess management
Culper-IIncident management
Culper-IAccess management
Culper-INetwork management
Recent attacks on U.S. water utilities went after the same systems in the drawing above. None of them needed advanced tools.
Nov 2023
Aliquippa, PA
Attackers found an internet-exposed controller at a municipal water authority, logged in with its factory default password and took over its display. Staff switched the station to manual operation.
Systems involved: Process control, Pumping & distribution
Source: CISA
Jan 2024
Muleshoe, TX
A pro-Russia group reached the town’s control system remotely and kept a tank overflowing for 30 to 45 minutes before staff took the system offline and ran it by hand.
Systems involved: Telemetry, Pumping & distribution
Source: CBS Austin
Oct 2024
American Water, Camden, NJ
Unauthorized activity on business systems forced the company to take its customer portal offline and pause billing. It reported that water and wastewater facilities were not affected.
Lesson: the office network and the plant need one plan. How we cover both
Source: The Record
Section 1433 of the Safe Drinking Water Act requires every community water system serving more than 3,300 people to assess its cybersecurity risk, plan its response, certify both to EPA and repeat the cycle every five years. EPA is enforcing it. We deliver the whole package, built from your actual plant.
“Electronic, computer, or other automated systems (including the security of such systems)”
Next certification deadline: Emergency Response Plans for systems serving 3,301 to 49,999 people.
Section 1433(a)
We inventory and assess your SCADA, PLCs, remote sites and business IT, and write the cybersecurity section of your assessment.
Section 1433(b)
We write the cyber incident procedures your operators follow to detect an attack, isolate systems and run safely in manual, then rehearse them in a tabletop exercise.
Certification
You get a package mapped to EPA’s water sector cybersecurity checklist, with the evidence an inspector will ask to see.
Every 5 years
Culper-I keeps your asset inventory and risk picture live, so the next recertification starts from real data instead of a blank page.
Why now: EPA took at least 100 enforcement actions under Section 1433 between 2020 and 2024, and attacks hit water systems in at least seven states in July 2026. Congress is weighing bills that would tighten the requirements. In New Jersey, the Water Quality Accountability Act adds its own program, reporting and insurance rules, and we cover both in one program. Source: Congressional Research Service, Aug 2026
Culper-I
Culper-I is how we protect water and wastewater plants. It watches your SCADA, PLCs and remote sites around the clock, learns what normal looks like, and warns your operators the moment something changes, before an intrusion becomes an outage or a boil-water notice.
Monitoring is passive. It listens to network traffic and never sends commands to your controllers.
Everything a utility needs to build, run and prove a cybersecurity program, sequenced so you can start small and add protection as budgets allow.
Digital Team Six is a New Jersey team. We protect water and wastewater systems of every size, from a town’s wells and lift stations to county and regional authorities with several plants and many remote sites.
Municipal water and sewer utilities
Town-run treatment plants, wells, pump stations and collection systems, often with one licensed operator on call and an integrator on contract.
County and municipal utilities authorities
Authorities that run several plants and many remote sites, with control traffic carried over radio, cellular and fiber.
Regional sewerage and water authorities
Systems that serve many towns at once, where one compromised controller can affect a whole region.
Every county, from Cranford and Jersey City
Our headquarters is in Cranford, in Union County, and our customer operations are in Jersey City, in Hudson County. One program covers the rules New Jersey systems answer to: SDWA Section 1433, the Water Quality Accountability Act and its NJCCIC incident reporting, and the MEL Deductible Reduction Groups for municipal systems. See the Compliance solution.
Requirements depend on what you treat, how many people you serve and where you operate. Here is where most New Jersey utilities land.
| Requirement | What it asks of you | What we deliver |
|---|---|---|
| Safe Drinking Water Act, Section 1433Added by America’s Water Infrastructure Act (2018). Community water systems serving more than 3,300 people. | Certify a Risk and Resilience Assessment and an Emergency Response Plan to EPA every five years. Both must address cybersecurity. Plans for systems serving 3,301 to 49,999 people are due December 31, 2026. | The cybersecurity portions of both documents, cyber incident procedures your operators can follow, and support through recertification. EPA guidance |
| NJ Water Quality Accountability ActAs amended in 2021. NJ public community water systems with more than 500 service connections. | Maintain a cybersecurity program consistent with NIST CSF, CIS Controls or ISO/IEC 27000, report cybersecurity incidents to NJCCIC promptly, and carry cybersecurity insurance. | A program built to the framework you choose, an NJCCIC reporting procedure, and the controls insurers ask about on applications. NJDEP guidance |
| EPA and CISA guidanceEvery drinking water and wastewater system. | Meet the baseline in EPA’s water sector cybersecurity checklist and CISA’s Cross-Sector Cybersecurity Performance Goals. Inspectors and insurers increasingly expect both. | An assessment against both, and a plan that closes the gaps in priority order. |
Wastewater utilities do not yet face a single federal cybersecurity mandate, but the same EPA and CISA guidance applies, and insurers now ask the same questions of both.
Still deciding? These come up in almost every first conversation.
Digital Team Six is a New Jersey cybersecurity company, headquartered in Cranford with customer operations in Jersey City. We protect water and wastewater systems across the state, from town utilities to county utilities authorities and regional sewerage authorities, and watch their control systems around the clock with Culper-I, our Early Warning System.
Yes. Our assessments and Culper-I scale from a single municipal water department to county and regional authorities that run several plants and many remote sites over radio, cellular and fiber. Each control room is set up and monitored on its own, under one program.
No. Culper-I monitoring is passive. It listens to a copy of network traffic and never sends commands to your control equipment. Any active testing happens only with your approval, in a maintenance window.
Your integrator keeps the process running. We keep it secure. We work alongside integrators every day and give them a secure, logged path for the remote support they already provide.
That is who we built this for. Start with an assessment of your asset inventory, your gaps against compliance requirements and your legacy system vulnerabilities, then build a budget plan with prioritized tasks. Crawl, walk, run.
For each control room: a day on site for discovery and two days to write the report, about two weeks of staging in our lab, then two days on site to deploy, during manned hours and with your operators and SCADA integrator.
Yes, for the cybersecurity parts of Section 1433. We complete the cyber portions of your Risk and Resilience Assessment and Emergency Response Plan, give you a package ready to certify to EPA, and keep the evidence current with Culper-I between five-year cycles.
We build your program to the NIST Cybersecurity Framework or CIS Controls, as the 2021 amendments require, set up your NJCCIC incident reporting process, and document it so you can show your work to regulators and insurers.
Our operations center sees it and confirms it. A high-severity alert, such as an outage, lost operator access or signs of compromise, reaches the operator on duty by phone and ticket within the hour, using the escalation list we agreed with you. We help your team isolate the problem and run safely in manual while we investigate.
Tell us about your utility. One of our OT engineers will walk you through how an assessment works and where we would start at your plant.
Prefer to talk now? 973-339-0090
© 2025 Digital Team Six, Inc. | Your Cyber. Our Passion.™ | Cybersecurity Solutions Specialized for Municipalities, K12, Education Sector and Non-profits.
