The National Institute of Standards and Technology has published three reference designs showing how water and wastewater utilities can enable remote access to operational technology while applying layered security controls.

Special Publication 1800-45 is a practice guide, not a regulation. The National Cybersecurity Center of Excellence built and demonstrated sample architectures in a laboratory with commercially available products and input from utilities and vendors.

Graphic shows three secure remote-access reference designs using commercial technologies.
NIST Special Publication 1800-45 documents three reference designs built with commercially available technologies.Boho News graphic from cited primary dataView source

Remote connections can let staff and contractors manage equipment without being physically present, which can improve operations and service. The same connection can expand the path an attacker or unauthorized user might try to exploit.

The designs address organizations with different sizes, resources and operational needs. NIST links remote access to functions including authentication, authorization, access control, network monitoring and risk management.

Water-sector operational technology can include pumps, valves, treatment processes, sensors and control systems. Disruptions can affect both clean-water delivery and wastewater removal, making availability and safety central design constraints.

The final publication grew from draft Technical Note 2283 and was revised after community feedback. It documents build architecture and implementation details so organizations can reproduce or adapt the examples.

Graphic lists authentication, access control, monitoring and risk management as control layers.
The guide connects authentication, access control, monitoring and risk management to remote operational-technology access.Boho News graphic from cited primary dataView source

A laboratory demonstration does not establish that every utility can deploy the design unchanged. Existing control systems, vendor support, network segmentation, staffing and local risk all affect implementation.

NIST also does not certify or endorse the commercial products used in the builds. The value of a reference design is in showing interoperable security patterns and recording how controls were assembled and tested.

For utilities, the next step is an environment-specific assessment: identify who needs remote access, restrict privileges, protect credentials, monitor sessions and test recovery without interrupting essential treatment operations.