Capabilities Behind Resilient Local Infrastructure
Across the utilities that kept service running during this summer’s attacks, four capabilities stand out. Each applies to any system a local government operates, from water and wastewater to buildings, traffic, and power.
The first is knowing what is connected. The attackers went after controllers that could be reached from the internet, often through cellular modems or remote access tools set up for convenience. Plymouth, Minnesota stopped the attack by disconnecting the cellular equipment at its towers and lift stations, which was possible because staff knew where that equipment was. Federal guidance since then has been direct: take controllers off the open internet, and where remote access is necessary, run it through a secure gateway with multifactor authentication.
The second is the ability to run things by hand. Braham’s crews had their plant back online in about two hours, Clayton County restored service within hours, and across the affected Minnesota systems, contingency procedures kicked in and most kept operating. Manual operation depends on people who know the equipment and on procedures written down somewhere other than one person’s head.
The third is partnerships that exist before they are needed. Minnesota’s response worked because the state IT agency, public safety, public health, and federal partners already had a way to come together with local utilities. That support is most useful to an agency that already knows who makes the call and who to call.
The fourth is capacity. The country has somewhere between 150,000 and 170,000 water systems, and many are small, rural, and short on cybersecurity resources. In 2024 the EPA reported that more than 70 percent of the water systems it had inspected were not fully meeting a federal requirement to maintain risk assessments and emergency response plans. In August, Senators Amy Klobuchar and Adam Schiff introduced the Water Cyber Shield Act, which would direct the EPA to assess water system cybersecurity and help municipal systems defend themselves. For most small systems today, protection rests on the knowledge of a few people and on whether those people are available when something goes wrong.
Each of these capabilities is within reach of an agency of any size. They come from knowing what is connected, writing down how to run it by hand, building relationships before an incident, and making sure more than one person can carry the response. The utilities that had them in place this summer restored service quickly, and that same readiness can be built ahead of time.
Fractional Source has partnered with Sourcewell Ventures to scale our K12 cybersecurity pilot over the next few months, providing free assessments and exercises to local governments. If you are interested, please contact us by replying to this email, or reach the Sourcewell Ventures team at [email protected].