Timehri Networks OT Resilience Series

By Franklyn C. Adams, Timehri Networks

When SCADA becomes unavailable, the responsibility to deliver safe drinking water and manage wastewater continues. A continuity of service plan turns that responsibility into clear decisions, assigned duties, and workable procedures.

A cyber incident, prolonged power outage, communications failure, storm, or loss of key personnel can disrupt normal operations. The immediate questions are practical: Which services must continue? What can operators safely do with the systems still available? How long can those arrangements last?

A useful continuity document answers those questions before an incident. Regular exercises establish whether its answers work.

Define the service that must continue

For this article, a continuity of service plan means the operational document describing how a utility will sustain essential services during disruption and return to normal operations. It may be a standalone plan or an annex to an existing emergency response or continuity of operations plan.

Figure 1 — How the Three Plans Work Together

This article complements Responding with Confidence: Creating and Exercising an OT Incident Response Plan and Restoring Trusted Operations: Creating and Testing an OT Disaster Recovery Plan. Incident response coordinates the assessment, containment, and management of an event. Disaster recovery restores affected technology and infrastructure to trusted operation. Continuity of service establishes how the utility will sustain essential treatment, pumping, collection, and distribution functions while those activities take place. The three plans work together and may be activated concurrently under coordinated leadership.

EPA provides emergency response planning templates for drinking water and wastewater utilities. These offer a foundation for aligning continuity procedures with the utility’s broader emergency arrangements.

Build the document around operational decisions

1. Identify essential functions and dependencies

Start with the services the community depends on, then identify the people, equipment, supplies, and information needed to sustain them. Examples include disinfection, critical pumping, reservoir monitoring, wastewater conveyance, laboratory testing, and emergency communications.

Map dependencies such as electricity, fuel, chemicals, telecommunications, remote sites, contractors, and suppliers. Include shared dependencies: a backup system may still rely on the same power source, network equipment, or authentication service as the primary system.

2. Establish minimum service levels and time limits

Document the minimum acceptable operating condition for each essential function and how long degraded operation can remain safe. Determine these limits with operations, engineering, and compliance personnel using actual process conditions.

Distinguish the maximum tolerable interruption from the target time to restore a system. A SCADA recovery target does not establish how long a treatment process can safely operate without reliable monitoring. Record the evidence and assumptions behind both.

3. Assign authority and alternates

Name the roles authorized to activate the plan, dispatch staff, approve operating changes, request mutual aid, and authorize restoration. Assign alternates and define shift handovers. Coordinate operations, OT, IT, management, safety, and communications responsibilities so that technical containment decisions account for process consequences.

4. Write usable procedures for degraded operation

Replace statements such as “operate manually” with approved, site-specific instructions. Identify required staffing, local readings, monitoring intervals, records, operating limits, escalation triggers, and stop conditions. State which tasks require personnel at remote sites and how they will communicate.

Manual operation is not automatically safe or available. Loss of trusted instrumentation, alarms, interlocks, or adequate staffing may require a controlled shutdown, service restriction, or an alternative supply arrangement. Document those decisions explicitly.

Figure 2 — Continuity of Service Decision Flow

5. Document resources, communications, and recovery

Record generator and fuel arrangements, chemical reserves, critical spares, vendor support, mutual aid contacts, and alternative communications. Identify how staff will retrieve approved procedures and essential records if email, internet access, or the normal document repository is unavailable.

Include recovery priorities, protected backups of relevant configurations, and a process for verifying restored systems. Define who confirms process conditions, validates critical settings and alarms, and approves the return to normal control. Restoration is complete when operations are verified, not simply when a server starts.

6. Make the document usable during an emergency

Place activation criteria, immediate actions, authority, and contact details at the front. Keep detailed procedures in controlled annexes. Assign an owner, approver, version, and review date. Maintain accessible offline copies while protecting sensitive diagrams, access information, and recovery material. Do not place passwords in broadly distributed copies.

How often should the plan be exercised?

Timehri Networks recommends a coordinated continuity exercise at least annually, supported by quarterly readiness checks and focused drills every six months. This is a recommended planning baseline, not a universal regulatory requirement. Adjust it for service criticality, staffing, system changes, prior findings, and applicable regulatory or contractual obligations.

Frequency	Activity	What it should establish
Quarterly	Readiness checks and short walkthroughs	Contacts, alternates, offline procedures, communications, and resource arrangements remain usable.
Every six months	Focused drill or tabletop	A selected capability works, such as loss-of-SCADA coordination, shift handover, or restoration of a backup in an isolated environment.
At least annually	Coordinated exercise involving operations, OT, IT, and management	Teams can activate the plan, sustain priority services, coordinate decisions, and define safe recovery.
After significant changes or incidents	Targeted review and exercise	Changed procedures and corrective actions work before staff rely on them.

Figure 3 — Continuity Exercise Cycle

A document review is not an exercise. A tabletop tests decisions through discussion; a functional drill demonstrates selected actions. An annual tabletop should therefore be complemented by practical verification of critical capabilities. Broader operational exercises should be scheduled according to risk and readiness, with clear controls to protect live processes. Review and approve the complete document at least annually and update affected sections whenever conditions change.

Figure 4 — A Document Review is not an Exercise

The joint CISA, EPA, and FBI guidance on securing water systems identifies developing and exercising cybersecurity incident response and recovery plans as a priority. EPA’s water resilience tabletop exercise resources can help utilities plan, conduct, and evaluate their own scenarios.

Exercise the loss of a capability

Consider a scenario in which SCADA displays stop updating, remote communications are unreliable, and the on-call integrator is unavailable. Local equipment may still be running, but operators cannot assume displayed values are current.

Ask participants to demonstrate how they would:

Recognize the loss of trustworthy information and activate the appropriate procedures.
Verify conditions through approved independent means and prioritize site visits.
Allocate qualified personnel while sustaining essential functions across shifts.
Communicate with management, emergency partners, regulators, and customers when required.
Decide when degraded operation is no longer sustainable and authorize safe recovery.

Set measurable objectives before starting. Record time to activation, successful contact attempts, retrieval of offline procedures, staffing gaps, and whether decisions respect approved operating limits. Simulate disruptive actions or use isolated test environments; any work on live systems needs operational approval, abort criteria, and a recovery path.

Turn findings into improvements

Hold a debrief immediately after the exercise. Produce an after-action record with each finding, its service consequence, an accountable owner, a completion date, and the evidence needed to close it. Update the document, brief affected staff, and retest significant weaknesses.

For example, discovering that only one employee can retrieve a controller backup is an operational dependency. Closing that finding means authorizing and training an alternate, then demonstrating successful retrieval and restoration in a suitable test environment.

A continuity document earns its value when the people responsible for water and wastewater services can use it under pressure. Build it around essential functions, exercise it regularly, and use the results to improve the utility’s ability to sustain safe service.

Sources & Further Reading

Timehri Networks
OT Cybersecurity • Critical Infrastructure