Guide

NH water OT security. What to review now.

New Hampshire now requires water and wastewater systems with Internet-connected control systems to maintain a cybersecurity protection program sized to their environment.

6 min readSources: NH statutes, NHDES rules, NHPR

Read RSA 485:3-e
Current status

Effective June 19, 2026. Systems without Internet-connected control systems are exempt. The law directs NHDES to adopt implementing rules; check current department guidance for specific requirements. 1 2 4

If you only read one thing.

Start with the parts of the environment you can document today.

  1. Map Internet connections

    Document every external path into the control environment.

  2. Review remote access

    Know who connects, how they connect, and what they can reach.

  3. Update the asset list

    Include every device that supports plant operations.

  4. Review manual operations

    Make sure critical processes can continue without connected systems.

  5. Update the incident plan

    Review contacts, isolation steps, recovery procedures, and reporting.

  6. Track NHDES

    Update the program as the department publishes new requirements.

01 · What to review now

Start with your systems and obligations.

SB 589 created cybersecurity requirements for covered public water systems and wastewater facilities. 1 2

  1. Check whether you are covered

    For wastewater, RSA 485-A:5-f covers wastewater treatment plants and wastewater facilities without limiting coverage to public ownership. That can include private facilities handling industrial waste. Facilities without Internet-connected control systems are exempt; confirm how the statutory definitions apply to your operation.

  2. Maintain a security program

    Covered systems need a cybersecurity protection program.

  3. Match it to your system

    The program must reflect the size and complexity of the environment.

  4. Track the NHDES rules

    Check current NHDES rules and guidance for implementation details.

02 · Paths to the Internet

Start with every path to the Internet.

Trace how operational systems connect outside the facility. Include direct connections, remote access, cellular devices, and vendor equipment.

Operational systems
SCADA servers, HMIs, engineering workstations, and other systems used to operate the plant.
Connected equipment
Gateways, telemetry, switches, radios, cellular devices, and vendor appliances.
Remote access
VPNs, vendor services, remote support tools, and other outside connections.
Internet connection
Document which operational systems ultimately have a path to the Internet.

03 · Who can reach your systems

Know who can reach your systems.

List every employee, vendor, integrator, MSP, and manufacturer with remote access.

For every connection, know

  • Who can connect
  • How they connect
  • Which systems they can reach
  • Who approves the access
  • Whether access stays enabled
  • How quickly it can be shut off

Include

  • Operators and internal staff
  • Controls integrators
  • Equipment vendors
  • Managed service providers
  • Equipment manufacturers
  • Other remote support providers

Know what is actually on the network.

Do not stop at the SCADA server. Know every device that supports operations and how it connects.

Workstations
Operator, engineering, maintenance, and other computers used to support operations.
Network equipment
Switches, gateways, firewalls, and remote-access appliances.
Remote devices
Radios, cellular equipment, telemetry, and connections between sites.
Vendor and legacy systems
Vendor appliances, embedded systems, older equipment, and devices missing from the IT inventory.

04 · Keep operating

Know how you will keep operating.

Plan for what happens when a connected system is unavailable or cannot be trusted.

  1. Identify manual processes

    Know which operations can continue manually.

  2. Identify critical systems

    Know which systems must remain available to keep the plant running.

  3. Define isolation authority

    Know what can be disconnected and who can make that call.

  4. Plan restoration

    Know how critical systems and processes will be brought back.

Update the emergency plan too.

Community drinking water systems already have cyber-response requirements under Env-Dw 503.24. 3

Isolate
Disconnect affected computers when needed.
Assess
Determine the operational impact.
Operate manually
Move critical processes to manual operation when required.
Restore
Bring critical processes back safely.
Document
Record the response and what happened.

05 · Know what happened

Know what happened when something goes wrong.

You need enough evidence to understand the activity and determine what was affected.

  • Communication: which systems talked to each other?
  • Origin: where did the connection come from?
  • Reach: which systems were touched?
  • Change: what changed?
  • Sequence: what happened before and after?
  • Evidence: what can be preserved?
Two kinds of evidence

Network visibility shows where activity moved. Forensics reconstructs the event and determines its scope.

06 · Confirmed vs. pending

The law is in effect. Check current implementation rules.

The statute establishes the cybersecurity protection requirement and directs NHDES to adopt rules for wastewater facilities. Check the latest department guidance before relying on any technical or documentation requirements. 4

Already confirmed

  • Effective June 19, 2026
  • Public water systems are covered under RSA 485:3-e
  • Wastewater facilities are covered under RSA 485-A:5-f
  • Systems without Internet-connected controls are exempt
  • The program must fit the size and complexity of the system

Details to verify

  • Technical expectations
  • Required documentation
  • How systems show compliance
  • Implementation timelines
  • How requirements scale by system
Read the NHPR report

Know what is connected before something happens.

Talk with our team about seeing the activity, preserving the evidence, and understanding the scope.

Talk to our team

07 · Where CrunchAtlas fits

Where CrunchAtlas fits.

CrunchAtlas passively monitors network activity and supports evidence-backed investigation across IT and OT environments. It does not independently establish compliance. Coverage depends on deployment scope and available telemetry, and consequential actions remain operator controlled.

Network Detection and Response

See network activity across monitored IT and OT environments without actively probing operational systems.

Host and Network Forensics

Reconstruct what happened and determine which systems were affected.

Incident Reporting

Preserve the timeline, evidence, affected systems, verdict, and next actions.

08 · FAQ

NH water OT security, answered.

Does this apply if our control systems are not connected to the Internet?

The statutes exempt systems that do not use an Internet-connected control system.

When did the requirement take effect?

June 19, 2026.

How are implementation details established?

The law directs NHDES to adopt implementing rules. Check current NHDES rules and guidance for requirements applicable to your facility.

Does the law require a specific cybersecurity product?

The statute names no specific commercial product.

09 · Sources

Sources.

Primary statutes, existing drinking-water emergency-planning rules, and September 2026 reporting on NHDES rulemaking.

  1. New Hampshire RSA 485:3-e
  2. New Hampshire RSA 485-A:5-f
  3. New Hampshire Env-Dw 503.24
  4. New Hampshire Public Radio and New Hampshire Bulletin, September 5, 2026

Keep reading.

Small water systems

Who owns each security duty.

Water system cyberattacks

What operators should check now.

Water and wastewater

Passive detection and investigated cases for plants.

Know every path into your plant.

Talk with our team about how AtlasCyber watches what is connected, without touching your PLCs.

Talk to our teamSign up for our newsletter