NH Water OT Security Requirements

New Hampshire now requires water and wastewater systems with Internet-connected control systems to maintain a cybersecurity protection program sized to their environment.

Request a Demo See What Changed ↓

Effective June 19, 2026. Systems without Internet-connected control systems are exempt. NHDES is developing implementation rules.

Start with what the law requires.

SB 589 created cybersecurity requirements for covered public water systems and wastewater facilities.

01

Check whether you are covered

The requirement applies when the system uses Internet-connected control systems.

02

Maintain a security program

Covered systems need a cybersecurity protection program.

03

Match it to your system

The program must reflect the size and complexity of the environment.

04

Track the NHDES rules

NHDES is still defining the implementation details.

Start with every path to the Internet.

Trace how operational systems connect outside the facility. Include direct connections, remote access, cellular devices, and vendor equipment.

Operational Systems

SCADA servers, HMIs, engineering workstations, and other systems used to operate the plant.

Connected Equipment

Gateways, telemetry, switches, radios, cellular devices, and vendor appliances.

Remote Access

VPNs, vendor services, remote support tools, and other outside connections.

Internet Connection

Document which operational systems ultimately have a path to the Internet.

Know who can reach your systems.

List every employee, vendor, integrator, MSP, and manufacturer with remote access.

For every connection, know:

Who can connect
How they connect
Which systems they can reach
Who approves the access
Whether access stays enabled
How quickly it can be shut off

Include:

Operators and internal staff
Controls integrators
Equipment vendors
Managed service providers
Equipment manufacturers
Other remote support providers

Know what is actually on the network.

Do not stop at the SCADA server. Know every device that supports operations and how it connects.

Workstations

Operator, engineering, maintenance, and other computers used to support operations.

Network Equipment

Switches, gateways, firewalls, and remote-access appliances.

Remote Devices

Radios, cellular equipment, telemetry, and connections between sites.

Vendor & Legacy Systems

Vendor appliances, embedded systems, older equipment, and devices missing from the IT inventory.

Know how you will keep operating.

Plan for what happens when a connected system is unavailable or cannot be trusted.

01

Identify manual processes

Know which operations can continue manually.

02

Identify critical systems

Know which systems must remain available to keep the plant running.

03

Define isolation authority

Know what can be disconnected and who can make that call.

04

Plan restoration

Know how critical systems and processes will be brought back.

Update the emergency plan too.

Community drinking water systems already have cyber-response requirements under Env-Dw 503.24.

Isolate

Disconnect affected computers when needed.

Assess

Determine the operational impact.

Operate manually

Move critical processes to manual operation when required.

Restore

Bring critical processes back safely.

Document

Record the response and what happened.

Know what happened when something goes wrong.

You need enough evidence to understand the activity and determine what was affected.

Communication: Which systems talked to each other?

Origin: Where did the connection come from?

Reach: Which systems were touched?

Change: What changed?

Sequence: What happened before and after?

Evidence: What can be preserved?

Network visibility shows where activity moved. Forensics helps reconstruct the event and determine its scope.

Network Detection & Response → Host & Network Forensics →

The requirement is in effect while NHDES defines implementation.

The law establishes the security-program requirement. NHDES is still defining how covered systems will implement and document it.

Already confirmed

Effective June 19, 2026
Public water systems are covered under RSA 485:3-e
Wastewater facilities are covered under RSA 485-A:5-f
Systems without Internet-connected controls are exempt
The program must fit the size and complexity of the system

Still being defined

Technical expectations
Required documentation
How systems show compliance
Implementation timelines
How requirements scale by system

NHDES began rulemaking in September 2026. Track proposed rules and guidance as they are released.

Read the NHPR Report ↗

What should operators do now?

Start with the parts of the environment you can document today.

Map Internet connections. Document every external path into the control environment.

Review remote access. Know who connects, how they connect, and what they can reach.

Update the asset list. Include every device that supports plant operations.

Review manual operations. Make sure critical processes can continue without connected systems.

Update the incident plan. Review contacts, isolation steps, recovery procedures, and reporting.

Track NHDES. Update the program as the department publishes new requirements.

Where CrunchAtlas fits.

CrunchAtlas passively monitors network activity and supports evidence-backed investigation across IT and OT environments. Consequential actions remain operator-controlled.