CrunchAtlasGuide
Small water systems. Who owns what?
Small teams often share cybersecurity across operators, IT providers, SCADA integrators, and vendors. This guide makes each responsibility and handoff clear.
If you only read one thing.
The names may change. These five jobs don't, and each needs an owner. 1
Know what's connected
A current view of important IT, OT, remote sites, and the connections between them.
Know who can get in
Each remote access path, who uses it, who approves it, and how access is removed.
Know what you can see
Which logs, alerts, network data, and system records exist when something needs investigating.
Assign the investigation
Someone determines what's suspicious, what's affected, and what the evidence supports.
Define response
Who gets called, who can act, what gets preserved, and how recovery is coordinated.
01 · Who owns what
Separate the jobs.
The title on the contract matters less than the work each party actually owns.
- Utility team
- Sets operational decisions, approvals, emergency procedures, and the process context outside providers need.
- SCADA integrator
- May install, configure, maintain, and troubleshoot control systems. Cybersecurity scope depends on the engagement.
- IT provider or MSP
- May manage business IT, accounts, endpoints, firewalls, backups, or remote access. OT scope varies.
- Equipment vendors
- Support the products and services in their scope. Access, monitoring, and security responsibilities vary.
If two parties both think the other owns a job, nobody owns it.
02 · Ask your providers
Ask six questions.
You may already have this handled. Get the handoffs clear. Ask each provider:
- What systems are you responsible for?
- What systems and activity can you actually see?
- Who manages remote access?
- Who investigates a security alert?
- What evidence is retained?
- Which actions require operator approval?
If an answer is unclear, define it before an incident forces the question.
Know who owns the investigation before you need one.
Talk with our team about what AtlasCyber finds in your network.
03 · Where CrunchAtlas fits
Where CrunchAtlas fits.
AtlasCyber monitors the network and ClemAI investigates what it finds. One platform connects the investigation workflow, and consequential actions stay under operator control.
Network Detection and Response
Passive network evidence turns suspicious activity into an investigated case without probing operational systems.
Alert Investigation
Work alerts to a verdict with the affected systems, evidence, and recommended next step attached.
Host and Network Forensics
Reconstruct what happened and establish scope from available host and network evidence.
Incident Reporting
Carry the investigated case into a reviewable report with findings, evidence, scope, and response information.
04 · FAQ
Small water system questions, answered.
Does a small water system need its own cybersecurity team?
Not necessarily. The work can be shared across operators, IT, a SCADA integrator, an MSP, a cybersecurity provider, and other specialists. What matters is that each job has a clear owner.
Is our SCADA integrator responsible for cybersecurity?
It depends on the engagement. An integrator may know the control environment deeply while focusing on engineering, integration, maintenance, and operational support. Confirm which cybersecurity responsibilities are actually included.
Does our MSP already handle this?
It may handle part or all of it. Confirm what the MSP can see in OT, which systems it manages, whether remote access is in scope, and who investigates suspicious activity.
What does AtlasCyber provide to a small water system?
AtlasCyber detects and investigates network activity; ClemAI documents findings and recommended actions in the case record. Operators retain responsibility for operational decisions.
05 · Sources
Sources.
The ownership and preparedness guidance is grounded in EPA water cybersecurity resources. CrunchAtlas product descriptions are separate from EPA guidance.
- EPA, Water Cybersecurity Assessment Tool (WCAT) fact sheets
- EPA, Cybersecurity Assessments
- EPA, Cybersecurity Planning
This page is educational. It doesn't assign legal, regulatory, engineering, or contractual responsibility for a specific utility. Confirm responsibilities against the utility's contracts, architecture, policies, and applicable requirements.
Keep reading.
Know who owns the investigation.
Talk with our team about what AtlasCyber finds in your network.
Talk to our teamSign up for our newsletter