Summary
The Water Cyber Shield Act, introduced in August 2026, proposes mandatory cybersecurity risk assessments and incident reporting, if enacted, for U.S. water utilities while authorizing $300 million annually to fund upgrades. The biggest vulnerability isn't policy — it's the legacy OT equipment running most water systems, which lacks visibility, secure remote access, and a backup path when the primary network fails. Digi's infrastructure management portfolio addresses all three gaps without ripping out existing equipment, and the compliance documentation utilities will need for EPA, CISA, and NIST assessments is built into the workflow from day one.
Cyberattacks on water infrastructure are no longer a theoretical risk; they are happening now. Coordinated incidents have hit community water systems across more than a dozen U.S. states, and federal lawmakers are moving fast. The
Water Cyber Shield Act, introduced in August 2026, authorizes $300 million annually to help utilities fund cybersecurity upgrades and would require risk assessments and incident reporting, if enacted, for water and wastewater systems nationwide.
This is a genuine turning point for the water sector. But the challenge most utilities face is not a policy gap; it is an infrastructure gap. You cannot protect, audit, or respond to incidents on systems you cannot see or reach.
For the thousands of water utilities still running legacy operational technology (OT) equipment, that gap is closing.
A 20- or 30-year-old PLC isn't bad equipment just because it's old. Replacing functioning OT isn't always practical or the right engineering decision. The goal here isn't replacement; it's bringing modern connectivity, access control, and visibility to the infrastructure already running your operations.
The Vulnerability Is in the OT Layer
Most cyberattacks on water systems go after operational technology: PLCs, RTUs, SCADA systems, pump controls, chemical dosing equipment. These are the devices that actually run the water. Most were engineered decades ago with no network security in mind, communicating over serial protocols that were never meant to connect to the Internet.
But as IT and OT networks have converged, those devices are now reachable from the outside. Without encryption, authentication, or centralized management, they are often the easiest path in for an attacker.
The legislation's risk assessment mandate brings into focus questions that the changing threat landscape, not the utilities, has made newly urgent. Infrastructure designed and built decades before today's connectivity requirements couldn't anticipate where IT and OT convergence would lead:
- What devices are on your network?
- Who can reach them?
- What happens when the primary network goes down mid-incident?
Answering those questions takes a different kind of infrastructure investment than most cybersecurity vendors discuss.
Engineering the Security Architecture
The connectivity and management architecture matters as much as the hardware. For OT environments, the key principles are: network segmentation to isolate OT from IT and from the Internet; controlled remote access with MFA and role-based permissions rather than open VPN tunnels; minimizing direct Internet exposure of field devices; authentication at every access layer; and maintaining an independent management path that doesn't rely on primary network availability. The products described here are tools for implementing those principles, not replacements for the architecture decisions.
Visibility Starts at the Serial Layer
Most water utility field equipment communicates over serial interfaces. Flow meters, pressure sensors, chemical analyzers, RTUs, and older PLCs all speak RS-232 or RS-485. That is not inherently a problem, but it becomes one when those devices connect to IP networks without proper access controls, or get managed through ad-hoc local PCs and adapters that nobody monitors or patches.
The Digi Connect EZ family brings these devices under centralized, encrypted, authenticated management without replacing any equipment or re-running any wiring. Operators monitor, configure, and troubleshoot serial-connected devices from a single portal, with role-based access control, encrypted connections, and automated firmware updates across a distributed fleet. No rip-and-replace. No re-running your existing field wiring. Just visibility and control you did not have before.
For utilities running dozens or hundreds of remote sites, centralized visibility is not a convenience. It is the foundation a compliance posture requires. Learn more.
Out-of-Band Access: The Incident Response Layer You Need Before the Incident
Most water utility security teams have incident response and recovery plans; several are federally required to. The gap isn't planning. It's maintaining an independent path to remote assets when the primary network itself is the thing that's unavailable. If the network is the problem, you cannot use it to diagnose or fix the problem.
Most water utility field sites are not data centers. A lift station doesn't have a rack. Out-of-band management at the field level requires equipment that actually fits the environment.
Digi Connect EZ is already at the edge. It's the device terminating the serial console on the PLC, pump controller, or RTU. When you add a CORE cellular modem, that same device provides an independent cellular path reachable through Digi Remote Manager or your own private network, completely separate from the primary Ethernet connection. When the primary link goes down, Digi Connect EZ is already connected to the equipment you need to reach so you don't just get out-of-band network access, you get direct CLI serial console access to the field device itself over cellular. You can assess, diagnose, and issue commands without dispatching a technician.
Digi SureLink automates the failover. When the primary link drops, SureLink transitions to cellular automatically. When Ethernet restores, it fails back. Management and monitoring continue through the outage without requiring manual intervention. That's operational resilience these sites can actually deploy.
For central or aggregation sites, such as a treatment plant, a network operations room, or a regional hub, Digi Connect IT 16/48 is the right fit: a rack-mounted console server with 16 or 48 serial ports for managing the IT and OT equipment concentrated at those locations.
For utilities now facing mandatory incident reporting, speed of response matters twice: operationally and on paper. The faster you can access and contain an incident, the better the documentation you can hand regulators when they ask.
Fewer emergency truck rolls. Faster response. Better documentation. That is what OOB management delivers. Learn more.
Field-Level Telemetry: Knowing What Is Happening Before It Becomes a Crisis
For central or aggregation sites, such as a treatment plant, a network operations room, or a regional hub, Digi Connect IT 16/48 is the right fit: a rack-mounted console server with 16 or 48 serial ports for managing the IT and OT equipment concentrated at those locations.
The Act's focus on risk assessments reflects a basic truth: you cannot manage what you cannot measure. Equipment such as pump stations, lift stations, remote distribution nodes, and storage tanks are typically unmanned, and anomalies can go undetected for hours or days.
Digi Connect Sensor XRT-M is a rugged, battery-powered remote telemetry unit built for exactly these environments. It connects to pressure sensors, flow meters, water quality instruments, and other field devices over analog (4-20 mA, 0-10 V), digital, and Modbus interfaces, and transmits data over cellular LTE-M/NB-IoT directly into Digi Axess dashboards or your existing SCADA platform via MQTT.
Battery life runs approximately five years at two reads and transmissions per day. The IP68-rated NEMA enclosure handles outdoor and underground deployment. Setup takes under 10 minutes. And because it operates on cellular rather than your OT network, you get a layer of visibility that does not depend on that network being healthy, which is exactly the point when something goes wrong.
Lifecycle Management and Compliance Documentation
Here is a challenge that does not get enough attention: documentation. Risk assessments require knowing the current state of every device on your network. Firmware currency matters. Access logs matter. Security incident records matter. And when a regulator asks, you need to produce that information quickly.
Digi Remote Manager (DRM) is the cloud-based management platform that ties all of this together. DRM lets you automate firmware updates across individual devices or entire fleets, generate detailed reports on device health and connectivity, create real-time alerts for specified conditions, and maintain an auditable record of every configuration change and access event.
DRM operates in a commercial-grade cloud environment compliant with SOC 1, SOC 2, and SOC 3 standards, supporting NIST, ISO 27002, and HIPAA frameworks. For utilities in air-gapped or highly regulated environments, Digi On-Prem Manager delivers the same capabilities hosted entirely within your own infrastructure; in other words, no data leaves your network.
Digi LifeCycle Assurance (LCA) adds another layer. LCA provides ongoing expert support, 24X7 access to the Digi technical team, and proactive device management across your connected infrastructure. Every Digi device ships with a 5-year hardware warranty; LCA is a separate subscription that adds managed support and faster response on top of that foundation.
The Digi Infrastructure Stack for Water Utilities
Digi Infrastructure Management products are not a collection of standalone tools. They are designed to work together as a unified OT management architecture.
| Layer |
Product |
What It Delivers |
| Field telemetry |
Digi Connect Sensor XRT-M |
Cellular-connected pressure, flow, and water quality monitoring at remote sites |
| Serial/SCADA integration |
Digi Connect EZ 8/16/32 |
Centralized, encrypted management of legacy serial devices |
| Out-of-band access — field sites |
Digi Connect EZ (with CORE cellular modem) |
Independent cellular path + direct serial console access to field devices; SureLink automatic failover |
| Out-of-band access — central/aggregation sites |
Digi Connect IT 16/48 |
Rack-mounted console server for treatment plants, network operations rooms, and regional hubs |
| Centralized management |
Digi Remote Manager |
Firmware lifecycle, access control, audit trails, real-time alerts |
| Ongoing assurance |
Digi LifeCycle Assurance |
24x7 expert support, proactive management, security currency |
Your operations team works from one place, not five. That matters when you are managing dozens of remote sites and need to move fast.
A Practical Path Forward
Federal mandates and funding cycles create urgency, but they also create a real opening. The Water Cyber Shield Act's $300 million annual authorization for State Revolving Funds means utilities that move now are better positioned to access grant and loan funding for exactly these types of infrastructure upgrades.
You do not need a full infrastructure overhaul to start. Bring your serial-connected OT devices under centralized management. Establish an independent out-of-band access path. Deploy field telemetry at your highest-risk remote sites. That combination addresses the three gaps regulators and CISA auditors find most often: no visibility, no secure remote access, and no incident response capability when the primary network fails.
Digi has been building infrastructure management solutions for utilities, energy providers, and critical infrastructure operators for decades, combining industrial rated hardware and an industry-leading management platform. And the compliance documentation your team will need for EPA, CISA, and NIST assessments is built into the workflow, not bolted on after the fact.
Frequently Asked Questions About the Water Cyber Shield Act and Infrastructure Management
What does the Water Cyber Shield Act require water utilities to do?
As introduced, the bill would require cybersecurity risk assessments for large water systems and extends mandatory incident reporting to state and locally owned facilities. It also authorizes $300 million annually through the Drinking Water and Clean Water State Revolving Funds to help utilities fund security upgrades. Requirements are expected to align with frameworks from EPA, CISA, and NIST. Important: Confirm the bill's current status before referencing specific compliance deadlines.
My utility runs legacy serial equipment. Do I have to replace it to meet new security requirements?
No, and that is an important distinction. Legacy serial devices like PLCs, RTUs, and flow meters do not need to be replaced. The Digi Connect EZ family brings existing serial equipment under centralized, encrypted, authenticated management over your IP network without re-terminating existing serial runs or disturbing existing field cabling. You modernize your security posture while protecting your existing equipment investment.
Why is out-of-band (OOB) management important for incident response?
Out-of-band management gives you a separate, independent path to reach critical infrastructure equipment when your primary network is unavailable — which is exactly when normal channels fail. At field sites like lift stations and pump stations, Digi Connect EZ with a CORE cellular modem provides that independent path: the device is already connected to the serial console on your PLC or RTU, so over-cellular access means your team can issue commands, not just ping a network. SureLink handles the failover automatically. At central or aggregation sites, the Digi Connect IT 16/48 provides rack-mounted console server access for the IT and OT equipment concentrated there.
How does Digi Remote Manager support compliance documentation?
Digi Remote Manager keeps an auditable record of configuration changes, firmware update history, access events, and device health across your entire connected infrastructure. It supports NIST, ISO 27002, and HIPAA frameworks and operates in a SOC 1, SOC 2, and SOC 3 compliant cloud environment. For utilities that cannot send data outside their own network, Digi On-Prem Manager delivers the same capabilities hosted entirely within your private infrastructure.
What is the difference between Digi's 5-year hardware warranty and Digi LifeCycle Assurance?
These are two separate offerings. The 5-year hardware warranty covers the physical device and ships with every Digi product at no additional cost. Digi LifeCycle Assurance (LCA) is a separate subscription that adds 24X7 expert technical support, proactive device management, and accelerated response on top of the hardware warranty. LCA is particularly valuable for utilities with limited internal IT/OT staff or strict uptime requirements.
Can Digi Connect Sensor XRT-M connect to my existing SCADA platform?
Yes. Digi Connect Sensor XRT-M supports native MQTT, so it can publish data directly to any MQTT-compatible broker or SCADA platform. It also supports Modbus RTU and ASCII protocols and connects to up to four sensors simultaneously via analog (4-20 mA, 0-10 V) and digital interfaces. Data flows into Digi Axess for built-in dashboards and alerting, or into your existing SCADA or enterprise system; no middleware is required.
How quickly can Digi Connect Sensor XRT-M be deployed at a remote pump station or field site?
Digi Connect Sensor XRT-M setup takes under 10 minutes. The device ships with preloaded configurations and provisions through the Digi Axess mobile app (iOS and Android). The IP68-rated NEMA enclosure handles outdoor and underground installation, and the dual 12 Ah battery delivers approximately five years of operation at two reads and transmissions per day. No external power infrastructure is required at remote sites.
Is federal funding available to help cover the cost of OT security upgrades?
The Water Cyber Shield Act, as introduced, would authorize $300 million annually through State Revolving Funds specifically to help utilities fund cybersecurity upgrades. Monitor the bill's progress and consult with your state revolving fund administrators about eligibility. Digi can provide documentation on product specifications, security certifications, and management capabilities to support grant and funding applications.
What does Digi Axess provide beyond basic data collection?
Digi Axess is the operational monitoring platform built for Digi field devices. It provides configurable dashboards, real-time threshold alerts, historical data review, and remote device configuration, all accessible via web browser or mobile app. For water utilities, this means operators at a central location can monitor remote pump stations, lift stations, and distribution sites from a single screen without building a custom SCADA integration. When regulators ask for documentation of anomalies or response actions, Axess event history provides a ready audit trail.
Ready to assess your OT infrastructure against the new federal requirements? Talk to a Digi infrastructure specialist today.