Answer first: transfer responsibility, not just a password
When a shared rural water system changes operators, board members or technology vendors, ask the authorized operator and qualified technology provider to review digital ownership and access together. Identify who can approve access, who supports connected equipment and who handles an incident. A departing volunteer handing over one password does not establish that all administrative accounts, remote services and recovery arrangements have been transferred.
Joint EPA, CISA and FBI guidance recommends water-system asset inventories, stronger authentication, appropriate security assessments, backups and practiced response roles. Translate those priorities into a qualified handoff plan for the actual system. This is an owner-governance guide, not permission to scan a network, enter a controller, change treatment settings or disconnect live equipment. Determine the system's regulatory status and operating authority before making compliance claims.
Name the operating and technology decision-makers
The board or responsible owner should identify the qualified water operator, the technology custodian and the person authorized to approve contracts and access. These roles can overlap, but the overlap should be explicit. Ask who is available after hours and who can authorize emergency assistance if the usual contact cannot be reached. Record the actual assignments rather than assume the new service company accepted every former volunteer's responsibility.
Keep the digital-access work connected to the broader shared water-system handoff. Ownership documents, operator qualifications and regulator notices remain separate obligations. Ask the responsible drinking-water authority which reporting or approval requirements apply to the actual transition. An association vote or a vendor login does not independently authorize someone to operate treatment equipment or change an approved operating procedure.
Commission a protected inventory of what depends on digital access
Ask qualified staff to identify the connected control, communications and business systems that support the supply. The owner-facing summary can name the responsible provider, system purpose, support agreement and unresolved handoff issue without exposing technical connection details. A monitoring subscription, billing account, alarm service and equipment-maintenance portal may have different owners. Do not assume the company servicing the pump also controls every associated digital service.
The joint guidance identifies an inventory of operational and information-technology assets as a security priority. Our editorial recommendation is to link that protected inventory to the service contracts and authorized custodians, so a later personnel change has a clear starting point. Have qualified personnel perform the technical discovery. Do not ask residents to probe equipment, search for exposed controllers or publish network details to crowdsource an answer.
Review access changes through the approved process
Give the authorized reviewers a list of departing and incoming people and vendors, their roles and the effective transition dates. Ask them to reconcile that information with actual access arrangements and document completion through an appropriate protected record. Distinguish identifying an old account from confirming that it has been safely handled. Do not distribute credentials in meeting minutes or send a complete access file to every household.
Ask the qualified provider to explain its approach to appropriate individual access, authentication and remote-service authorization. The joint guidance recommends addressing insecure default passwords and using multifactor authentication where possible. Implementation must account for the actual equipment and service-continuity requirements. This guide does not prescribe a router setting, password-reset sequence or control-system change. A board should request competent work and evidence, not improvise the technical change itself.
Use a responsibility table that omits security-sensitive details
Use the table to expose gaps between contracts. For example, one vendor may maintain communications while another supports the control equipment. Ask who coordinates an incident involving both. An answer that everyone will help is not the same as an assigned lead with an agreed contact route. The public or member-facing summary should report progress without disclosing credentials, detailed network diagrams or sensitive recovery information.
| Role | Responsibility to confirm | Evidence to retain securely | Open question |
|---|---|---|---|
| Responsible owner or board | Authority, contracts and decision escalation | Approved assignments and service scope | Who can authorize assistance after hours? |
| Qualified water operator | Safe operating continuity and regulator coordination | Applicable operating and response arrangements | Which operational limits affect technology work? |
| Qualified technology custodian | Protected inventory, access review and recovery support | Dated completion and unresolved exceptions | Which systems are outside the service contract? |
| Departing provider or volunteer | Documented transfer through authorized channels | Handoff acknowledgment and missing-item list | What knowledge or service ownership remains untransferred? |
| Incident coordinator | Current contacts and exercised responsibilities | Response-plan review and exercise record | Who acts if the primary contact is unavailable? |
Ask for recovery evidence, not merely a backup subscription
Ask qualified staff what the recovery arrangement covers, who maintains it and how its usability is verified without disrupting service. Separate evidence that a backup exists from evidence that the relevant restoration process has been appropriately checked. The joint guidance recommends backups and recovery planning; it does not make a subscription receipt proof that this system could resume safe operation after an incident.
EPA's 2017 incident checklist distinguishes utility responsibilities from IT staff or vendor responsibilities and includes preparation and recovery. Use that role framework as background, not its dated contact details or software examples. Have the current qualified team establish appropriate procedures and current assistance contacts. Do not run a surprise restoration test on live controls or attempt manual water-treatment operation because a general checklist mentions continuity planning.
Illustrative scenario: the former volunteer is the only remote-monitoring contact
Imagine a small association hires a new operator after a long-serving volunteer moves away. The water service continues, but the former volunteer remains the only person associated with a monitoring subscription. This is an illustrative scenario, not a report of an actual compromise. The board asks its authorized operator and technology provider to identify the ownership and access gaps through a protected review rather than post account details in a group chat.
The review produces named custodians, a documented service handoff and a list of exceptions requiring follow-up. The operator also confirms how alarms and urgent calls are handled during the transition. If a suspected incident is discovered, the team uses the current response plan and qualified assistance. The board does not declare the water safe from the fact that a dashboard is visible, nor does it shut down equipment to experiment with access.
Practice communication and keep the review current
Schedule a discussion-based exercise with the appropriate participants: an unavailable primary contact, a lost monitoring service or a suspected unauthorized message can test who calls whom without manipulating operational equipment. Ask the incident coordinator to record unanswered responsibility questions and assign follow-up. The joint guidance recommends exercising response plans. A completed discussion is useful evidence of preparation, not certification that every technical weakness has been removed.
Use EPA's current water-sector cybersecurity page to locate current assistance information and verify any program's eligibility before relying on it. Review the handoff when staff, vendors, subscriptions or equipment change. Retain protected technical records through authorized custody and give residents only the information appropriate for them. Water-quality advisories and public notifications must follow the responsible operator and authorities, not a board's unsupported interpretation of a cybersecurity event.
Frequently asked questions
Is handing over one password a complete transition? No. Should all households receive administrative credentials? No; use authorized, appropriately limited access. Can volunteers scan the system to find missing equipment? This guide does not authorize that activity. Does cybersecurity guidance permit treatment-setting changes? No. Does a working dashboard prove water is safe? No. Should old agency phone numbers be copied from a 2017 checklist? Verify current contacts instead. Is every shared well regulated identically? No; confirm classification and obligations. What if an incident is suspected now? Contact the authorized operator and qualified response team through the current plan and follow applicable emergency instructions.