Monitoring & Digital
SCADA Water Treatment Companies
SCADA integrators and system integrators for water/wastewater plants, PLC, HMI, historians, and cybersecurity.
This page is a good fit if you need:
- Acid Dosing Systems or Aerated Lagoons, MABR capabilities
- Suppliers with agriculture sector experience
- Providers operating in Indonesia or United Kingdom
- Providers
- 2
- Verified
- 1
- Countries
- 2
Can't find the right fit? Post a brief and let qualified suppliers come to you.
Post a projectHow to choose a scada water treatment provider
Start with providers that clearly operate in your target geography and project footprint.
Look for industry exposure that matches your water challenge, compliance constraints, and deployment context.
Use technologies, service scope, and proof signals to narrow the list before reaching out to suppliers.
Not sure where to start? Our experts can help.
Filter results
Verified providers
1 claimed companies in this category
Country
Industry
Technology
Find a SCADA Water Treatment Provider
Showing 1-2 of 2
2 results from 2 matched providers
SCADA Systems for Water Treatment: Architecture, Protocols, and Cybersecurity Standards
SCADA (Supervisory Control and Data Acquisition) systems in water treatment plants provide centralised monitoring and control of all process units: intake/raw water abstraction, coagulation-flocculation dosing, sedimentation, filtration, disinfection (chlorination, UV, ozone), pH adjustment, and distribution pumping. Architecture: field instruments (pressure, flow, turbidity, pH, chlorine, level transmitters - 4 to 20 mA with HART or Foundation Fieldbus digital overlay) connect to I/O modules in local control panels, which communicate via Modbus TCP, Profibus DP, or Profinet to PLCs (Siemens S7-300/400/1500, Allen-Bradley ControlLogix, Schneider Quantum/Modicon). PLCs communicate over industrial Ethernet to SCADA servers running HMI software (Wonderware System Platform, Ignition, Siemens WinCC OA, GE iFix) which display process mimics, trends, alarms, and historical data. Control room operators monitor and override setpoints via operator workstations; remote telemetry units (RTUs) at satellite pumping stations transmit data via GPRS, 4G, or fibre to the central SCADA. OPC-DA and OPC-UA provide standardised data exchange between historian databases, LIMS (laboratory information management), and business systems.
Alarm management is a critical SCADA function for water treatment: ISA-18.2 (Management of Alarm Systems for the Process Industries) provides the standard framework, adopted by UK Water Industry Research (UKWIR) guidance. Key alarm philosophy requirements: alarm rationalisation (only alarm conditions requiring operator action within a defined time window); target alarm rate less than 6 per hour in steady state; priority classification (critical, high, medium, low) based on consequence and time to respond. Common water treatment alarms: raw water turbidity greater than 10 NTU (coagulant dose increase required); filtered water turbidity greater than 0.1 NTU (filter backwash triggered); free chlorine residual less than 0.2 mg/L at service reservoir inlet (disinfection deficit - regulatory breach risk); high-lift pump failure (duty/standby changeover automatic, operator notification). Historian databases (OSIsoft PI, Aveva Historian, Inductive Automation Ignition Historian) store process data at 1-second to 15-minute resolution for regulatory reporting, process optimisation, and fault investigation.
Cybersecurity for water SCADA systems is a statutory requirement under the UK NIS Regulations 2018 (Operators of Essential Services designation), the EU NIS2 Directive (2022/2555/EU, effective October 2024), and US AWIA 2018. Technical controls: network segmentation (OT network isolated from IT network via DMZ with industrial firewall; unidirectional security gateways for historian data replication from OT to IT); no direct internet connectivity from PLC/SCADA network; vendor remote access via secure VPN with MFA and session recording; software patching management (ICS-CERT advisories, assessed and tested before deployment on SCADA); removable media control (USB lockdown); OT-specific intrusion detection (Claroty, Dragos, Nozomi Networks - passively inspect industrial protocols without impacting control). UK NCSC CAF (Cyber Assessment Framework v3.1) is used by Ofwat for NIS compliance assessment of water companies. Incident reporting: UK water companies must report NIS incidents to Ofwat within 72 hours; Ofwat can impose fines up to GBP 17M or 10 percent of qualifying turnover for non-compliance.
Frequently Asked Questions
What SCADA software is used in water treatment plants?
Most widely deployed SCADA/HMI platforms in water treatment: (1) AVEVA (formerly Wonderware) System Platform / InTouch: dominant in UK water utilities (Thames Water, United Utilities, Severn Trent use AVEVA extensively); scalable from single-site to enterprise-wide historian; (2) Inductive Automation Ignition: growing rapidly in water sector; subscription licensing; browser-based clients; native OPC-UA; popular for mid-size water utilities and newer SCADA replacements; (3) Siemens WinCC / WinCC OA: widely used in European water utilities; integrates natively with Siemens S7 PLCs; WinCC OA for large distributed systems; (4) GE Digital iFix / Proficy: established in US water market; integrates with GE Historian (Proficy Historian); (5) Rockwell FactoryTalk View: used with Allen-Bradley ControlLogix PLCs; common in North American water treatment; (6) Schneider Electric EcoStruxure: common in French water market (Veolia, Suez plants). Historian databases: OSIsoft PI System (now AVEVA PI) is the de facto standard historian in UK and US water utilities for long-term process data storage, reporting, and analytics.
What communications protocols do water SCADA systems use?
Water SCADA uses multiple protocol layers: Field level (instrument to PLC): 4 to 20 mA analogue; HART (digital overlay on 4 to 20 mA, allows remote instrument configuration); Foundation Fieldbus H1 (process instruments, 31.25 kbps); Profibus PA (Siemens ecosystem). Control level (PLC to PLC, PLC to SCADA): Modbus RTU (serial RS-485, legacy) and Modbus TCP (Ethernet, widely used); Profibus DP (12 Mbps, Siemens/European systems); Profinet (real-time Ethernet, Siemens); EtherNet/IP (Allen-Bradley/Rockwell); DNP3 (telemetry RTUs, especially US water utilities per IEEE 1815). SCADA to enterprise: OPC-DA (COM/DCOM, legacy); OPC-UA (IEC 62541, current standard - encrypted, secure, platform-independent); REST API/MQTT for cloud integration. Telemetry (RTU to SCADA over WAN): IEC 60870-5-101 (serial) and IEC 60870-5-104 (TCP/IP) widely used in UK water utilities; DNP3 over TCP predominant in US; MQTT over 4G for modern deployments. UK Water Industry prefers IEC 60870-5-104 or DNP3 for EA regulatory data transfer (Abstraction/Impoundment telemetry).
How are SCADA alarms managed in water treatment?
Effective alarm management follows ISA-18.2 / IEC 62682 (identical content): (1) Alarm philosophy document: defines alarm priorities, rationalisation criteria, target alarm rates, suppression rules, and operator response requirements - should be completed before SCADA configuration; (2) Alarm rationalisation: each alarm must have a defined consequence, required operator action, and available response time; alarms with no required action become events (not alarms); (3) Priority assignment: Critical (trip/shutdown, immediate action less than 5 minutes, less than 5 percent of total alarms); High (process upset, action within 10 minutes); Medium/Low (informational, operator discretion); (4) Alarm suppression: during startup, shutdown, or known maintenance conditions, non-relevant alarms are suppressed by state-based suppression logic (ISA-18.2 Section 8); (5) Alarm performance KPIs: steady-state alarm rate target less than 6 per hour (ISA-18.2 guidance); standing alarms (active greater than 24 hours) require investigation; (6) UK UKWIR guidance (2018): Good Alarm Management Practice for Water Industry tailors ISA-18.2 to water/wastewater applications. Alarm flooding during events (greater than 10 alarms per 10 minutes) requires flood suppression strategies.
What cybersecurity standards apply to water SCADA systems?
Applicable cybersecurity standards and regulations: (1) UK NIS Regulations 2018 (SI 2018/506): water/wastewater operators designated Operators of Essential Services (OES) must implement appropriate and proportionate security measures; report incidents to Ofwat/NCSC; Ofwat uses NCSC CAF v3.1 for compliance assessment; (2) EU NIS2 Directive (2022/2555/EU): effective October 2024 in EU member states; water/wastewater in scope as 'essential entities'; stricter requirements than NIS1; EU-27 transposition ongoing; (3) US AWIA 2018: community water systems serving greater than 3,300 persons must conduct Risk and Resilience Assessment (RRA) and Emergency Response Plan (ERP) every 5 years; certified to EPA; (4) IEC 62443 series: industrial cybersecurity standard specifying Security Levels (SL0 to SL4); SL2 is minimum for water SCADA (resists intentional violation by sophisticated attacker with limited resources); (5) NIST SP 800-82 Rev 3 (2023): comprehensive ICS security guide for US federal operators and best practice reference globally; (6) NCSC Active Cyber Defence (UK): Suspicious Email Reporting Service, Early Warning service for CNI operators. Key technical controls: network segmentation, MFA, patching, removable media control, OT asset inventory.
A UK water company managing 22 water treatment works and 14 wastewater treatment plants was running a disparate SCADA estate across three different legacy platforms, with no network segmentation between OT and IT, remote access via unsecured VPN, and no OT asset inventory. An Ofwat CAF assessment rated the company at inadequate on three of four CAF Objectives, triggering a regulatory requirement to remediate within 18 months.
A specialist OT cybersecurity contractor conducted an OT asset discovery exercise using passive network monitoring (Claroty deployment), establishing a complete asset inventory of 4,800 OT devices. Network segmentation was implemented using Purdue Model architecture, creating demilitarised zones between IT and OT. Remote access was migrated to a privileged access management solution with MFA. A 24/7 OT security operations centre (SOC) contract was established.
CAF assessment score improved from inadequate to advanced on all four Objectives within 14 months. Three attempted cyber intrusions were detected and contained by the OT SOC in year one, none of which penetrated to the control layer. The company avoided an Ofwat enforcement action that carried estimated financial penalties of GBP 4.2 million under the NIS Regulations.
Questions to Ask Shortlisted Providers
- 1
What is the current SCADA platform, HMI software version, and OT operating system landscape across all sites?
Legacy OT systems (Windows XP, Windows 7, unsupported PLCs) create known vulnerability paths; understanding the estate scope determines whether remediation, migration, or compensating controls are required.
- 2
Is there network segmentation between IT and OT systems and what is the remote access architecture?
Flat IT/OT networks are the most common attack entry point for water utility breaches; separation via DMZ and unidirectional gateways is the baseline control required under IEC 62443 SL2.
- 3
What is the current OT asset inventory and vulnerability management process?
You cannot protect what you cannot see; passive OT asset discovery (Dragos, Claroty, Nozomi) is the starting point for any cybersecurity programme under NCSC CAF Objective B.
- 4
What incident response and recovery procedures exist for a cyber event causing loss of SCADA control?
Water sector operators must notify Ofwat and NCSC of significant NIS incidents; tested incident response plans and manual fallback procedures are required under CAF Objective D and IEC 62443.
- 5
What is the supply chain cybersecurity policy for SCADA vendors, system integrators, and remote support contractors?
Supply chain compromise (malicious firmware, backdoored remote access tools) is the primary attack vector for sophisticated threat actors targeting critical national infrastructure; vendor security questionnaires and contractual security obligations are required.
What Drives Cost in This Category
Passive OT discovery licensing costs GBP 40,000 to 150,000 per year; network segmentation implementation (firewalls, DMZ, Purdue Model refactoring) costs GBP 200,000 to 1.5 million depending on estate size and complexity.
Migrating from legacy SCADA (unsupported Wonderware, iFIX, Citect) to modern platforms costs GBP 500,000 to 5 million for a mid-size utility; rushed migration without cybersecurity-by-design replicates legacy vulnerabilities in new systems.
Decommissioning insecure VPN and deploying PAM solutions (CyberArk, BeyondTrust, Delinea) with MFA costs GBP 80,000 to 400,000 depending on number of remote users and sites.
Specialist OT SOC services cost GBP 150,000 to 600,000 per year for 24/7 monitoring of a mid-size utility; incident response retainers with a specialist OT forensics firm cost GBP 20,000 to 80,000 per year.
Key Regulations & Standards
Water and wastewater operators are designated Operators of Essential Services; Ofwat acts as the NIS competent authority and uses the NCSC Cyber Assessment Framework (CAF) v3.1 to assess compliance across four Objectives (A: Managing security risk; B: Protecting against attack; C: Detecting security events; D: Minimising impact of incidents).
International standard defining Security Levels (SL1 to SL4) for industrial control systems; SL2 is the UK water sector minimum, requiring resistance to intentional violation by a sophisticated attacker with limited resources; water company asset standards increasingly mandate IEC 62443-2-4 compliance for SCADA system integrators.
AMP8 business plan guidance requires water companies to submit documented cyber resilience plans, evidence of CAF assessments, and investment plans for OT security uplift; failure to evidence adequate cyber resilience is a material risk factor in Ofwat's totex and ODI determinations.
Applies to SCADA alarm management in water treatment; specifies alarm rationalisation, documentation, management of change, and operator interface requirements; poorly managed SCADA alarms are a contributory factor in operator error incidents cited in DWI and EA enforcement cases.