SCADA Water Treatment Companies
SCADA integrators and system integrators for water/wastewater plants, PLC, HMI, historians, and cybersecurity.
7 specialist providers · 2 related · 5 countries
Qualified suppliers come to you.
Filter results
Country
Industry
Technology
Not sure where to start?
Showing 1-9 of 9
Buyer's guide
The buyer's guide to scada water treatment
SCADA Systems for Water Treatment: Architecture, Protocols, and Cybersecurity Standards
SCADA (Supervisory Control and Data Acquisition) systems in water treatment plants provide centralised monitoring and control of all process units: intake/raw water abstraction, coagulation-flocculation dosing, sedimentation, filtration, disinfection (chlorination, UV, ozone), pH adjustment, and distribution pumping. Architecture: field instruments (pressure, flow, turbidity, pH, chlorine, level transmitters - 4 to 20 mA with HART or Foundation Fieldbus digital overlay) connect to I/O modules in local control panels, which communicate via Modbus TCP, Profibus DP, or Profinet to PLCs from the major automation vendors. PLCs communicate over industrial Ethernet to SCADA servers running HMI software from the established SCADA vendors which display process mimics, trends, alarms, and historical data. Control room operators monitor and override setpoints via operator workstations; remote telemetry units (RTUs) at satellite pumping stations transmit data via GPRS, 4G, or fibre to the central SCADA. OPC-DA and OPC-UA provide standardised data exchange between historian databases, LIMS (laboratory information management), and business systems.
Alarm management is a critical SCADA function for water treatment: ISA-18.2 (Management of Alarm Systems for the Process Industries) provides the standard framework, adopted by UK Water Industry Research (UKWIR) guidance. Key alarm philosophy requirements: alarm rationalisation (only alarm conditions requiring operator action within a defined time window); target alarm rate less than 6 per hour in steady state; priority classification (critical, high, medium, low) based on consequence and time to respond. Common water treatment alarms: raw water turbidity greater than 10 NTU (coagulant dose increase required); filtered water turbidity greater than 0.1 NTU (filter backwash triggered); free chlorine residual less than 0.2 mg/L at service reservoir inlet (disinfection deficit - regulatory breach risk); high-lift pump failure (duty/standby changeover automatic, operator notification). Historian databases store process data at 1-second to 15-minute resolution for regulatory reporting, process optimisation, and fault investigation.
Cybersecurity for water SCADA systems is a statutory requirement under the UK NIS Regulations 2018 (Operators of Essential Services designation), the EU NIS2 Directive (2022/2555/EU, effective October 2024), and US AWIA 2018. Technical controls: network segmentation (OT network isolated from IT network via DMZ with industrial firewall; unidirectional security gateways for historian data replication from OT to IT); no direct internet connectivity from PLC/SCADA network; vendor remote access via secure VPN with MFA and session recording; software patching management (ICS-CERT advisories, assessed and tested before deployment on SCADA); removable media control (USB lockdown); OT-specific intrusion detection (platforms that passively inspect industrial protocols without impacting control). UK NCSC CAF (Cyber Assessment Framework v3.1) is used by Ofwat for NIS compliance assessment of water companies. Incident reporting: UK water companies must report NIS incidents to Ofwat within 72 hours; Ofwat can impose fines up to GBP 17M or 10 percent of qualifying turnover for non-compliance.
Frequently asked questions
What SCADA software is used in water treatment plants?
Most widely deployed SCADA/HMI platforms in water treatment: (1) A widely used enterprise SCADA platform: dominant in UK water utilities (Thames Water, United Utilities, Severn Trent use it extensively); scalable from single-site to enterprise-wide historian; (2) A second platform: growing rapidly in water sector; subscription licensing; browser-based clients; native OPC-UA; popular for mid-size water utilities and newer SCADA replacements; (3) A major automation vendor's SCADA suite: widely used in European water utilities; integrates natively with the same vendor's PLCs; a separate variant for large distributed systems; (4) An industrial-software vendor's HMI/SCADA suite: established in US water market; integrates with the same vendor's historian; (5) Another automation vendor's SCADA platform: used with the same vendor's PLCs; common in North American water treatment; (6) A further automation vendor's platform: common in French water market. Historian databases: one process historian product is the de facto standard historian in UK and US water utilities for long-term process data storage, reporting, and analytics.
What communications protocols do water SCADA systems use?
Water SCADA uses multiple protocol layers: Field level (instrument to PLC): 4 to 20 mA analogue; HART (digital overlay on 4 to 20 mA, allows remote instrument configuration); Foundation Fieldbus H1 (process instruments, 31.25 kbps); Profibus PA (German automation vendor ecosystem). Control level (PLC to PLC, PLC to SCADA): Modbus RTU (serial RS-485, legacy) and Modbus TCP (Ethernet, widely used); Profibus DP (12 Mbps, European systems); Profinet (real-time Ethernet); EtherNet/IP (US automation vendor ecosystem); DNP3 (telemetry RTUs, especially US water utilities per IEEE 1815). SCADA to enterprise: OPC-DA (COM/DCOM, legacy); OPC-UA (IEC 62541, current standard - encrypted, secure, platform-independent); REST API/MQTT for cloud integration. Telemetry (RTU to SCADA over WAN): IEC 60870-5-101 (serial) and IEC 60870-5-104 (TCP/IP) widely used in UK water utilities; DNP3 over TCP predominant in US; MQTT over 4G for modern deployments. UK Water Industry prefers IEC 60870-5-104 or DNP3 for EA regulatory data transfer (Abstraction/Impoundment telemetry).
How are SCADA alarms managed in water treatment?
Effective alarm management follows ISA-18.2 / IEC 62682 (identical content): (1) Alarm philosophy document: defines alarm priorities, rationalisation criteria, target alarm rates, suppression rules, and operator response requirements - should be completed before SCADA configuration; (2) Alarm rationalisation: each alarm must have a defined consequence, required operator action, and available response time; alarms with no required action become events (not alarms); (3) Priority assignment: Critical (trip/shutdown, immediate action less than 5 minutes, less than 5 percent of total alarms); High (process upset, action within 10 minutes); Medium/Low (informational, operator discretion); (4) Alarm suppression: during startup, shutdown, or known maintenance conditions, non-relevant alarms are suppressed by state-based suppression logic (ISA-18.2 Section 8); (5) Alarm performance KPIs: steady-state alarm rate target less than 6 per hour (ISA-18.2 guidance); standing alarms (active greater than 24 hours) require investigation; (6) UK UKWIR guidance (2018): Good Alarm Management Practice for Water Industry tailors ISA-18.2 to water/wastewater applications. Alarm flooding during events (greater than 10 alarms per 10 minutes) requires flood suppression strategies.
What cybersecurity standards apply to water SCADA systems?
Applicable cybersecurity standards and regulations: (1) UK NIS Regulations 2018 (SI 2018/506): water/wastewater operators designated Operators of Essential Services (OES) must implement appropriate and proportionate security measures; report incidents to Ofwat/NCSC; Ofwat uses NCSC CAF v3.1 for compliance assessment; (2) EU NIS2 Directive (2022/2555/EU): effective October 2024 in EU member states; water/wastewater in scope as 'essential entities'; stricter requirements than NIS1; EU-27 transposition ongoing; (3) US AWIA 2018: community water systems serving greater than 3,300 persons must conduct Risk and Resilience Assessment (RRA) and Emergency Response Plan (ERP) every 5 years; certified to EPA; (4) IEC 62443 series: industrial cybersecurity standard specifying Security Levels (SL0 to SL4); SL2 is minimum for water SCADA (resists intentional violation by sophisticated attacker with limited resources); (5) NIST SP 800-82 Rev 3 (2023): comprehensive ICS security guide for US federal operators and best practice reference globally; (6) NCSC Active Cyber Defence (UK): Suspicious Email Reporting Service, Early Warning service for CNI operators. Key technical controls: network segmentation, MFA, patching, removable media control, OT asset inventory.
Illustrative scenario · Water and wastewater utility operational technology
A composite drawn from typical projects in this category, not a single client engagement. Figures are indicative.
- Challenge
- A UK water company managing 22 water treatment works and 14 wastewater treatment plants was running a disparate SCADA estate across three different legacy platforms, with no network segmentation between OT and IT, remote access via unsecured VPN, and no OT asset inventory. An Ofwat CAF assessment rated the company at inadequate on three of four CAF Objectives, triggering a regulatory requirement to remediate within 18 months.
- Approach
- A specialist OT cybersecurity contractor conducted an OT asset discovery exercise using passive network monitoring, establishing a complete asset inventory of 4,800 OT devices. Network segmentation was implemented using Purdue Model architecture, creating demilitarised zones between IT and OT. Remote access was migrated to a privileged access management solution with MFA. A 24/7 OT security operations centre (SOC) contract was established.
- Outcome
- CAF assessment score improved from inadequate to advanced on all four Objectives within 14 months. Three attempted cyber intrusions were detected and contained by the OT SOC in year one, none of which penetrated to the control layer. The company avoided an Ofwat enforcement action that carried estimated financial penalties of GBP 4.2 million under the NIS Regulations.
Questions to ask shortlisted providers
5
- 01
What is the current SCADA platform, HMI software version, and OT operating system landscape across all sites?
Legacy OT systems (Windows XP, Windows 7, unsupported PLCs) create known vulnerability paths; understanding the estate scope determines whether remediation, migration, or compensating controls are required.
- 02
Is there network segmentation between IT and OT systems and what is the remote access architecture?
Flat IT/OT networks are the most common attack entry point for water utility breaches; separation via DMZ and unidirectional gateways is the baseline control required under IEC 62443 SL2.
- 03
What is the current OT asset inventory and vulnerability management process?
You cannot protect what you cannot see; passive OT asset discovery is the starting point for any cybersecurity programme under NCSC CAF Objective B.
- 04
What incident response and recovery procedures exist for a cyber event causing loss of SCADA control?
Water sector operators must notify Ofwat and NCSC of significant NIS incidents; tested incident response plans and manual fallback procedures are required under CAF Objective D and IEC 62443.
- 05
What is the supply chain cybersecurity policy for SCADA vendors, system integrators, and remote support contractors?
Supply chain compromise (malicious firmware, backdoored remote access tools) is the primary attack vector for sophisticated threat actors targeting critical national infrastructure; vendor security questionnaires and contractual security obligations are required.
What drives cost in this category
4
- OT asset discovery and network segmentation implementation
- Passive OT discovery licensing costs GBP 40,000 to 150,000 per year; network segmentation implementation (firewalls, DMZ, Purdue Model refactoring) costs GBP 200,000 to 1.5 million depending on estate size and complexity.
- SCADA platform modernisation and migration
- Migrating from legacy SCADA (unsupported legacy platforms) to modern platforms costs GBP 500,000 to 5 million for a mid-size utility; rushed migration without cybersecurity-by-design replicates legacy vulnerabilities in new systems.
- Remote access and privileged access management (PAM) overhaul
- Decommissioning insecure VPN and deploying PAM solutions with MFA costs GBP 80,000 to 400,000 depending on number of remote users and sites.
- Ongoing OT security operations centre (SOC) and incident response retainer
- Specialist OT SOC services cost GBP 150,000 to 600,000 per year for 24/7 monitoring of a mid-size utility; incident response retainers with a specialist OT forensics firm cost GBP 20,000 to 80,000 per year.
Key regulations and standards
4
- UK NIS Regulations 2018 (SI 2018/506) and NCSC CAF v3.1
- Water and wastewater operators are designated Operators of Essential Services; Ofwat acts as the NIS competent authority and uses the NCSC Cyber Assessment Framework (CAF) v3.1 to assess compliance across four Objectives (A: Managing security risk; B: Protecting against attack; C: Detecting security events; D: Minimising impact of incidents).
- IEC 62443 Industrial Cybersecurity Series
- International standard defining Security Levels (SL1 to SL4) for industrial control systems; SL2 is the UK water sector minimum, requiring resistance to intentional violation by a sophisticated attacker with limited resources; water company asset standards increasingly mandate IEC 62443-2-4 compliance for SCADA system integrators.
- Ofwat AMP8 Resilience and Cyber Security Expectations
- AMP8 business plan guidance requires water companies to submit documented cyber resilience plans, evidence of CAF assessments, and investment plans for OT security uplift; failure to evidence adequate cyber resilience is a material risk factor in Ofwat's totex and ODI determinations.
- ISA-18.2:2016 Management of Alarm Systems for Process Industries
- Applies to SCADA alarm management in water treatment; specifies alarm rationalisation, documentation, management of change, and operator interface requirements; poorly managed SCADA alarms are a contributory factor in operator error incidents cited in DWI and EA enforcement cases.