Cyber attacks on utilities have increased substantially year-over-year and while most U.S. attacks have been domestic in origin, globally, utilities have been the target of nation states or rogue actors seeking to disrupt operations. In particular, there were several reported breaches of informational (IT) and operational technology (OT) assets, in 2020 and 2021, resulting in data and financial loss and compromised assets, through phishing and other techniques.

Along with a presidential executive order and Justice Department memo from earlier in the year, the Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, the Environmental Protection Agency, and the National Security Agency recently released a joint cyber security advisory related to ongoing cyber security threats to the water and wastewater sector. The joint advisory included recommendations for how to manage cyber threats to protect safety and reliability. Given that U.S. utilities not only provide an essential service to millions of people but also provide water for fire suppression, national defense, health care, ecosystem support, and critical infrastructure, they continue to be attractive targets for cyber criminals. The advisory did not suggest the industry was an outsized target; rather, that the water and sewer sector should increase its mitigation measures and resourcing given the risk profile.

Our Operational And Management Assessment Considers Risk Management

In the U.S. Public Finance group at S&P Global Ratings, we evaluate cyber security preparedness at water and sewer utilities through the Organizational Effectiveness subcategory within our Operational and Management Assessment (OMA). Where we view a utility operator as lacking sufficient risk management policies and practices, it can weaken our view of the issuer's OMA, often resulting in a lower rating than otherwise comparable peers with stronger policies. As cyber attacks increase in sophistication and frequency, we believe U.S. public finance issuers must embed cyber security into their comprehensive risk-mitigation strategies. Along with the OMA assessment, we also consider risk management and mitigation a governance factor under environmental, social, and governance (ESG) as discussed in "ESG Brief: Cyber Risk Management In U.S. Public Finance", published June 28, 2021, on RatingsDirect.

The risks are not just financial

Cyber attacks can cause reputational, regulatory, and financial risks if information breaches occur. These events may also influence a utility's relationship with the customer base, weakening management's rate-setting flexibility. In addition to our evaluation of IT exposures and general cyber hygiene, utilities have a number of potential OT vulnerabilities related to supervisory control and data acquisition (SCADA) systems among other physical asset considerations.

SCADA or industrial control systems are critical to most U.S. utility systems and have been in use since the 1970s. SCADA systems collect, analyze, and visualize data from industrial equipment. Systems are designed to promote efficiency and transparency, which supports operations. From a credit perspective, we view these capabilities as supporting an issuer's operational management. However, if not managed appropriately, these systems can open the door to potential cyber intrusions. This is especially acute when systems are online. Many SCADA systems are aging and lacking in cyber security protections. While systems that are closed or "air-gapped" are less exposed, they are not immune from exposure. Even relatively secure systems can be accessed by laptops and USB drives. Third-party vendors can significantly increase this risk with backdoor access requirements, as further detailed in the report "Cyber Risk In A New Era: Are Third-Party Vendors Unwitting Cyber Trojan Horses For U.S. Public Finance," published Oct. 25, 2021. Several operationally based attacks have stemmed from SCADA vulnerabilities, many of which include ransomware introduced through SCADA or through the network to SCADA. There have been recent examples of OT cyber attacks that involve poisoning the water, shutting down cleaning and disinfection capabilities, changing chemical levels in the supply and shutting down critical operations.

What We Are Watching

Our approach to understanding OT exposure focuses on the tenets of "prepare, respond, recover," which includes understanding the degree of access controls that are in place, system redundancies, and monitoring processes. Monitoring systems support early detection which is one of the most important strategies to reduce the potential impact of an attack. There have been SCADA breaches that have not been uncovered for weeks, which can result in exponentially worse outcomes. If an operational asset is impaired or if an integrated system is shut down (intentionally or by a cyber intrusion), it is important to understand the response and recovery plans, including whether assets can continue to function off network and independently and whether safeguards, such as physical safety systems are in place to respond to a "worst case" scenario.

Issuer disclosure is critically important to determine not only the potential risks but also the mitigation measures. These could include incorporating drafting response plans for a potential cyber security attack and ensuring those plans are updated and tested through walkthroughs as well as tabletop, functional, or full-scale exercises.

Chart 1

Cyber Preparedness Is An Important Credit Consideration

While there isn't a single standard for cyber preparedness, industry associations and federal agencies have provided guidance, recommendations, and tools for utilities to assess cyber resilience. In lieu of a single standard, we look to the utility to demonstrate how it incorporates best practices into its asset inventory, risk assessment, and employee training.

We will continue to track cyber resiliency in the sector as well as whether a federal standard will be set, which we believe would be beneficial for the industry as it would set a minimum floor for cyber resilience and provide guidance for smaller utilities that may not have the sophistication or budget to implement sufficient planning.

Of the utilities that have taken the steps to identify their potential cyber exposures, most have also begun to improve their security. However, survey results from the 2021 Water Sector Coordinating Council and discussions with utilities, especially smaller systems, suggest that many have not taken sufficient steps to assess and address their cyber risks. In our view, failure to implement the most basic standards of cyber security indicates potential credit vulnerabilities. Issuers with strong organizational effectiveness will demonstrate comprehensive cyber readiness which will continue to be a driver of our management assessment for utilities.

We recognize that utilities have significant infrastructure needs. We will continue to evaluate how managers are identifying budgetary resources and prioritizing cyber projects to meet their cyber security needs while balancing other system requirements and rate affordability. Cyber preparedness isn't necessarily measured by a certain percentage of budget. Effective strategies can be scalable and accessible for all utilities.

The U.S. water and sewer sector continues to be an attractive target for cyber attacks given the essential nature of service provided and the depth of information and data within a utility's network. The physical nature of the water and sewer business introduces complexity into organizational decision making with respect to cyber management. A number of technologies that interconnect various physical assets to improve efficiency and transparency may also increase exposure to cyber risks. It is critical for management to balance operational efficiencies with potential cyber disruption. Our OMA evaluation will assess management's approach to determining the appropriate level of interconnectivity and how to mitigate associated risks. The strongest cyber preparedness will include comprehensive policies to assess IT and OT risks as well as detailed response and recovery plans that protect the system and the ratepayers.

Chart 2