Skip to main content
Cybersecurity assessments

Cybersecurity assessments

A cybersecurity assessment is a process that helps organizations identify, evaluate, and mitigate cyber risks to their operations, assets, and personnel. It involves analyzing vulnerabilities, threats, and security measures to enhance overall cybersecurity resilience. Cybersecurity assessments are not mandated by the Safe Drinking Water Act, but they are highly recommended.

Why are these assessments important?

Cyber attacks can cause service disruptions and impact public health.

Cyber criminals can gain access to protected employee and customer information.

What do they do and why are they done?

Cybersecurity assessments ensure the protection of operational and critical functions, as well as ensuring overall cybersecurity resilience.

These assessments are the first step for a water supply to get cyber insurance coverage. They establish a cybersecurity baseline for future comparisons and can be conducted internally or with external support.

What can I expect during an assessment?

Cybersecurity assessments are performed by in depth evaluation of your information technology (IT) and operational technology (OT) critical infrastructure and encompasses the components listed in Step 2.

The cyber assessment generally takes 2-4 hours to perform.

The cyber assessor will use industry wide assessment tools such as CISA’s 38 cybersecurity performance goals (CPG) or a similar tool to assess cyber resiliency.

Who will perform the assessment?

Cyber assessments can be performed by CISA, Michigan Command Center (MC3), or third-party vendors specializing in cybersecurity.

Components of a cybersecurity assessment

Download a printable flyer

Identify

  • Cybersecurity leadership within the organization
  • Operational technology (OT) and information technology (IT) equipment inventory
  • Vulnerabilities related to cybersecurity
  • Partnerships to enhance cybersecurity resiliency
  • Vendors and suppliers that are operating under best practices for cybersecurity

Protect

  • Water supply by practicing password hygiene, credential management (unique credentials for each user and revoking credentials for departing employees)
  • Water supply by separating user and privileged accounts, network segmentation between operational technology and information technology networks, monitor unsuccessful login attempts on operational technology and IT networks, and incorporating multi-factor authentication
  • Water supply by regularly storing backups, creating incident response plans, managing login records, prohibiting connections of unauthorized devices, limiting operational technology connections to public internet, etc.

Detect

  • Establish capability of detecting cyber actor tactics, threats, and procedures and documenting the threats

Respond

  • Have standard operating procedures in place of how to report and who to contact in the event of a cybersecurity incident

Recover

  • Organizations are capable of safely and effectively recovering from a cybersecurity incident