Summary
The Water Cyber Shield Act, introduced in August 2026, mandates cybersecurity risk assessments and incident reporting for U.S. water utilities while authorizing $300 million annually to fund upgrades. The biggest vulnerability isn't policy — it's the legacy OT equipment running most water systems, which lacks visibility, secure remote access, and a backup path when the primary network fails. Digi's infrastructure management portfolio addresses all three gaps without ripping out existing equipment, and the compliance documentation utilities will need for EPA, CISA, and NIST assessments is built into the workflow from day one.
Cyberattacks on water infrastructure are no longer a theoretical risk; they are happening now. Coordinated incidents have hit community water systems across more than a dozen U.S. states, and federal lawmakers are moving fast. The
Water Cyber Shield Act, introduced in August 2026, authorizes $300 million annually to help utilities fund cybersecurity upgrades and mandates risk assessments and incident reporting for water and wastewater systems nationwide.
This is a genuine turning point for the water sector. But the challenge most utilities face is not a policy gap; it is an infrastructure gap. You cannot protect, audit, or respond to incidents on systems you cannot see or reach.
For the thousands of water utilities still running legacy operational technology (OT) equipment, that gap is closing.
The Vulnerability Is in the OT Layer
Most cyberattacks on water systems go after operational technology: PLCs, RTUs, SCADA systems, pump controls, chemical dosing equipment. These are the devices that actually run the water. Most were engineered decades ago with no network security in mind, communicating over serial protocols that were never meant to connect to the Internet.
But as IT and OT networks have converged, those devices are now reachable from the outside. Without encryption, authentication, or centralized management, they are often the easiest path in for an attacker.
The legislation's risk assessment mandate forces utilities to answer questions that have been easier to defer:
- What devices are on your network?
- Who can reach them?
- What happens when the primary network goes down mid-incident?
Answering those questions takes a different kind of infrastructure investment than most cybersecurity vendors discuss.
Visibility Starts at the Serial Layer
Most water utility field equipment communicates over serial interfaces. Flow meters, pressure sensors, chemical analyzers, RTUs, and older PLCs all speak RS-232 or RS-485. That is not inherently a problem, but it becomes one when those devices connect to IP networks without proper access controls, or get managed through ad-hoc local PCs and adapters that nobody monitors or patches.
The Digi Connect EZ family brings these devices under centralized, encrypted, authenticated management without replacing any equipment or re-running any wiring. Operators monitor, configure, and troubleshoot serial-connected devices from a single portal, with role-based access control, encrypted connections, and automated firmware updates across a distributed fleet. No rip-and-replace. No new wiring. Just visibility and control you did not have before.
For utilities running dozens or hundreds of remote sites, centralized visibility is not a convenience. It is a prerequisite for any serious compliance posture. Learn more.
Out-of-Band Access: The Incident Response Layer You Need Before the Incident
Ask most water utility security teams what their plan is when the primary network goes down during a cyberattack, an equipment failure, or a storm and you often get a pause. That gap is real.
When the network is the problem, you cannot use the network to fix it. That is exactly why out-of-band (OOB) management matters. The Digi Connect IT 16/48 console server gives your team an always-available, independent access path over cellular LTE that's completely separate from your primary network. If your firewall, core switch, or SCADA server goes dark through normal channels, your team can still get in, assess the situation, and respond.
For utilities now facing mandatory incident reporting, speed of response matters twice: operationally and on paper. The faster you can access and contain an incident, the better the documentation you can hand regulators when they ask.
Fewer emergency truck rolls. Faster response. Better documentation. That is what OOB management delivers. Learn more.
Field-Level Telemetry: Knowing What Is Happening Before It Becomes a Crisis
The Act's focus on risk assessments reflects a basic truth: you cannot manage what you cannot measure. Equipment such as pump stations, lift stations, remote distribution nodes, and storage tanks are typically unmanned, and anomalies can go undetected for hours or days.
Digi Connect Sensor XRT-M is a rugged, battery-powered remote telemetry unit built for exactly these environments. It connects to pressure sensors, flow meters, water quality instruments, and other field devices over analog (4-20 mA, 0-10 V), digital, and Modbus interfaces, and transmits data over cellular LTE-M/NB-IoT directly into Digi Axess dashboards or your existing SCADA platform via MQTT.
Battery life runs approximately five years at two reads and transmissions per day. The IP68-rated NEMA enclosure handles outdoor and underground deployment. Setup takes under 10 minutes. And because it operates on cellular rather than your OT network, you get a layer of visibility that does not depend on that network being healthy, which is exactly the point when something goes wrong.
Lifecycle Management and Compliance Documentation
Here is a challenge that does not get enough attention: documentation. Risk assessments require knowing the current state of every device on your network. Firmware currency matters. Access logs matter. Security incident records matter. And when a regulator asks, you need to produce that information quickly.
Digi Remote Manager (DRM) is the cloud-based management platform that ties all of this together. DRM lets you automate firmware updates across individual devices or entire fleets, generate detailed reports on device health and connectivity, create real-time alerts for specified conditions, and maintain an auditable record of every configuration change and access event.
DRM operates in a commercial-grade cloud environment compliant with SOC 1, SOC 2, and SOC 3 standards, supporting NIST, ISO 27002, and HIPAA frameworks. For utilities in air-gapped or highly regulated environments, Digi On-Prem Manager delivers the same capabilities hosted entirely within your own infrastructure; in other words, no data leaves your network.
Digi LifeCycle Assurance (LCA) adds another layer. LCA provides ongoing expert support, 24X7 access to the Digi technical team, and proactive device management across your connected infrastructure. Every Digi device ships with a 5-year hardware warranty; LCA is a separate subscription that adds managed support and faster response on top of that foundation.
The Digi Infrastructure Stack for Water Utilities
Digi Infrastructure Management products are not a collection of standalone tools. They are designed to work together as a unified OT management architecture.
| Layer |
Product |
What It Delivers |
| Field telemetry |
Digi Connect Sensor XRT-M |
Cellular-connected pressure, flow, and water quality monitoring at remote sites |
| Serial/SCADA integration |
Digi Connect EZ 8/16/32 |
Centralized, encrypted management of legacy serial devices |
| Out-of-band access |
Digi Connect IT 16/48 |
Independent access to critical systems when the primary network is unavailable |
| Field visualization and alerting |
Digi Axess |
Real-time dashboards, threshold alerts, and event history for remote site telemetry with no custom integration required |
| Centralized management |
Digi Remote Manager |
Firmware lifecycle, access control, audit trails, real-time alerts |
| Ongoing assurance |
Digi LifeCycle Assurance |
24X7 expert support, proactive management, security currency |
Your operations team works from one place, not five. That matters when you are managing dozens of remote sites and need to move fast.
A Practical Path Forward
Federal mandates and funding cycles create urgency, but they also create a real opening. The Water Cyber Shield Act's $300 million annual authorization for State Revolving Funds means utilities that move now are better positioned to access grant and loan funding for exactly these types of infrastructure upgrades.
You do not need a full infrastructure overhaul to start. Bring your serial-connected OT devices under centralized management. Establish an independent out-of-band access path. Deploy field telemetry at your highest-risk remote sites. That combination addresses the three gaps regulators and CISA auditors find most often: no visibility, no secure remote access, and no incident response capability when the primary network fails.
Digi has been building infrastructure management solutions for utilities, energy providers, and critical infrastructure operators for decades, combining industrial rated hardware and an industry-leading management platform. And the compliance documentation your team will need for EPA, CISA, and NIST assessments is built into the workflow, not bolted on after the fact.
Frequently Asked Questions About the Water Cyber Shield Act and Infrastructure Management
What does the Water Cyber Shield Act require water utilities to do?
As introduced, the bill mandates cybersecurity risk assessments for large water systems and extends mandatory incident reporting to state and locally owned facilities. It also authorizes $300 million annually through the Drinking Water and Clean Water State Revolving Funds to help utilities fund security upgrades. Requirements are expected to align with frameworks from EPA, CISA, and NIST. Important: Confirm the bill's current status before referencing specific compliance deadlines.
My utility runs legacy serial equipment. Do I have to replace it to meet new security requirements?
No, and that is an important distinction. Legacy serial devices like PLCs, RTUs, and flow meters do not need to be replaced. The Digi Connect EZ family brings existing serial equipment under centralized, encrypted, authenticated management over your IP network without touching any wiring or enclosures. You modernize your security posture while protecting your existing equipment investment.
Why is out-of-band (OOB) management important for incident response?
Out-of-band management gives you a separate, independent path to reach critical infrastructure equipment when your primary network is unavailable. That matters most during a cyberattack or network failure, which is exactly when the systems you need to diagnose are unreachable through normal channels. Digi Connect IT 16/48 provides OOB access over cellular LTE, completely independent of your primary network, so your team can respond without dispatching a technician to a remote site.
How does Digi Remote Manager support compliance documentation?
Digi Remote Manager keeps an auditable record of configuration changes, firmware update history, access events, and device health across your entire connected infrastructure. It supports NIST, ISO 27002, and HIPAA frameworks and operates in a SOC 1, SOC 2, and SOC 3 compliant cloud environment. For utilities that cannot send data outside their own network, Digi On-Prem Manager delivers the same capabilities hosted entirely within your private infrastructure.
What is the difference between Digi's 5-year hardware warranty and Digi LifeCycle Assurance?
These are two separate offerings. The 5-year hardware warranty covers the physical device and ships with every Digi product at no additional cost. Digi LifeCycle Assurance (LCA) is a separate subscription that adds 24X7 expert technical support, proactive device management, and accelerated response on top of the hardware warranty. LCA is particularly valuable for utilities with limited internal IT/OT staff or strict uptime requirements.
Can Digi Connect Sensor XRT-M connect to my existing SCADA platform?
Yes. Digi Connect Sensor XRT-M supports native MQTT, so it can publish data directly to any MQTT-compatible broker or SCADA platform. It also supports Modbus RTU and ASCII protocols and connects to up to four sensors simultaneously via analog (4-20 mA, 0-10 V) and digital interfaces. Data flows into Digi Axess for built-in dashboards and alerting, or into your existing SCADA or enterprise system; no middleware is required.
How quickly can Digi Connect Sensor XRT-M be deployed at a remote pump station or field site?
Digi Connect Sensor XRT-M setup takes under 10 minutes. The device ships with preloaded configurations and provisions through the Digi Axess mobile app (iOS and Android). The IP68-rated NEMA enclosure handles outdoor and underground installation, and the dual 12 Ah battery delivers approximately five years of operation at two reads and transmissions per day. No external power infrastructure is required at remote sites.
Is federal funding available to help cover the cost of OT security upgrades?
The Water Cyber Shield Act, as introduced, would authorize $300 million annually through State Revolving Funds specifically to help utilities fund cybersecurity upgrades. Monitor the bill's progress and consult with your state revolving fund administrators about eligibility. Digi can provide documentation on product specifications, security certifications, and management capabilities to support grant and funding applications.
What does Digi Axess provide beyond basic data collection?
Digi Axess is the operational monitoring platform built for Digi field devices. It provides configurable dashboards, real-time threshold alerts, historical data review, and remote device configuration, all accessible via web browser or mobile app. For water utilities, this means operators at a central location can monitor remote pump stations, lift stations, and distribution sites from a single screen without building a custom SCADA integration. When regulators ask for documentation of anomalies or response actions, Axess event history provides a ready audit trail.
Ready to assess your OT infrastructure against the new federal requirements? Talk to a Digi infrastructure specialist today.