Test your defences before attackers test your water supply
The Enhanced CIRMP Rules now set network segregation of critical systems as the benchmark for lateral-movement risk (s 8C). NodeZero tests whether yours holds. Water authorities operate ageing OT systems alongside newer IT networks, creating complex segmentation challenges. NodeZero tests the IT layer — corporate networks, data collection systems, remote access infrastructure — and tests whether compromised IT systems can reach critical water treatment and supply control systems.
Your specific challenges
Enhanced CIRMP requirements
Critical water assets are among the nine classes under the Enhanced CIRMP Rules 2026, phasing in over 24 months (to June 2028). Assets designated as Systems of National Significance can also be required to undertake vulnerability assessments and cyber security exercises.
Ageing OT infrastructure
Legacy SCADA and treatment control systems were not designed for network connectivity, which leaves IT/OT boundaries hard to define and hard to test.
Third-party access
Treatment chemical suppliers, pump contractors and maintenance vendors often need network access. Each connection is a path an attacker can borrow.
Built for your situation
IT/OT boundary validation
Segmentation testing shows whether compromised IT systems can reach water treatment controls. Identifies unintended connections from maintenance ports and contractor VPNs.
Insider threat simulation
Simulates a compromised contractor or rogue employee attempting to escalate privileges and access critical systems from standard user access.
Evidence for CIRMP
NodeZero reports show each proven attack path and whether the fix held on re-test — evidence you can put in front of a CISC reviewer, supporting SoNS obligations where they apply.
Secure your water infrastructure
See how NodeZero validates IT/OT segmentation and insider threat paths in water environments