Water treatment plants and transit agencies across the United States now face a direct federal warning: plan for the day your internet connection disappears. CISA has expanded its public-safety communications toolkit with nine new resources aimed at helping essential services maintain operations when normal connectivity fails. The guidance arrives alongside a separate federal advisory confirming that state-linked hackers have already compromised American telecom networks, giving the warning a sharp operational edge.
Why water and transit agencies face a connectivity reckoning
Most water utilities and transit systems depend on always-on internet for supervisory control and data acquisition, known as SCADA, as well as dispatch, incident command, and real-time passenger information. A prolonged internet outage does not just slow down email. It can blind operators to pressure changes in a water main, halt automated chemical dosing, or leave bus and rail dispatchers unable to track vehicles. CISA’s position, stated plainly in its updated toolkit, is that “public safety and essential services must plan communications resiliency in advance for emergency events.” That language signals a shift from treating internet loss as a brief inconvenience to treating it as a scenario that demands rehearsed, tested fallback procedures.
The practical difference between agencies that adopt CISA’s exposure-reduction steps early and those that rely on generic continuity templates is likely to show up fastest in two areas: how quickly dispatchers can restore voice and data coordination, and how long SCADA systems can operate in a degraded or manual mode. Agencies that have already mapped their internet-facing dependencies and removed unnecessary external connections will have fewer failure points to troubleshoot. Those still running default configurations will spend the first hours of an outage simply figuring out what stopped working and why.
Federal guidance, telecom compromise, and the threat driving the timeline
CISA’s updated toolkit is not a single document. It is a collection of nine new resources covering communications continuity, cyber resiliency, and interoperability for public-safety organizations. Separately, the agency maintains an index of emergency communications guidance covering the Government Emergency Telecommunications Service, or GETS, along with interoperability standards and planning templates that transit operations centers and water utility incident commanders can adapt.
The Federal Transit Administration has built its own cybersecurity hub specifically for transit operators, linking them to DHS and CISA materials. That FTA resource page creates a single entry point for agencies that may not have dedicated cybersecurity staff but still need to meet federal expectations for preparedness.
Behind all of this planning guidance sits a concrete threat. CISA, the NSA, the FBI, and international partners jointly published hardening guidance for communications infrastructure after confirming that actors affiliated with the People’s Republic of China compromised U.S. telecom networks. That advisory is not hypothetical. It documents an active compromise and provides technical steps for network defenders to detect and expel intruders. For water and transit operators, the implication is direct: the commercial internet and telecom links they rely on for daily operations have already been targeted by a capable adversary, and those links cannot be assumed reliable during a crisis.
CISA’s internet exposure reduction guidance translates that threat into action items. It instructs organizations to identify and disable unnecessary internet-facing services, remove external dependencies that are not operationally required, and shrink the attack surface that an adversary or a natural disaster could exploit. For a water utility, that might mean ensuring that a SCADA historian database is not reachable from the public internet. For a transit agency, it could mean verifying that vehicle-tracking feeds have a local fallback when cloud connections drop.
Gaps in adoption data and what operators should watch next
The federal guidance is clear, but the adoption picture is not. No primary CISA or Department of Transportation document currently published supplies data on how many water or transit agencies have completed offline communications plans or conducted internet-blackout exercises. Without that baseline, it is difficult to measure whether the new toolkit is accelerating real change or sitting unread on agency intranets. The absence of sector-specific case studies or after-action reports documenting actual internet-loss incidents at utilities compounds the problem. Agencies looking for proof that these steps work in practice will find federal recommendations but little published evidence from peers who have tested them under stress.
Water utilities face an additional gap. The CISA toolkit and emergency communications index address public safety broadly, and the FTA hub speaks directly to transit. But no dedicated federal publication in the current resource set targets water and wastewater systems with the same specificity. Water operators will need to adapt general public-safety materials to their own control environments, which differ significantly from transit dispatch in architecture and risk profile.
For operators at both types of agencies, the first practical step is to inventory every system that depends on an external internet connection and determine which of those systems must function during a prolonged outage. CISA’s exposure-reduction guidance provides a framework for that audit. Agencies that complete it will know exactly which services to prioritize for local fallback capability and which can tolerate downtime. Those that skip the inventory risk discovering their blind spots only when connectivity actually fails.
More from Morning Overview
*This article was researched with the help of AI, with human editors creating the final content.
