Scope of Cybersecurity at a Municipal Water Utility
Northbridge Water Authority supplies 180,000 residents through 14 pumping stations and a SCADA estate managed by an outsourced vendor. The IT security manager argues that the authority's ISO/IEC 27001-certified ISMS already covers cybersecurity because 'SCADA is just another asset in the asset register.' The operations director disagrees, pointing to remote vendor access over the internet, flat connectivity between business IT and OT, and a recent unexplained 20-minute loss of telemetry at two stations. The board has asked for a one-page scope statement for a cybersecurity programme aligned with ISO/IEC 27032. Stakeholders include the regulator, the vendor, local emergency services, insurers, and residents. A draft scope written by IT mentions only 'confidentiality of customer billing data' and excludes OT. The CEO wants clarity on why cybersecurity is broader than information security and who owns the programme.
1. Explain how the concepts of cyberspace, cybersecurity, information security, network security and critical information infrastructure protection apply to Northbridge, and why the IT manager's scope claim is inadequate.
Read the worked answer
Cyberspace is the environment created by interconnected people, software, services and devices; it is not limited to the corporate LAN. Information security protects information assets in any form, network security protects the network infrastructure, internet security protects internet-facing services, and CIIP protects critical infrastructure such as water. ISO/IEC 27032 places cybersecurity at the intersection: preserving confidentiality, integrity and availability in cyberspace while coordinating stakeholders. Northbridge's billing data is information security, but the SCADA telemetry, remote vendor sessions and IT-OT links are cyberspace interactions with safety and availability consequences. An ISO/IEC 27001 asset register is necessary but not sufficient: the IT manager is treating a governance and coordination problem as an inventory problem. The unexplained telemetry loss shows that availability and incident response are in scope. A defensible scope would include OT/IT convergence, remote access, monitoring, incident coordination and supplier oversight, while defining interfaces to physical security and enterprise IT. The programme owner should have authority across IT, OT and suppliers, not sit only in IT.
2. Identify the stakeholder categories and coordination gaps, and propose a scope statement with at least four in-scope elements and two explicit exclusions.
Read the worked answer
Stakeholder categories: internal governance (board, CEO, operations, IT, legal, HR), operational (control-room operators, maintenance), external service providers (SCADA vendor, telecoms), regulators, emergency services, insurers, and residents. Coordination gaps: the vendor is outside governance; the regulator's expectations are not mapped to incident notification; emergency services are not in joint exercises; insurers see no evidence; residents are not considered in service-disruption communications. A scope statement should state: in scope are SCADA/telemetry availability, remote vendor access, IT-OT interconnections, cybersecurity incident response with regulators and emergency services, and operator awareness. Out of scope are physical guarding of station fences, owned by facilities with an interface procedure, and residents' personal devices. Exclusions are acceptable only if interfaces and residual risk are documented. The scope should name the accountable executive and review cycle. This reasoning separates asset ownership from cybersecurity governance and prevents the IT-only draft from leaving OT unprotected.