An 'accept' entry in a water utility's risk register

'Accept' is defensible only if it is a decision someone with authority actually made, with residual risk written down, compensating controls named, and an expiry date. On these facts the register shows a bare 'accept' at likelihood 2, impact 5 - and for a water utility, impact 5 means public health, not a fine.

Interrogate the likelihood. 2 assumes the attacker needs network access to the HMI protocol, which is true. But the advisory exists, three sites run firmware that becomes unsupported in December, and the SCADA hosts run an operating system out of support since October 2023 - so any pivot from the office network, a vendor remote-support session or a USB stick reaches the HMI. Likelihood 2 is somebody's judgement, not a measurement, and it must be justified in writing or revised.

Note the triad asymmetry. The dominant risk is integrity, not availability. Silently altered dosing setpoints can produce normal-looking HMI readings while the water is wrong - worse than an obvious outage and much harder to detect. Availability failures at least announce themselves.

So: acceptance is defensible only if segmentation ships before October and the board signs the residual. Otherwise the correct entry is 'mitigate with compensating controls, accept residual', with a named owner and a review trigger.

Ranked by risk reduced per dollar, then by speed to implement:

1. IT/OT segmentation and inter-site boundaries ($35,000). Deny-by-default at a managed switch or firewall, permitting only the specific HMI flows to specific hosts. This attacks the advisory's precondition - network access to the protocol - and is available now. Highest value.
2. Broker vendor remote access. No standing vendor VPN accounts; a jump host with MFA, session recording, and sessions only in scheduled windows. A large share of real water incidents enter through exactly this door.
3. Harden the HMI hosts. Application allow-listing, no email or browsing on SCADA hosts, local firewall rules limiting which addresses may speak the HMI protocol, unused services disabled. The Windows Server 2012 R2 lifecycle makes this an interim measure, not a fix.
4. Detection tuned to integrity. Alert on setpoint changes outside a defined band, new devices appearing on the OT network, and HMI logons at unusual hours. Setpoint-delta alerting is cheap and directly catches the attack that matters.
5. Rehearse manual operation. Verify the four-hour storage figure with a real drill at one site; the whole outage calculus currently rests on an untested number.

The refresh still matters, but sequence the three v3.8 sites first - they lose vendor support before the October budget lands, so the firmware deadline must drive the order of work.

Four elements separate a governed acceptance from a formality:

1. Named authority with the delegated limit. For a municipal utility the general manager or board should sign, not the security lead, because the consequence includes public health and continuity of supply. Check the delegation-of-authority document before the meeting - accepting a risk you are not authorised to accept is itself a finding.
2. Consequence-language risk statement, not just numbers: 'An undetected setpoint change at site X could deliver water outside permit limits for up to N hours before sampling detects it.' Include the basis for likelihood and impact.
3. Compensating controls with owners and dates, plus trigger conditions that reopen the decision - a new advisory, a failed manual-operation drill, segmentation slipping past October. A review date alone invites drift.
4. Expiry and exit. The acceptance lapses in six months or at refresh completion, whichever is first, and the register entry closes only when the upgrade is verified - not when the purchase order is raised.

Also separate two different entries: 'we accept the residual risk that remains after segmentation' is governance. 'We accept doing nothing' presented to a board that regulates drinking water reads very differently in a post-incident review. Minute the discussion, not just the outcome.