Municipal water and wastewater systems sit at the centre of public safety.
When something goes wrong, it is not abstract. It shows up in service disruption, environmental impact, and loss of public trust.
A Western Canadian municipality recognized it was exposed but lacked a clear, defensible view of its operational technology security risks. Without that clarity, it could not confidently prioritize action or secure funding.
Compugen led a full OT security assessment aligned to ISA 62443, a globally recognized standard that helps organizations assess risk and secure critical infrastructure systems. The result was a clear, credible roadmap the municipality could use to move from concern to action.
This municipality is responsible for operating and maintaining critical water and wastewater infrastructure. Systems that rely on operational technology to monitor and control flow, treatment, and safety.
Like many public sector organizations, the environment had evolved over time. Infrastructure aged. Systems expanded. Connectivity increased. Security did not always keep pace.
Several challenges stood out:
Aging infrastructure supporting critical operations, including network components well past recommended lifecycle
Flat network architecture, making it easier for threats to move between systems
Limited separation between IT and OT environments, increasing potential exposure to other Municipal Services
Multiple remote access methods, often tied to vendors and difficult to centrally manage
Lack of formal OT security ownership and policy structure
There was awareness that risk existed. What was missing was a structured way to measure it, communicate it, and act on it.
In an environment where systems control water quality, chemical dosing, and flow rates, that gap matters.
The shift started with a single voice.
An engineer within the water treatment operation identified cybersecurity as a growing concern and raised it internally. That perspective helped connect operational risk with broader IT and leadership priorities.
At the same time, there was growing recognition that informal approaches were no longer enough. The municipality needed to align with a recognized standard and bring consistency to how risk was assessed and managed.
This created a clear opportunity to step back, assess the environment properly, and establish a baseline that could support real decisions.
Compugen led a full OT security gap and risk assessment aligned to ISA 62443, a globally recognized framework for securing industrial and critical infrastructure environments.
The approach was structured, detailed, and built to stand up to scrutiny.
To strengthen credibility, a certified third-party assessment organization conducted the audit. This ensured the findings were objective and could be used confidently in internal planning and funding discussions.
The engagement included:
A detailed review of OT systems across water and wastewater environments
Evaluation against ISA 62443-aligned controls
Identification of security gaps across governance, network design, access control, and system management
A prioritized roadmap outlining immediate actions and longer-term initiatives
Midway through the engagement, procurement requirements introduced an RFP process. Compugen maintained its position, navigated the shift, and expanded the scope to include the wastewater treatment environment.
Throughout the engagement, Compugen worked closely with engineering, IT, and leadership teams. Regular touchpoints kept the project aligned and ensured the findings reflected both technical reality and operational context.
The assessment brought clarity to a complex environment.
It showed that a significant portion of evaluated controls were not fully aligned, highlighting gaps that could impact both security and operational resilience.
More importantly, it gave the municipality something it did not have before:
A defensible, standards-based view of its OT security posture
Clear visibility into where risk exists and how it could impact operations
A prioritized set of actions, including immediate steps internal teams could begin addressing
A structured roadmap to guide future investment and modernization
Immediate opportunities included improving access controls, tightening password and credential practices, updating documentation, and addressing basic system hygiene.
Longer-term priorities focused on:
Network segmentation and improved architecture
Centralized monitoring and logging
Stronger remote access controls
Development of formal OT security policies and incident response planning
The shift was practical.
Instead of broad concern, the municipality now had a clear plan. One that could be communicated, funded, and executed.
The assessment is already shaping what comes next.
Internal teams are using the findings to guide planning and prioritize remediation efforts. Conversations are underway to move forward on infrastructure upgrades, network improvements, and ongoing security support.
The engagement has also created momentum beyond a single municipality. Other public sector organizations are facing similar challenges and looking for a way to bring structure and clarity to their environments with Compugen.
This was not a transactional engagement.
Compugen started with a single operational contact and quickly built alignment across engineering, IT, and leadership. That mattered, because OT security sits across all three.
The team kept a consistent cadence of communication, translating technical findings into clear business impact so each group understood the risks and their role in addressing them.
Credibility came from two places. Depth in OT environments, and a structured, standards-based approach backed by independent validation.
By the time the findings were delivered, stakeholders were aligned and confident in the path forward.
That foundation is now carrying into the next phase, with Compugen positioned as a trusted partner.
If you are responsible for municipal or critical infrastructure, you are likely facing the same challenge. You know there are risks. The question is whether you can clearly define them and act on them.
Compugen helps public sector organizations assess their environments, prioritize what matters, and build a path forward that stands up to scrutiny. Start the conversation.