30 questions across 7 control domains. AWWA V4.0 and EPA-aligned. Understand your risk posture and see where your gaps are before an attacker finds them.
AWWA V4.0 requires all OT/ICS devices documented before any other controls. Use AWWA's Getting Started Guide to complete an inventory within 30 days.
We deploy a passive network tap to discover every ICS device communicating on your network — including devices no one knew existed. Cross-referenced against Shodan for internet exposure. Results in 48 hours.
EPA guidance and AWWA both list internet exposure of PLCs/HMIs as the single highest-priority risk to remediate immediately. Remove all direct internet paths to control systems.
We run a Shodan/Censys search against your public IP ranges and SCADA domains before the engagement begins. On-the-call, we'll show you what adversaries can already see about your systems.
AWWA Getting Started Guide Step 1: Unitronics Vision Series, Siemens S7, Allen-Bradley PLCs, and most HMIs ship with known default passwords publicly listed online.
We test against the CISA Known Exploited Vulnerabilities catalog for your specific device makes and models — including Unitronics, Siemens, Rockwell, GE, and Schneider Electric.
AWWA and EPA both require logical or physical separation between IT and OT networks. Flat networks are the root cause of most water sector incidents.
Passive capture of Modbus, DNP3, and EtherNet/IP traffic to map exactly how your OT network communicates. Identify flat-network paths an attacker would use to pivot from IT to PLC.
EPA priority control: all remote access (VPN, RDP, vendor tools) to OT systems requires multi-factor authentication. Single-factor remote access is not acceptable.
We enumerate all remote access paths (including shadow IT: TeamViewer, AnyDesk, cellular modems) and hunt for unauthorized remote sessions in logs going back 90 days.
AWIA 2018 §2013 legally requires a cybersecurity IRP. AWWA provides a template. It must cover OT-specific scenarios and be tested within 12 months of creation.
We deliver a ready-to-sign AWIA-compliant incident response plan as part of every assessment — tailored to your specific SCADA platform, control systems, and utility size. Includes tabletop exercise guide.
AWWA V4.0 Priority 2: deploy OT-aware monitoring tools. Passive monitoring of ICS protocols (Modbus, DNP3) to detect unauthorized commands or anomalous behavior without impacting operations.
After the assessment, RedEye offers continuous passive monitoring of your OT network — $5,000-$12,000/month depending on site count. We alert on unauthorized control commands, new devices, and active threat IOCs targeting water sector.
RedEye's 2-week OT assessment covers everything above — with findings, prioritized remediation, and AWIA certification documentation. Most engagements are fully grant-funded.