
Water & Waste
Drinking water infrastructure is a primary target for nation-state actors. Operational technology is often decades old and not designed for network connectivity.
of CISOs anticipate geopolitically motivated attacks on critical infrastructure; water infrastructure ranks highest
Cybersecurity in water & waste: what it involves
Cybersecurity in the water sector is about protecting drinking water companies, treatment plants and waste water management against disruption and manipulation. Drinking water and waste water are listed in NIS2 Annex I, implemented in the Netherlands through the Cyberbeveiligingswet (Cbw), and organisations designated as critical entities also fall under the Critical Entities Resilience Act (Wwke). Operational technology is often decades old and was not designed for network connectivity. The main threats are manipulation of water and treatment processes, ransomware on SCADA management systems, legacy OT that cannot be patched and geopolitically motivated attacks by nation-states. Water companies and water boards therefore mainly hire OT/ICS security specialists with water experience, NIS2 implementation coordinators, network security engineers for segmentation and business continuity and crisis response experts. IEC 62443 is the common standard here.
Key Threats
Manipulation of water treatment processes
Ransomware on SCADA management systems
Legacy OT without patching capability
Geopolitical attacks (nation-states)
MVPeople delivers
OT/ICS Security specialists (water)
NIS2 implementation coordinators
Network Security Engineers (segmentation)
Business Continuity & crisis response experts
48u
Average time-to-shortlist
97%
Clients return
7.000+
Professionals in network
100%
Cybersecurity focus
Frequently asked questions
Dutch drinking water companies fall under the Cyberbeveiligingswet (Cbw), the Dutch implementation of NIS2, because drinking water and waste water are listed in NIS2 Annex I. Organisations designated as critical entities also fall under the Critical Entities Resilience Act (Wwke), which also covers physical threats such as sabotage. For securing the OT environment, the ISA/IEC 62443 series is the common benchmark.
A water company mainly needs OT/ICS security specialists who can secure SCADA systems and treatment processes without putting availability at risk. Network security engineers for segmentation, NIS2 implementation coordinators and business continuity and crisis response experts are also important. Because much of the OT is old and cannot be patched, the focus is on segmentation, monitoring and the ability to recover.
MVPeople Group responds to every request within 4 hours and delivers introduction CVs for interim roles within 24 hours, often with a first profile within 4 hours. Candidates come from a network of more than 7,000 pre-screened cybersecurity professionals, including OT/ICS specialists and business continuity experts. MVPeople is NEN-4400-1 certified, WAADI registered and works DBA-proof.
Interim fits defined projects, such as a risk assessment after designation as a critical entity, a segmentation project or setting up an OT security programme. Permanent hiring fits day-to-day operation and monitoring of the process environment. A common approach is an interim specialist who lays the foundation and a permanent employee who embeds it afterwards. Through MVPermanent, permanent hiring typically takes 2 to 4 weeks.
Last updated by Mathijs Visser, Co-founder and Lead Consultant MVPeople Group.
Other NIS2 sectors
MVPeople Group places cybersecurity professionals across all NIS2 sectors.
Need cybersecurity talent for water & waste?
We introduce the first qualified interim candidates within 24 hours. 100% cybersecurity. 100% focus.



