You do not need to understand SCADA to govern it. You need to know whether someone is accountable for it. These eight questions can be read aloud at a board meeting by anyone, and the answers belong in the minutes.
1. Who can log into our control system from outside the plant?
Good answer: a named, current list, and confirmation that no controller or cellular modem can be reached straight from the internet. Warning sign: "I'd have to check," or a list that includes former employees or old vendors. Exposed controllers were how more than 100 water systems were hit in July 2026.
2. Have all default passwords on our equipment been changed?
Good answer: yes, and here's how we verified it. Warning sign: "the vendor set that up." Default credentials are how the Muleshoe, Texas tank overflow happened in 2024.
3. Does remote access require more than a password?
Good answer: yes — a code or an app, every time. Warning sign: a shared password used by several people.
4. If you operate other districts, can one login reach all of them?
Good answer: each district is separated, and here's how. Warning sign: silence. Multi-district exposure through a shared platform is the specific weakness attackers used against Texas utilities in 2024.
5. How would we know if someone changed a setting remotely?
Good answer: the system logs changes and alerts a person. Warning sign: "an operator would notice." At Muleshoe, nobody noticed for up to 45 minutes.
6. Do we have a written plan for losing the control system?
Good answer: yes, we can run manually, and we've practiced it this year. Warning sign: a plan that exists but has never been tested, or one written for flooding and never updated for a cyber event.
7. Does AWIA §1433 apply to us, and are we certified?
If your system serves 3,300 or more people, federal law requires a cybersecurity risk and resilience assessment and a certified emergency response plan, refreshed every five years. The most recent recertification deadline for systems in that range passed on June 30, 2026. Good answer: a certification date. Warning sign: "I think our engineer handled that."
8. What would it cost to fix the gaps, and who pays?
This is the question that turns a concern into a project. Federal and state programs — SLCGP through the Office of the Governor, and the state revolving funds through the Texas Water Development Board — exist to pay for exactly this work. The district applies, the funding comes to the district, and the district hires the vendor.
If seven of these eight answers are "I'd have to check," that is not a crisis. It is a completely normal starting point for a small district — and it is documentable, fundable work.
What to do with the answers
Put them in the minutes. A board that has asked these questions on the record and started a funded plan is in a very different position — legally and practically — than one that has not, whether the next event is an audit or an incident.