Franklin - What worked, what didnt, and how we are giving agency to water utilities

The talk introduces the Water Watch Center, a new entity meant to deliver cybersecurity at scale to American water utilities. The speakers note that about 150,000 utilities want to do security properly but have no staff or budget, and they cannot easily raise rates to pay for it. The proposed structure is meant to act like a nervous system: the National Rural Water Association serves as the hub, while five managed security service providers, one per CISA region with a plan to reach ten, handle day-to-day work and share anonymized data upward.

A volunteer named David describes helping a small town public works department with four employees and no in-house IT. The engagement started with a full assessment and asset inventory, then moved to coordinating with the town's outside vendors and fitting controls to a budget that began at zero. He found that basic hygiene, such as multifactor authentication on public-facing systems, landed best when explained through patient, listening-first conversations. Josh Corman argues that losing water quickly disables hospitals, and describes a parallel effort to engineer resilience for a dozen hospital towns.

In questions, the speakers argued that free vendor products often carry hidden staffing costs, and that some security appliances themselves have exploited vulnerabilities, so technology is not always the answer. The main takeaway is that these utilities lack people more than tools, and that sustained federal funding for the rural water association is needed to keep the model running.