®01
Control systems and network control with zones under IEC 62443
Zone model with risk analysis under IEC 62443-3-2
More on thisIndustries / Water
Secure technology. Reliable supply.
Protect control systems and securely connect water and wastewater facilities.
Consulting. Integration. Operations.
Built around your industry.
- Water suppliers and municipal utilities
- Wastewater utilities and treatment plants
- Water associations and municipal enterprises
- Long-distance water suppliers and reservoir operators
Your priorities
Understand the challenge. Shape the solution.
We secure the control systems of waterworks and treatment plants in line with IEC 62443, connect remote sites over encrypted links and analyze operational data to detect disruptions early.
02
Sensor data platform for leak detection and water quality
Sensor data platform connected to control system, meters and laboratory
More on this03
Customer and billing systems with GDPR-compliant data handling
Integration architecture with interface catalog and data contracts
More on thisFrom strategy to implementation
Six service modules
Six fields of expertise. Explore the scope that fits your project.
01Control systems and network control with zones under IEC 62443IEC 62443-3-3 · OPSWAT MetaDefender Industrial Firewall · OPSWAT MetaDefender NetWall
Our approach
Process control systems in waterworks and treatment plants and the network control systems of distribution often stay in service for decades and rarely receive security updates. We divide these systems into zones and conduits with security levels under the IEC 62443 series, separate the process network from office IT and place firewalls and security gateways in front of controllers that cannot be hardened themselves. Passive OT monitoring detects unknown devices and unusual commands in the control network without intervening in control.
Full scope
- Inventory of control systems, controllers and communication paths with risk analysis under IEC 62443-3-2
- Zone model with conduits and security levels for waterworks, treatment plant, network control center and office IT
- Segmentation with industrial firewalls and security gateways in front of legacy systems, aligned with maintenance windows
- Passive OT monitoring with Microsoft Defender for IoT connected to the SIEM
- Hardening and patch concept per zone under IEC 62443-3-3 and the IND modules of BSI IT-Grundschutz
A water supplier separates the process control system of its waterworks from office IT and places a security gateway in front of the filter plant controllers; OT monitoring reports a forgotten connection to an old maintenance computer for the first time.
What you get
- Zone model with risk analysis under IEC 62443-3-2
- Segmented networks with documented firewall rules
- OT monitoring connected to the SIEM and reporting process
02Secure remote maintenance for pumping stations and remote sitesIEC 62351 · IPsec · Evertrust PKI
Our approach
Pumping stations, wells, storage tanks and stormwater tanks are scattered and operated through telecontrol and remote maintenance, often with routers in factory settings and shared accounts. We connect the stations over encrypted links with device certificates whose CA keys sit in a hardware security module, and we secure telecontrol protocols under IEC 62351. Service providers reach plants only through a jump server with multi-factor authentication, time-limited approval and session recording.
Full scope
- Inventory of all remote sites, routers, mobile and fiber links and remote access paths
- IPsec links with device certificates from a PKI, CA keys in the HSM, enrollment via EST or SCEP
- Securing IEC 60870-5-104 under IEC 62351 and OPC UA with certificates and signed messages
- Jump server with multi-factor authentication, approval per session, session recording and privileged access management
- Inspection of service providers' maintenance laptops and removable media with OPSWAT MetaDefender Kiosk
A wastewater association replaces the open remote access to its pumping stations with IPsec links and device certificates; vendors now maintain the stations only through a jump server with approval and recording.
What you get
- Remote maintenance concept with roles, approvals and session logs
- PKI with HSM-protected CA keys and certificate policy
- Encrypted connection of all remote sites with operations manual
03Sensor data platform for leak detection and water qualityOPC UA · MQTT · LoRaWAN
Our approach
Flow, pressure and quality sensors, radio water meters and laboratory values deliver readings continuously, but only a shared platform turns them into a picture of the network. We build this platform in the cloud or in a German data center, take measurements from the control system through a data diode or gateway and combine them with meter and laboratory data. Night flow per district metered area, pressure curves and quality values such as turbidity, conductivity and chlorine are available in dashboards for network operations and quality assurance.
Full scope
- Connection of control system, sensors and radio water meters via OPC UA, MQTT and LoRaWAN, feedback-free through a data diode
- Time series database with data catalog, quality rules and a common time reference across all sources
- Night flow analysis per district metered area and comparison of input and consumption for the water balance
- Dashboards for network operations, waterworks and quality assurance with limit values under the German Drinking Water Ordinance
- Operation on Kubernetes in a German cloud or Azure with access concept and pseudonymization of meter data
A municipal utility combines flow measurements from its metered areas with radio water meter data; rising night flow in a residential area leads the network foreman to a leak before water reaches the surface.
What you get
- Sensor data platform connected to control system, meters and laboratory
- Dashboards for water balance, night flow and quality values
- Operating and access concept with data protection documentation
04Demand forecasting and anomaly detection with machine learningXGBoost · LSTM · Isolation Forest
Our approach
Waterworks often run pumps, treatment and tank levels by experience, although weather, calendar and consumption history describe demand well. We train models that forecast water demand per supply zone and inflow to the treatment plant, and models that report deviations in pressure, flow, quality and pump behavior. The models give recommendations, and operations staff decide. Used as a safety component of water supply, they count as high-risk systems under the EU AI Act, so we document data, limits and human oversight from the start.
Full scope
- Demand forecast per supply zone from consumption history, weather data, school holidays and public holidays for pump and tank schedules
- Inflow forecast for treatment plants and stormwater tanks from precipitation data of the German Weather Service and water levels
- Anomaly detection for pressure, flow, quality values and pump behavior with feedback from operations staff
- Model operations with MLflow, versioning, data drift monitoring and controlled retraining
- Classification and documentation under the EU AI Act with a concept for human oversight and logging
A water supplier plans the pump schedules of its storage tanks with a demand forecast for the next day; operations staff confirm every recommendation, and conspicuous pressure drops appear as alerts in the control room.
What you get
- Versioned forecasting and anomaly models with model card
- Recommendations and alerts integrated into control room or dashboard
- Documentation under the EU AI Act with oversight concept
05Customer and billing systems with GDPR-compliant data handlingSAP S/4HANA Utilities · OpenAPI · Apache Kafka
Our approach
Customer management, metering and the billing of water charges and wastewater fees often run in grown systems that import meter readings by file and keep customer data without retention periods. We integrate billing, customer portal, remote meter reading and financial accounting through versioned interfaces, for example when introducing SAP S/4HANA Utilities, and map the split wastewater fee for sewage and rainwater. Consumption data gets a legal basis, purpose limitation, a role concept and a deletion concept under DIN 66398, and it is pseudonymized for analytics.
Full scope
- Interface catalog across billing, customer portal, remote meter reading, geographic information system and financial accounting
- Integration or migration to SAP S/4HANA Utilities with data migration, tests and parallel operation
- Mapping of water charges and the split wastewater fee with area data from the geographic information system
- Customer portal with login via OpenID Connect, meter reading submission and electronic invoice delivery
- Data protection concept with record of processing activities, deletion concept under DIN 66398 and pseudonymization for analytics
A water association moves its billing to SAP S/4HANA Utilities and imports meter readings from radio reading through an interface; consumption data is deleted after fixed periods and passed to the data platform only in pseudonymized form.
What you get
- Integration architecture with interface catalog and data contracts
- Tested billing and portal integration with migration log
- Data protection concept with deletion concept and record of processing activities
06KRITIS and NIS2 compliance with the B3S Wasser/AbwasserB3S Wasser/Abwasser · ISO 27001 · BSI IT-Grundschutz
Our approach
Operators of critical facilities in water supply and wastewater disposal regularly demonstrate their measures to the BSI, and NIS2 extends the obligations to many more utilities. The B3S Wasser/Abwasser of the industry associations DVGW and DWA translates these requirements into measures for plants and organization. We determine the scope, run the gap analysis against the B3S, build the ISMS, set up attack detection and reporting and prepare the audit.
Full scope
- Scope definition with critical facilities under the BSI Act, NIS2 classification and registration with the BSI
- Gap analysis under the B3S Wasser/Abwasser with a prioritized action plan and owners
- ISMS under ISO 27001 or BSI IT-Grundschutz with risk analysis, policies and management review
- Attack detection systems for control network and office IT, reporting process with the NIS2 deadlines and emergency drills
- Audit preparation, support during the audit and training for management on its obligations
A water supplier above the KRITIS threshold maps its measures to the B3S Wasser/Abwasser, closes the gaps in remote maintenance and attack detection and submits evidence to the BSI without significant deficiencies.
What you get
- Scope and gap analysis under the B3S Wasser/Abwasser
- ISMS documentation with risk analysis and action plan
- Audit documents, reporting process and drill reports
Typical project situations
Where change becomes tangible.
A specific challenge is often the starting point. These examples connect a typical situation with a possible approach and the intended result.
Illustrative situations, not customer references.
01 / Water
Remote maintenance at a wastewater association
Pumping stations connected through routers in factory settings, vendors with shared accounts and permanently open access, audit under the BSI Act announced.
Solution
Encrypted connection of all pumping stations with device certificates from an HSM-backed PKI, jump server with approval and recording, zone model under IEC 62443 for the treatment plant.
Traceable remote access per service provider, separated networks without operational interruption, evidence for the audit.
02 / Water
Water loss at a municipal utility
Rising water losses, metered areas without analysis, pipe bursts noticed only at the surface.
Solution
Sensor data platform with metered areas, radio water meters and control system data through a data diode, anomaly models for night flow and pressure.
Leaks found earlier, network crews plan work orders from platform alerts, water balance per zone for management.
03 / Water
Getting started with NIS2 at a water association
The association newly falls under NIS2, small IT team, measures spread across spreadsheets, no rehearsed reporting procedures.
Solution
Classification and registration, gap analysis under the B3S Wasser/Abwasser, ISMS under BSI IT-Grundschutz, attack detection as a managed service.
Prioritized action plan with owners, rehearsed reporting procedures, management that knows and fulfills its obligations.
Working together
A clear path. With your team.
From an initial assessment to ongoing operations, we agree on priorities, responsibilities and the results of each stage.
How we work
- 01
Assessment
Plants, networks, remote access, data sources and regulatory gaps
Prioritized list of measures, inventory of plants and access paths, gap analysis for B3S Wasser/Abwasser, KRITIS and NIS2 - 02
Concept
Zone model, remote maintenance concept, data platform, operating model
Target architecture, zone model, PKI concept, interface catalog, operating model, test concept - 03
Implementation
Segmentation, remote maintenance, platforms and interfaces in stages, aligned with maintenance windows
Integrated systems, tests, documentation, approval per stage while supply continues - 04
Operations
Monitoring, audits, knowledge transfer
Monitoring, certificate renewal, audit support, stepwise handover
Before our first conversation
You do not need all the answers yet.
Start with a concrete challenge. These four questions help us find the right direction together.
Book a first consultation- 01
What should change?
Your current challenge and the outcome you are aiming for.
- 02
Which systems are involved?
An overview of sites, applications and interfaces.
- 03
What sets the boundaries?
Project dates, maintenance windows and known dependencies.
- 04
Who needs to be involved?
The right people from IT, security and operations.
Background & decision criteria
What are IT solutions for the water sector?
Six modules from the control systems of waterworks and treatment plants to customer service and billing, planned, integrated and operated by OTOKO®. Zone models, remote maintenance and data platforms are built so that supply and treatment keep running and the evidence for KRITIS, NIS2 and the B3S Wasser/Abwasser is produced along the way. The entire solution runs in German data centers.
IT solutions for the water sector protect the control systems of waterworks, treatment plants and distribution networks, connect widely distributed remote sites securely and make measurement, consumption and customer data usable for operations and planning. OTOKO® covers six modules: control systems and network control with zones under IEC 62443, secure remote maintenance for pumping stations and remote sites, sensor data platforms for leak detection and water quality, demand forecasting and anomaly detection with machine learning, customer and billing systems with GDPR-compliant data handling, and KRITIS and NIS2 compliance with the B3S Wasser/Abwasser.
The difference from a pure consulting project lies in operations and evidence. Every zone model, every remote access path and every model comes with logs, version history and the documents that the BSI Act, NIS2 and the B3S Wasser/Abwasser require. Cryptography and hardware security modules are our core competence. The keys behind the device certificates that identify remote stations and remote maintenance access are therefore held in certified devices rather than in software.
Why OTOKO® for the water sector
- Cryptography and HSM
Cryptography and hardware security modules are our core competence. Device certificates for remote stations, remote maintenance access and telecontrol links rest on CA keys in certified hardware security modules.
- German data centers
The entire solution runs in German data centers, from the sensor data platform and the forecasting models to billing with your customers' consumption data.
- Critical infrastructure and regulated industries
We work with operators of critical infrastructure and regulated industries. We know what the BSI, auditors, supervisory authorities and information security teams expect from water utilities.
- One team through to operations
One team accompanies you from consulting to operations. OT security engineers, integration engineers and data engineers stay on without handover to third parties.
Delivery and details
Typical starting point before a water sector project
Most water utilities do not fail on missing technology but on long-lived control systems, distributed sites and small teams facing growing evidence obligations.
01
Control systems without zones
Process control system, controllers and office IT share a flat network, security updates have been missing for years and an incident in the office can reach into the plant.
02
Remote access without control
Pumping stations, wells and storage tanks are connected through routers with default settings, service providers use shared accounts and nobody logs who accesses which station and when.
03
Measurements without analysis
Flow, pressure and quality values arrive in the control system but are not linked with consumption and laboratory values, so leaks and quality deviations are noticed late.
04
Evidence as a spreadsheet
The measures from the B3S Wasser/Abwasser sit in a spreadsheet without owners, NIS2 reporting procedures have not been rehearsed and attack detection covers only office IT.
Three operating models
| On-Premises | German cloud | Hyperscaler | |
|---|---|---|---|
| Data location | Your data center, your control systems and HSMs | Data centers in Germany, operated under ISO 27001 | Azure, AWS or Google Cloud, region selectable |
| Operation | Your team or OTOKO® as managed service | OTOKO®, with audit rights for your utility | Shared, platform services by the provider |
| Tools | OT monitoring in the control network, jump server, HSMs on site | Hosted PKI, HSM as a service, sensor data and billing platform | Managed IoT, data and machine learning services |
| Suited for | Control systems, telecontrol, CA keys, critical facilities | Municipal utilities with a need for sovereignty and audit rights | Forecasting models, analytics, customer portals with peak loads |
| Compliance | Full control, evidence from your ISMS under the B3S | Processing agreement under GDPR, location Germany, KRITIS evidence | Processing agreement, standard contractual clauses, exit plan per service |
Collaboration
Project
Clearly scoped undertaking such as a zone model, a remote maintenance solution or a sensor data platform with a defined result, milestones and acceptance.
- Assessment, concept, implementation, handover
- Fixed price or effort by milestone
- Suited for KRITIS audits, getting started with NIS2 and changes in maintenance windows
Team reinforcement
OT security engineers, integration engineers or data engineers work in your teams, with your tools and under your operating rules for the control room.
- Onboarding into plants, operating rules and security requirements
- Scalable as the project progresses
- Suited for utilities with their own team and capacity gaps
Managed service
OTOKO® operates OT monitoring, remote maintenance platform, PKI or sensor data platform with agreed service levels, reports and the contract terms that KRITIS and NIS2 require for service providers.
- Monitoring, certificate renewal, updates and on-call duty
- Audit rights, service levels and exit plans in the contract
- Suited for water associations and municipal enterprises without their own security team
Standards and evidence
What each regulation requires in the water sector and what OTOKO® delivers for it.
| Requirement | Demands | OTOKO® delivers |
|---|---|---|
| IEC 62443 | Zones and conduits with security levels, risk assessment, security requirements for systems and components, controlled remote access and duties for service providers in automation and control systems | Zone model under IEC 62443-3-2, requirements under IEC 62443-3-3, segmentation, remote maintenance via jump servers, service provider requirements under IEC 62443-2-4 |
| KRITIS | Appropriate organizational and technical measures at the current technical standard, attack detection systems, reporting of significant disruptions and regular evidence to the BSI for operators of critical facilities | Scope, action plan, attack detection in control network and office IT, reporting process, audit documents and support during the audit |
| NIS2 | Risk management, supply chain security, registration, staged reporting of significant incidents and training and accountability of management for entities in the drinking water and wastewater sectors | Classification and registration, risk register, reporting process with templates, service provider contracts with audit rights, management training |
| B3S Wasser/Abwasser | Industry-specific security standard of DVGW and DWA, confirmed as suitable by the BSI, with measures for control systems, telecontrol, networks, organization and emergency management | Gap analysis under the B3S, prioritized action plan, implementation of the technical measures and documentation as the basis for evidence under the BSI Act |
| BSI IT-Grundschutz | Information security management under BSI standards 200-1 to 200-3, protection requirements assessment and implementation of the IT-Grundschutz Compendium modules including the IND modules for industrial IT | ISMS setup with structure analysis and modeling, risk analysis under BSI standard 200-3, emergency management under BSI standard 200-4, preparation for ISO 27001 certification based on IT-Grundschutz |
FAQ
Good questions. Clear answers.
15 answers about your industry, the project and ongoing operations.
Industry & expertise6 questions
Which IT solutions for the water sector does OTOKO® offer?
The portfolio covers securing control systems and network control with zones under IEC 62443, secure remote maintenance for pumping stations and remote sites, sensor data platforms for leak detection and water quality, demand forecasting and anomaly detection with machine learning, customer and billing systems under the GDPR, and KRITIS and NIS2 compliance with the B3S Wasser/Abwasser. Each module can be commissioned on its own or as a complete package, with operation in German data centers.
Do we have to replace our control systems to become secure?
Usually not. Firewalls, security gateways, data diodes and monitored remote maintenance can be placed in front of existing controllers without changing their programming or plant operation. Replacement is planned only where components no longer allow a secure connection, and then as part of renewals that are due anyway and outside critical operating phases.
Does NIS2 also apply to smaller water and wastewater utilities?
NIS2 lists drinking water and wastewater among the sectors of high criticality and ties the obligations to sector and company size, so utilities below the KRITIS thresholds can also be covered. Whether and in which category a utility is affected also depends on its legal form, and we check this together with you. We work with operators of critical infrastructure and regulated industries. In every case the measures follow the risk of the plant.
What does the B3S Wasser/Abwasser require, and how do we provide evidence?
The B3S Wasser/Abwasser describes which technical and organizational measures waterworks, treatment plants and networks need at the current technical standard, from segmentation of control systems to emergency management. Operators of critical facilities can use it as the basis for their evidence under the BSI Act. We run the gap analysis, implement the missing measures and prepare the documents so that the auditors can trace every measure.
May demand forecasting models intervene in plant control?
We deploy models so that they send recommendations and alerts to the control room and operations staff decide. If a model takes on a safety function in water supply, it counts as a high-risk system under the EU AI Act and needs risk management, documentation, logging and human oversight. We produce these documents from the start, and the models run outside the control network with one-way data flow.
How do you handle consumption data from radio water meters?
Consumption data assigned to a household counts as personal data under the GDPR. For billing we clarify the legal basis with you from contract, municipal statute or legal obligation, set retention periods and observe state rules on radio water meters, some of which grant a right to object. For network analytics and forecasts, platform and models receive only pseudonymized or aggregated data, and all data stays in German data centers.
Getting started & delivery5 questions
Can we start with a single area of expertise?
Yes. We can scope a specific task first. We consider its interfaces with the rest of your infrastructure and agree which work is included before implementation.
What should we prepare for the first conversation?
A brief description of the challenge, the systems involved and your desired outcome is enough to start. Known deadlines and the relevant contacts are helpful. Please do not include credentials or confidential system documentation in an initial enquiry.
Who needs to participate in the project?
Security architect: Target architecture, zone model, evidence. OT security engineer: Segmentation, OT monitoring, remote maintenance under IEC 62443. Integration engineer: Telecontrol connection, PKI and HSM, billing interfaces. Data engineer: Sensor data platform, forecasting and anomaly models. Compliance consultant: B3S Wasser/Abwasser, KRITIS, NIS2, GDPR. Project lead: Milestones, acceptance, reporting.
How do you determine the schedule and effort?
We consider the systems, interfaces, available documentation and operational constraints. An agreed scope and milestones provide the basis for estimating effort. A fixed duration without these details would not be reliable.
What does the first stage deliver?
Plants, networks, remote access, data sources and regulatory gaps Prioritized list of measures, inventory of plants and access paths, gap analysis for B3S Wasser/Abwasser, KRITIS and NIS2
Operations & development4 questions
How can we work together?
Project: Clearly scoped undertaking such as a zone model, a remote maintenance solution or a sensor data platform with a defined result, milestones and acceptance. Team reinforcement: OT security engineers, integration engineers or data engineers work in your teams, with your tools and under your operating rules for the control room. Managed service: OTOKO® operates OT monitoring, remote maintenance platform, PKI or sensor data platform with agreed service levels, reports and the contract terms that KRITIS and NIS2 require for service providers.
What happens at handover to operations?
Monitoring, audits, knowledge transfer Monitoring, certificate renewal, audit support, stepwise handover
Can we expand to further sites or systems later?
We can account for future expansion in the initial concept. Documented interfaces and reusable rules provide a foundation. Each additional site or system still needs to be assessed for its particular requirements.
How do we keep the solution maintainable?
Agree responsibilities, recurring tasks and change procedures alongside the technical implementation. Documentation and knowledge transfer help your team operate the solution. The specific activities and any ongoing support are part of the agreed scope.
Water
Let's discuss your next step.
Let us review together how well your control systems and remote sites are protected today.
Book a first consultation
