Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
Scofield Council Authorizes State-Funded Cybersecurity Assessment for Drinking-water SCADA
Summary
The Scofield Town Council authorized Utah Cybersecurity to assess the town’s drinking-water SCADA system and pursue state-funded installation of a protective access device, contingent on emergency-plan updates and annual training; the program is reportedly funded by recent state legislation.
Mayor Lander appointed Phil Millett of Utah Cybersecurity to brief the council on a state program offering cybersecurity assessments and a small protective device for water-system controls. Millett said the program is paid by the legislature and would require no direct cost to Scofield beyond an hour or two of work from the town’s SCADA provider. "It's called 0 trust," Millett said, describing the approach that restricts OT access to only authorized individuals.
Millett told the council the program carries several compliance obligations: maintain an emergency response plan (ERP) with a cyber-incident addendum, provide annual training to anyone with SCADA access, report annually that the town is compliant, and notify the cyber center of any breach within two hours. He said the state has set compliance deadlines tied to system size: systems under 3,300 service connections face an earlier due date (December 31, 2026); larger systems are due July 1, 2027. "There’s going to be––well, the funding will be gone by sometime this fall," Millett said, urging early participation.
Town IT support (Ryan Price) asked for technical details about what the device allows and how it would interact with the town's existing VPN and Meter Works meter-reading setup. Millett described the solution as analogous to a VPN that ‘cloaks’ open ports so that only specified people and service providers can access operational technology. He said an engineer could visit to perform a vulnerability assessment and confirm whether the device is warranted.
Councilmember Brad Peacock moved to authorize Utah Cybersecurity to contact the town’s SCADA provider, coordinate an assessment and engineer site visit, and assist with the ERP addendum; the motion was seconded and approved by voice vote. Millett agreed to obtain the town SCADA contact information and schedule the assessment. The council recorded no roll-call tally in the transcript; the motion passed by general consent.
Next steps: Utah Cybersecurity will gather SCADA service-provider contacts (Meter Works was identified as the town’s meter/SCADA vendor), arrange a technical site visit, and assist the town with the ERP addendum and state reporting required for program participation.
