Oldsmar water plant: would your organization have caught it? A checklist

In February 2021, an unknown actor gained access to a US water treatment plant's control software and raised the dosing of sodium hydroxide. Plant staff noticed and reversed it before the software alarmed. Use the checklist below to test whether your organization would catch the same kind of change.

This is about learning from an event, not judging the people who ran the plant. Operators caught the change, which is the part to copy.

What does CISA say happened?

CISA's advisory AA21-042A describes an incident on 5 February 2021 at a US drinking water treatment facility. The advisory does not name the city; the incident is widely known as Oldsmar, and the advisory lists the Pinellas County Sheriff's Office among the responders.

Per the advisory:

• Unidentified actors gained unauthorized access to the facility's SCADA system.
• They used the SCADA software to increase the dosing of sodium hydroxide, a caustic chemical.
• Plant personnel noticed the change and corrected it before the SCADA software detected the manipulation and raised an alarm.
• The treatment process was unaffected.
• Likely access routes: weak password security and an outdated operating system. Desktop sharing software such as TeamViewer may have been used, but this could not be confirmed.
• The FBI could not confirm the incident was a targeted intrusion.

The advisory was first issued on 11 February 2021.

What did CISA recommend?

General: use a supported operating system, use multi-factor authentication, use strong RDP passwords, keep security software current, audit and isolate systems, close unused RDP ports, log remote connections, train users against social engineering, and suspend unusual accounts.

For water systems: install independent cyber-physical safety systems that prevent dangerous conditions even if the control system is compromised, such as limits on chemical pump size, reservoir size, valve gearing and pressure switches.

For TeamViewer: disable unattended access, set the service to manual start, use strong random passwords, never save connection passwords, require host confirmation for anything beyond view-only access, and use the block and allow list.

The checklist

Score each item yes, no or unknown. Unknown counts as no.

Access

1. Can anyone reach an operator workstation through remote desktop or screen sharing software from outside your network?
2. Does every remote path require multi-factor authentication?
3. Are remote tools set to require someone on site to approve a session?
4. Are any systems running an operating system the vendor no longer supports?
5. Do shared or default passwords exist on any control workstation?

Detection 6. Are remote connections logged, and does someone read the logs? 7. Would you notice a setpoint change made outside a work order? 8. Does your alarm logic depend only on the software that could be compromised? 9. Do operators know which values should never change, and who to call when one does?

Resilience 10. Is there a physical or independent limit that prevents a harmful setpoint even if software commands it? 11. Can you isolate the control network quickly? 12. Have you practiced manual operation?

People and process 13. Do you have a named owner for remote access policy? 14. Do operators feel safe reporting odd behavior, including their own mistakes? 15. Is there an agreed call list for suspected tampering, including law enforcement?

How to read the score

Any "no" in the first group is where an intruder gets in. Any "no" in the detection group is where a change goes unseen. Item 10 matters most: independent limits are the one control that still works when everything else fails.

What to do

1. Run the checklist with operations, not only IT.
2. Remove or lock down remote desktop and screen sharing paths first.
3. Enable MFA on every remote route.
4. Plan the replacement of unsupported operating systems, with isolation as the interim measure.
5. Add logging for remote sessions and review it weekly.
6. Identify the independent safety limits on your most dangerous setpoints, and verify they work.
7. Write down the call list and practice it once.

Quick check

Sources

• CISA: AA21-042A, Compromise of US Water Treatment Facility

Last reviewed: 18 October 2026.