A good tabletop for a small water utility starts with something that has happened to many plants: a long power loss. Then it adds a cyber doubt. Staff talk through what they do, who they call and what they cannot do. One hour and a whiteboard are enough.
Why this scenario
CISA's water page lists links to the energy sector and says firefighting and healthcare depend on water services. A power loss therefore reaches your plant from outside and your customers from inside. The cyber twist is that you may not know whether the control network can be trusted when power returns.
Setup
Invite an operator, a supervisor, the person who looks after IT, and someone who talks to customers. Name a facilitator and a note taker. Use the plant's real plan, not a clean one.
Injects
Read them aloud, a few minutes apart.
- Minute 0. Power is out across the area. Estimated restoration is unknown. The generator starts.
- Minute 10. The generator has fuel for a limited time. Who knows how long?
- Minute 20. Phones are unreliable. How do you reach staff and the county?
- Minute 30. Power returns. A screen in the control room shows a setpoint nobody changed. Do you trust it?
- Minute 40. A fire department asks whether hydrants will have pressure.
Questions to ask at each step
- Who decides, and who do they call?
- What can be done by hand, and who has done it?
- Where is the written procedure, and is it on a system that is down?
- Which regulator or agency do you tell? Your SRMA is EPA for water, per CISA.
What to record
Gaps in plain words, with an owner and a date. For example: "No one knew the generator run time", "Contact list is only on a laptop". Keep it to five items.
Linking to formal duties
For systems serving more than 3,300 people, the AWIA emergency response plan is a natural home for what you learn. See our post on AWIA dates.
Where software comes in
Ask what runs the plant: vendor remote access, update tools, HMI software. Safeguard can build an inventory with asset discovery and SBOM scanning, which answers the question "what was on that screen?" with a list instead of a guess.
Running it well
Keep the tone calm and blameless. The goal is to find gaps, not to grade people. If a question has no answer, write it down and move on instead of debating it. End with the five gaps and read them back so everyone hears the same list. Schedule the follow-up before people leave the room, with a date for each fix and a date for the next exercise.
Quick check
How long should the exercise run?
One hour is enough for a first run. Longer if you add more injects.
Should the exercise use the real plan?
Yes. A tidy fictional plan hides the gaps you want to find.
Sources
Last reviewed: 19 October 2026.
