Water utility post-quantum cryptography: where to start?

Water utility post-quantum cryptography means protecting the data links between treatment plants, pump stations, reservoirs, control rooms, cloud services and remote engineers. It uses key-exchange algorithms that a future cryptographically relevant quantum computer cannot break, so traffic recorded today cannot be decrypted later. For most utilities the first target is wide-area SCADA traffic, not the PLCs and RTUs at each site.

This article covers whether water systems really need this, what US and EU rules say, how to protect telemetry against “harvest now, decrypt later”, and how a utility with a small budget can put the work in order.

Do water utilities need quantum-safe encryption for SCADA links?

Yes for links that cross networks the utility does not control, and the work should be planned now even though no regulator has set a deadline. The reason is that water OT stays in service for a long time, and the key exchange protecting it today is the part quantum computing will break.

Federal agencies make the underlying point plainly. In their joint factsheet, CISA, NSA and NIST warn that a CRQC would have the potential to break public-key systems (sometimes referred to as asymmetric cryptography) that are used to protect information systems today. Every VPN tunnel, TLS session and remote-access client a utility uses to reach outstations depends on that kind of key exchange.

The sector’s size makes the exposure a national issue rather than a niche one. In the United States, there are approximately 152,000 public drinking water systems, including 50,000 community water systems, and more than 16,000 wastewater treatment systems. Together, over 80 percent of the U.S. population receives their potable water from these drinking water systems.

Many of those systems already struggle with the basics. A joint FBI, CISA, EPA and NSA advisory noted that WWS systems commonly use outdated control system devices or firmware versions, which expose WWS networks to publicly accessible and remotely executable vulnerabilities. Eric Goldstein, then CISA Executive Assistant Director for Cybersecurity, put it bluntly: “The Water and Wastewater Systems sector is under constant threat from malicious cyber actors.”

CISA’s guidance for operational technology sets the timeline expectation: the transition to post-quantum cryptography will be a complex, multi-year process. In the same document the agency states that “OT owners and operators cannot wait until the advent of a CRQC to develop and implement a plan.”

How do you protect pump station and reservoir telemetry against harvest now, decrypt later?

Protect the network path, not each field device: put hybrid post-quantum encryption at each end of the links that leave a trusted site, starting with those over public or carrier networks. Field devices can then stay as they are until their normal replacement date.

“Harvest now, decrypt later” describes an adversary who records encrypted traffic today and stores it until a quantum computer can recover the session keys. For a water utility, the value of individual flow or level readings fades within hours. What lasts is the context around them: IP plans, device inventories, setpoints, ladder logic downloads, historian queries and the credentials used in vendor maintenance sessions. A reservoir RTU installed this year may still be running in the 2040s, and so will the network design that recorded traffic reveals.

Map which links carry long-lived secrets

Start with a link inventory, not an algorithm choice. The CISA, NSA and NIST factsheet asks organisations to identify quantum-vulnerable cryptography that protects critical processes, especially for Critical Infrastructure. For a water utility, that inventory usually falls into a few groups:

• Control room to pump stations, lift stations and booster stations over leased lines, cellular modems or the public internet.
• Treatment plant to reservoirs and remote tanks, often over radio backhaul or carrier networks.
• OT network to a historian, analytics platform or disaster-recovery site in a data centre or cloud.
• Remote access for on-call operators, integrators and equipment vendors.

Rank each link by how long its contents stay sensitive and how exposed the transport is. A cellular link to an unmanned booster station that carries engineering sessions ranks above a fibre run inside a fenced plant.

Encrypt the path, not the PLC

Replacing controllers to get new cryptography is rarely realistic. CISA acknowledges that upgrading ICSs to post-quantum cryptography will be a challenge, and the joint factsheet frames the work broadly: migration to PQC should be viewed as an IT/OT modernization effort.

A network-layer gateway at each end of a link avoids touching the devices behind it. One example is the QPN gateway from Quantum Network. It encrypts at Layer 3 with a hybrid key agreement that combines a classical part and ML-KEM (FIPS 203) into one session key, renewed every two minutes. No software is installed on the PLCs, RTUs or HMIs behind it. Encrypting the network path protects data in transit only. It does not replace firewalls, segmentation or patching of the devices themselves.

Design for crypto agility and low-bandwidth links

Telemetry often runs over constrained links, so engineers worry about overhead. NCCoE interoperability testing found that PQC hybrid TLS handshakes with Kyber-512 and ECDH P256 are a few milliseconds slower than classical ECDH P256 ones. On lossy links the larger keys matter more, but the same tests concluded that the post-quantum handshakes do not seem to be more materially impacted than the classical ones. Whatever you deploy, make sure the post-quantum algorithm can be swapped later without a hardware change. Standards will keep evolving, and NIS2-style policies expect you to follow them.

Which regulations require water and wastewater operators to plan for post-quantum migration?

No US or EU law yet sets an explicit post-quantum deadline for water operators. Existing risk-assessment and cryptography duties, read together with federal and EU guidance, make post-quantum planning part of doing those duties properly.

In the US, the main legal hook is America’s Water Infrastructure Act Section 2013. It requires community drinking water systems serving more than 3,300 people to develop or update risk assessments and emergency response plans (ERPs). The US EPA has tools, guidance, and training to assist community water systems in complying with America’s Water Infrastructure Act (AWIA) Section 2013. These assessments must cover malevolent acts, including cyber threats against monitoring and control systems. A credible assessment of long-lived OT communications should therefore record quantum-vulnerable key exchange as a known future risk.

Alongside the law sit voluntary sector standards. ANSI/AWWA G430 (Security Practices for Operation and Management) sets out the elements of a utility security programme. Many utilities use it as the management frame for cyber controls, which makes it a sensible place to record encryption and key-management practices. The federal quantum-readiness guidance is also explicit about who should act. CISA, NSA and NIST urge all organizations, especially those that support critical infrastructure, to begin early planning for migration to post-quantum cryptographic (PQC) standards by developing their own quantum-readiness roadmap.

What does NIS2 require from drinking water operators regarding cryptography?

NIS2 requires drinking water and wastewater operators in scope to keep documented, risk-based cryptography policies and procedures. The supporting EU texts say these policies must be reviewed against the state of the art, which increasingly includes post-quantum algorithms.

Drinking water and waste water are listed in Annex I of the NIS2 Directive (EU) 2022/2555 as sectors of high criticality. Among the minimum measures in Article 21(2), point (h) requires policies and procedures regarding the use of cryptography and, where appropriate, encryption. Management is accountable for these measures: member states must ensure that management bodies approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements.

Commission Implementing Regulation (EU) 2024/2690 spells out what a cryptography policy should contain. Formally it applies to digital-infrastructure providers such as cloud and managed service providers, not to water utilities. Even so, national authorities and auditors use it widely as a reference. It requires a cryptography policy with a view to ensuring adequate and effective use of cryptography to protect the confidentiality, authenticity and integrity of data. It also states that the relevant entities shall review and, where appropriate, update their policy and procedures at planned intervals, taking into account the state of the art in cryptography.

How do small water utilities with limited budgets prioritise quantum-safe encryption?

Small utilities should sequence the work by exposure: first remove unnecessary internet exposure and inventory links, then encrypt the few paths that cross untrusted networks, and leave everything else to normal equipment renewal.

The federal agencies’ own wording is realistic about small systems. They note that WWS facilities are inconsistently resourced municipal systems-not all of which have the resources to employ consistently high cybersecurity standards. EPA’s Assistant Administrator for Water Jess Kramer has said that “Cybersecurity threats are a serious concern for our nation’s drinking water and wastewater systems”. That is why the order of the work matters more than the size of the budget.

A staged approach that fits a small utility

1. Use free assessments first. EPA conducts no-cost cyber assessment for drinking water and wastewater utilities using EPA’s Cybersecurity Checklist derived from CISA’s CPGs. Add a line on encrypted inter-site links to the resulting plan.
2. Close the obvious gaps. The joint CISA, EPA and FBI fact sheet lists actions such as Reduce Exposure to the Public-Facing Internet and asset inventory. An HMI exposed to the internet is a bigger risk today than any quantum computer.
3. Inventory links, not just assets. List every path between sites and to remote users, with its transport and encryption method.
4. Encrypt one or two high-exposure paths. Typically these are cellular or internet links to unmanned stations and vendor remote access. Gateways that sit beside existing routers and firewalls avoid a network redesign. A QPN gateway, for example, runs on standard x86 hardware and takes roughly 30 minutes to install for a team that knows its own IP addressing.
5. Write the roadmap into procurement. The joint factsheet advises that new products will be delivered with PQC built-in, and older products will be upgraded with PQC to meet transition timelines. Put that requirement into every SCADA, radio and modem tender.

National prioritisation also helps with budgeting. A CISA-commissioned review of quantum vulnerabilities assessed the 55 National Critical Functions and found six NCFs are high priority for assistance in migration, 15 are medium priority, and 34 are low priority. A small utility can apply the same triage to its own links: a few get attention now, most follow on the normal renewal cycle, and the decision is written down so a regulator or board can see the reasoning.