A Practical First Step Toward OT Cyber Resilience

A regional local council in northern Queensland, Australia, responsible for water and wastewater services across multiple treatment plants and pumping stations, engaged Parasyn to carry out a preliminary cyber security review of its operational technology (OT) environment. The council already worked with Parasyn as its engineering delivery partner for SCADA and control systems support, and this engagement extended that existing relationship into cyber security advisory.

One exchange during the review captured the gap Parasyn was there to help close. Asked whether the council could see its full OT asset inventory, the IT team was confident: they had a solid list of their servers. But when the conversation turned to the PLCs, the RTUs and the field instruments out at the treatment plants, the answer was that those belonged to the treatment team, who were not in the room. From an IT perspective, the environment looked well understood. In reality, a significant part of the OT estate, the pumps and dosing systems that actually move and treat the water, was effectively invisible to central oversight.

That kind of gap is not unique to this council, and it sits inside a threat landscape that is getting worse nationally: ASD's Annual Cyber Threat Report 2024-25 recorded a 111% year-on-year increase in notifications to critical infrastructure entities about malicious activity on their networks. Water and wastewater operators are under growing pressure to demonstrate OT cyber resilience as a result, driven by the Security of Critical Infrastructure Act 2018 (SOCI Act) and a broader shift in expectations from state and federal government. Like many regional operators, the council had no formally documented view of its OT cyber security posture: asset inventories, network architecture, remote access arrangements and incident response readiness had grown organically over time rather than being centrally managed and reviewed. Before committing to a full, formal risk assessment program, the council needed a fast, practical way to understand its exposure and prioritise next steps.

Parasyn designed the review as a non-intrusive, discovery-based assessment rather than a technical penetration test, run over six weeks from kickoff to final report:

1. Stakeholder alignment
   A structured kickoff session with the council's IT and OT teams to confirm scope, objectives and intended audience.
2. Discovery workshops
   Dedicated sessions with the IT team and the SCADA/operations team, covering architecture, access pathways and day to day operational practice.
3. Architecture review
   A tabletop review of the available high level network architecture diagram, covering connectivity, remote access mechanisms and site relationships.
4. Standards aligned analysis
   Findings assessed against IEC 62443, the leading international framework for OT cyber security, to produce practical, prioritised recommendations rather than a compliance audit.

The review examined ten focus areas spanning technical and procedural OT cyber security practice:

Rather than a static list of findings, Parasyn delivered a phased improvement roadmap the council could act on immediately:

1. Phase 1: Initial Risk Containment
   Completing the foundational asset inventory and network documentation, alongside short-term risk reduction actions across the other focus areas.
2. Phase 2: Baseline Foundation
   Establishing ongoing OT security processes and internal review practices.
3. Phase 3: Structured Cyber Security Program
   A risk based program formally aligned with IEC 62443, including a future formal risk assessment.

This gave the council a clear, achievable starting point rather than an overwhelming compliance burden, while establishing the foundation for a longer-term OT cyber security maturity program.

This engagement reflects how Parasyn works with critical infrastructure clients: as a partner that delivers as well as advises. Because Parasyn was already engineering and supporting the council's SCADA and control systems, the cyber security review could draw on real operational context from day one, rather than starting cold. That combination, engineering delivery credibility paired with dedicated OT cyber security expertise, is what differentiates Parasyn from design-only consultancies advising from the outside.