Treatment plants and sewerage networks were automated gradually, without cybersecurity being part of the design. Today, aeration, dosing and filtration processes, pumping stations and environmental reporting all depend on SCADA systems and on communication links that cross wide areas, often over public infrastructure. An attack that stops or falsifies these processes has consequences that do not stop at the operator: uncontrolled discharges, contamination of receiving waters and direct effects on public health and on ecosystems.
Directive (EU) 2022/2555 (NIS 2) treats waste water as a sector of high criticality in Annex I, separately from drinking water, and imposes obligations on risk analysis, technical and organisational measures, incident reporting and operational continuity, for industrial control systems as much as for administrative IT networks.
Legal framework
At European level:
- Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex
At national level (Romania):
- GEO no. 155/2024: Official Gazette no. 1332/2024
- Law no. 124/2025: Official Gazette no. 638/2025
- DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
- Order on disruption criteria and risk assessment: Official Gazette no. 776/2025
The Waste water sector
Essential entities:
Undertakings collecting, disposing of or treating urban, domestic or industrial waste water, excluding undertakings for which those activities are a non-essential part of their general activity.
- Regional and local water and sewerage operators managing treatment infrastructure
- Urban and industrial waste water treatment plants
- Public or private companies operating sewer networks interconnected with municipal systems
- Entities responsible for environmental discharge monitoring and reporting
Sector-specific cyber threats
- Unauthorised access to the SCADA systems of treatment plants
- Disruption of process automation in aeration, dosing and filtration
- Ransomware affecting monitoring or reporting systems
- Attacks on the communication networks between pumping stations
- Theft of technical and operational data on volumes, quality and discharges
NIS 2 requirements for the waste water sector
Mandatory measures:
- Inventory and classification of critical IT and OT assets
- Security policies approved at management level, with explicit responsibilities
- Network segmentation and separation of OT and IT communication channels
- Traffic monitoring and anomaly detection (IDS/IPS)
- Access control and multi-factor authentication, including for remote supplier access
- Incident response and business continuity plans, tested annually
- Cybersecurity training for operations and maintenance teams
- External security audits and attack simulations
- Monitoring of equipment and IT service suppliers
Critical interdependencies
- Direct links with drinking water networks and urban infrastructure
- Dependency on digital systems for reporting under environmental regulation
- Possible effects on ecosystems in the event of operational failure
- Dependency on electricity supply for pumping and treatment
Securing waste water management systems is essential for environmental protection and public health. NIS 2 requires operators to approach cyber risk proactively, and full implementation of the legal requirements is a precondition for preventing incidents with major impact on communities and ecosystems.
The other sectors in this series
The NIS 2 Directive covers eleven sectors of high criticality. Each has its own essential entities, specific threats and mandatory measures.