Are you ready for your next design-build opportunity? Our feature story looks at two paths to readiness you can follow to optimize this dynamic delivery capability. Either one—when done right— can greatly increase your organization's chances of a successful project outcome. This issue also explores the critical role pretreatment plays in protecting wastewater treatment plants and receiving ecosystems from excessive or harmful industrial pollutants. Plus we detail some recent advancements in reverse osmosis monitoring that help maintain system reliability when RO data doesn't behave as expected. In our cybersecurity article we alert you to the growing threat posed by recent world events to US water and wastewater systems, and outline some critical measures to safeguard these essential public amenities from bad actors. And finally, we proudly introduce the 2026 winner of Carollo’s Bryant L. Bench scholarship. From developing trends to innovative strategies, we hope this issue informs and inspires you. Please reach out to me or our authors with your thoughts. We’d love to hear from you! CURRENTS / IN THIS ISSUE ROSA YU, PhD, PE (ryu@carollo.com) ALAN ROBERSON, PE On May 18, 2026, the US Environmental Protection Agency (USEPA) proposed two new rules that will impact the regulation of per- and polyfluoroalkyl substances (PFAS) in drinking water. The first would allow public water systems to seek an extension to comply with the maximum contaminant levels (MCLs) for the two most common PFAS. The second would rescind existing MCLs for other PFAS. PROPOSED PFOA AND PFOS COMPLIANCE EXTENSION RULE This rule would allow utilities to seek a two-year federal extension to comply with MCLs for perfluorooctanoic acid (PFOA) and perfluorooctane sulfonic acid (PFOS)—both set at 4.0 nanograms per liter (ng/L). For approved systems, the compliance deadline would shift from April 26, 2029, to April 26, 2031. Why Primacy Matters. So far, nine states—Colorado, Connecticut, Idaho, Illinois, Maryland, North Carolina, Vermont, Washington, and Wisconsin—have incorporated the new PFOA and PFOS standards into state drinking water regulations and submitted primacy program revision applications to USEPA. Once states obtain primacy, they may choose to shorten or end an exemption granted by USEPA. PROPOSED NEW PROPOSED NEW PFAS DRINKING PFAS DRINKING WATER RULES WATER RULES What Utilities Need to Know EDITORIAL DIANA LEONARD (dmleonard@carollo.com) CONTENT EDITOR Diana Leonard / dmleonard@carollo.com COPY EDITOR Mary Ann Mavrogianes GRAPHIC DESIGNER Silvia Higuera-Backlund IN THIS ISSUE Understanding the Proposed PFAS Rules The Critical Role of Pretreatment Design-Build: Two Paths, One Destination Building Confidence in RO Monitoring Cybersecurity New Front Line Bryant L. Bench 2026 Scholarship Winner 2 4 6 8 10 11 Early Engagement is Critical Utilities that align with regulators, secure equipment, and communicate with customers will be best positioned for whatever emerges from this rule-making process. 2

REGULATORY CORNER / CURRENTS 3 Extension Rule Interim Control Measures. Systems with a PFOA or PFOS sample at or above 12 ng/L would be required to implement at least two of six control measures during the exemption period. 1 Provide water pitchers and a two-year supply of filters certified to reduce PFOA and PFOS levels. 2 Deliver alternative water supplies with lower PFOA and PFOS levels by distributing bottled water, temporarily switching to a new source, or blending water supplies. 3 Install, operate, and maintain point-of-use or point-of-entry devices certified to decrease PFOA and PFOS in all customer locations. 4 Implement actions and plans to decrease PFOA and PFOS levels in drinking water sources via source identification and source control. 5 Distribute written public education materials to consumers on PFOA and PFOS exposure sources. 6 Conduct community education and outreach activities on PFOA and PFOS in drinking water. Note that the control measures selected cannot include options 5 and 6 only. Control measures for systems with PFOA and PFOS levels above 4 ng/L but below 12 ng/L would not be required during the exemption period. Jan. 1 Apr. 26 Apr. 26 Apr. 26 2027 2029 2031 Initial monitoring begins Compliance monitoring begins MCL compliance begins Potential PFOA and PFOS MCL compliance extension Initial monitoring must be completed and submitted Public notification required for MCL violations 2019-2026 Engage early and often with your state primacy agency. States will ultimately decide if they want to allow for the federal exemption. Once states obtain primacy, they may choose to shorten or end an exemption granted by USEPA. Early engagement can clarify expectations and reduce uncertainty. Continue advancing treatment planning and implementation. Do not pause or delay technology evaluation, system design, construction, or system commissioning while these two proposed rules are being finalized. Consider alternative project delivery approaches. For capital improvement projects, advance early work packages or pre-procurement strategies to secure long-lead- time items and reduce schedule risk. Plan for interim actions. Utilities may need to identify and implement interim measures, such as raw water blending, powdered activated carbon application, and other available tools. Communicate with state primacy agencies and customers about these interim control strategies. Establish a public communication and outreach plan. Seeking a compliance extension requires formally certifying noncompliance, which may necessitate public perception strategies. Proposed changes may offer more time for PFOA and PFOS compliance, but they do not reduce the need for planning. The period for public and written comments has passed; however, utilities can still implement several proactive measures to better navigate the evolving PFAS regulatory landscape. ACTIONS UTILITIES CAN TAKE TO STAY AHEAD Carollo Can Help Carollo can help utilities understand the proposed rules, coordinate with state primacy agencies, prepare extension applications, determine treatment needs, design treatment systems, advance procurement and construction strategies, and develop public outreach to foster consumer trust while utilities prepare for compliance. PROPOSED PFAS MAXIMUM CONTAMINANT LEVEL RESCISSION RULE This rule would rescind the MCLs for perfluorohexane sulfonic acid (PFHxS), perfluorononanoic acid (PFNA), hexafluoropropylene oxide dimer acid (HFPO-DA), and hazard index (HI) mixtures that include these three compounds plus perfluorobutanesulfonic acid (PFBS). This rescission will not affect the PFOA and PFOS regulation. NA, HFPO-DA, and PFBS would not be regulated beyond the final date. USEPA emphasizes that this change is not an abandonment of concern about these PFAS, but rather a restart to consider regulating them in the future with proper scientific review and public input. As of January 2026, only nine systems nationwide exceeded MCLs for PFHxS, PFNA, HFPO-DA, and/or HI mixtures—indicating that only a small percentage of systems will be able to avoid PFAS treatment under the MCL rescission rule. PFAS monitoring and data reporting milestones remain unchanged by the proposed compliance extension and MCL rescission rules.

Awareness. Organized pretreatment programs must remain current to respond to ongoing regulations and local ordinances, such as sewer use ordinances, enforcement response plans, and inter-jurisdictional agreements. Adaptability. Change is constant. This is evidenced by the recent surge in large-scale industrial facilities such as data centers and semiconductor facilities—as well as the adoption of direct potable reuse in many communities. Utilities must remain nimble to develop, evaluate, or update pretreatment programs that reflect the current service area, treatment train, and compliance priorities. Adaptability is essential in responding to unexpected changes, such as abrupt pollutant discharges, unexpected industrial development, or upcoming water reuse needs. It's important to recognize that wastewater treatment plants frequently discharge to bodies of water that may ultimately become sources of drinking water. Protecting them is a shared responsibility—affecting utilities, dischargers, and rate payers alike. The Preventative Mitigation Toolbox Industrial pretreatment programs (IPPs) are the first barrier for publicly-owned treatment works (POTWs) to safeguard their facilities and the receiving ecosystems from excessive or harmful pollutants. Developing regulations and requirements for industrial users can protect utilities from toxic or high- strength discharges that the POTW was not specifically designed to treat—such as heavy metals, toxic chemicals, or corrosive acids. These harsh pollutants can corrode pipes or destroy fragile biological processes, and eventually reach a receiving lake or river. Because many pollutants adhere to solids during the wastewater treatment process, high-influent loading can cause excessive pollutant concentrations in the biosolids as well, making the disposal of municipal sludge increasingly difficult or even impossible. Alleviating these issues is especially important for water reuse or recycling programs. Local limit maintenance. One of the most common tools in a utility’s pretreatment toolbox is maintaining local limits that reflect the current service area and its limitations. Local limits regulate industrial discharges to protect treatment plant infrastructure, improve worker safety, and secure environmental compliance. They should be evaluated every National Pollutant Discharge Elimination System (NPDES) permit cycle or when significant modifications or end uses change at the POTW. Industrial protocols. Industrial dischargers have a primary impact on pretreatment programs. Protocols are a requirement of a federally-approved IPP and include frequent inspections, updated permits, and recurring industrial waste surveys. CURRENTS / PROJECT UPDATE 4 OLIVIA TAHTI (otahti@carollo.com) KRISTEL BAUMGARDNER-KRANZ, PE MARY KATE FORKAN SYDNEY PAZERA THE IMPORTANCE OF A well-defined pretreatment program sharpens the tools needed to protect POTWs and mitigate potential problems if discharges in the collection system go awry. PRETREATMENT Pretreatment in the wastewater cycle helps safeguard facilities, receiving ecosystems, and residential, agricultural, and industrial recycled water users. From the smallest towns to the largest cities, wastewater treatment plants are an essential element of effective water management— purifying wastewater before it's returned to the environment, preventing the spread of waterborne pathogens, and safeguarding aquatic ecosystems. Communities rely on these facilities to help protect their quality of life. But what protects your treatment plant? in Protecting Wastewater Treatment Facilities

For OCUD, the maximum allowable headworks loading analysis helped determine that existing local limits were adequate for all three plants. allowable headworks loadings (MAHLs)—back-calculated from OCUD’s existing local limits to the AAPLs—to determine if the existing local limits were enough to protect each plant. Challenging Project Meets a Tight Schedule in the Sunshine State The Orange County Utilities Department (OCUD) in central Florida reached out to Carollo to re-evaluate its industrial local limits as part of its NPDES permit renewal. Typically, local limits re-evaluations are scoped for around six months for a single treatment plant. However, for this project OCUD required a meticulous evaluation of a large water quality dataset from three water reclamation facilities (WRFs) and a key report delivered to a state agency in just two months. The work addressed four major components: 1. Compliance history. 2. A headworks loading comparison of existing local limits and pollutants of concern. 3. Identification of new pollutants of concern. 4. Potential WRF design or operational modifications. The team also evaluated historical water quality data, NPDES permit requirements and modifications, disposal practices, flow data, and design-based loading capacities at each WRF. To be effective, a local limits evaluation typically includes a headworks loading analysis. If the pollutant load at the headworks is greater than the treatment process can remove, a more stringent local limit may be required. Historical water quality and flow data provided a basis to calculate average annual pollutant loadings (AAPLs) for each local limit pollutant entering each WRF every year for a four-year period. This enabled comparing the maximum While neither pollutant had existing local limits, the evaluation recommended they be considered during OCUD’s next local limits evaluation. Carollo’s review of OCUD’s priority pollutant scans at each WRF identified a total of 11 new pollutants of concern but determined that no immediate action was currently required. Because pretreatment projects require extensive review, this project is still in negotiations with the state of Florida. No two local limits evaluations are alike. Each pretreatment program has different industrial users, relevant end uses, and opportunities for improvement. Tailoring solutions for each utility requires diligence, foresight, and expertise—all of which are specialties of Carollo's pretreatment team. ■ All existing local limits protected each WRF. ■ Two pollutants of concern showed MAHL exceedances: Ò Total Kjeldahl Nitrogen (as N). Ò Total dissolved solids (TDS). KEY FINDINGS PRETREATMENT IN ACTION How OCUD Applied These Principles to Protect its Facilities The Carollo pretreatment team has refined all the tools necessary to close the loop between scientific analysis, wastewater treatment facility planning and design, and potable reuse implementation to protect POTWs, their receiving waters, and the communities they serve. 5

6 6 6 6 POISED FOR DELIVERY TWO PATHS TO DESIGN-BUILD SUCCESS Public agencies are increasingly turning to design-build (DB) to save time, control costs, and attract skilled builders in a tight market. Based on Carollo's experience, one DB pattern stands out—the agencies excelling in DB aren't necessarily the ones bringing the most DB experience to the table. They're the ones who show up ready. One of the most common miscon- ceptions about the DB delivery method is that it is primarily a procurement choice. Match the project to the method, select a team, sign the contract, and the benefits follow. But in practice, DB project benefits accrue from capability deeply rooted in organizational readiness. When teams haven't built that capability, the familiar challenges emerge: slower decisions; mis- aligned expectations between owner, engineer, and contractor; unclear roles; and uncertainty about who owns which risk. The method itself doesn't resolve these challenges. Discipline and alignment do. Teams that make timely decisions, integrate construc- tion thinking early, and stay aligned when conditions shift are the ones who realize DB's full value. EARNING READINESS THROUGH EXPERIENCE 1 PATH Applying Lessons Learned in Baytown, Texas The Baytown Area Water Authority (BAWA) is expanding its East Surface Water Treatment Plant (ESWTP) from 6 to 12 mgd via progressive DB. The expanded plant will meet growing water demands, enhance system reliability, and support regional planning. This smaller-scale DB project is drawing on lessons learned by team members involved in other DB projects in the region, including the 320-mgd expansion of Houston's Northeast Water Purification Plant. While the ESWTP is more than an order of magnitude smaller than the $2 billion Houston project, the team is leveraging best practices—such as educating stakeholders, using standard-form contracts, leaning into collaboration, and establishing proven conflict resolution strategies—to shape the BAWA project. Expected to be operational by the summer of 2028, the project's success will not hinge on its smaller size, but rather on the applied discipline developed on larger, more complex work. The BAWA team has engaged stakeholders early. Local construction realities have informed design. Decisions are moving quickly. Second- guessing is rare. For utilities and partners who have delivered DB before, this discipline is one of the strongest arguments for starting with a successful project and building from there. TWO PATHS ONE DESTINATION CHITRA FOSTER, PE, DBIA (cfoster@carollo.com) PAUL WALKER, PE It Pays to Invest Early Working alongside many utilities that have implemented DB projects, Carollo has seen readiness built two ways. Some agencies earn it through experience—developing discipline across a series of projects. Others build it purposefully—structuring the organization, governance, and decision-making before the first DB project begins. Both paths work. Both rely on intention. DB is a Delivery Capability, Not a Procurement Decision More than just infrastructure, BAWA's ESWTP expansion is about planning ahead, collaborating openly with multiple partners, and building with purpose. CURRENTS / FEATURE STORY

7 7 7 7 Planning for Flood Control Preparedness in Hurricane Country The Harris County Flood Control District took a different route. On the Gulf Coast, disasters, storms, and the ensuing flooding events are a seasonal certainty. For Texas' third-largest county, waiting until after the next hurricane to plan its first major DB program would be politically and operationally untenable. In 2025, the flood control district established a Collaborative Delivery Task Force, bringing together engineering, construction, infrastructure, procurement, O&M, and the county attorney’s office to execute a holistic playbook to tackle the issue. Ongoing work includes: ■ Compliant contract templates purposed from the county's existing general conditions and skillfully adapted to DB by the county attorney's office. ■ Workflows—vetted through the flood control district's purchasing and legal departments— to streamline procurement. ■ Staff training programs and industry engagement to build organizational fluency. Currently the effort involves launching this first progressive DB project as a pilot to stress-test the playbook. It's a proactive, politically-aware approach that positions this agency so that when federal disaster recovery funds arrive, the Harris County Flood Control District is ready to deliver competitively, transparently, and at speed. BUILDING READINESS BY DESIGN 2 PATH KEY TAKE-AWAYS Agencies with DB experience should use it deliberately. Assign people who have done it before. Carry forward what worked. Give a smaller project the same rigor as a larger one, and favorable results tend to follow. Agencies preparing for their first DB program should understand experience isn't a prerequisite. Utilities that thrive on their first program are the ones who prepare as if it were their tenth—with governance defined, stakeholders aligned, risk allocation clear, and construction perspective built in from day one. Design-build rewards the teams who are READY. Plagued by flooding in the Houston area for nearly a century, the Harris County Flood Control District is actively working with project partners to plan for its first county- wide DB flood control strategy. For agencies preparing for their first DB program, readiness depends on a handful of deliberate actions taken before procurement begins. POSITIONING FOR READINESS AS A FIRST-TIME DB UTILITY Define how decisions get made, and by whom. DB moves quickly. Mapping decision authority, approval paths, and escalation routes early keeps the project moving forward. Engage the right stakeholders. Legal, operations, executive leadership, and technical staff all benefit from being at the table from the start. Clarify risk tolerance. Understanding what risks the agency and contractor will each hold, and where the engineer fits in, removes one of the biggest sources of DB friction. Bring construction thinking into design. DB's value emerges when designers understand how projects get built. Constructability reviews and early contractor input make that real. Set expectations for team collaboration. Defining how the owner, engineer, and contractor will communicate, resolve issues, and align on goals is a foundation to build on. The common thread across all five actions: none of this requires prior DB experience. It requires awareness and intention.

KYLE THOMPSON, PhD, PE (kthompson@carollo.com) YOKO KOYAMA, PE ANDREW SALVESON, PE CURRENTS / PROJECT UPDATE 8 How can utilities achieve more reliable and cost-effective RO performance results—even when data doesn't behave as unexpected? 8 Reverse osmosis (RO) systems are among the workhorses of potable reuse, helping provide reliable pathogen removal when treated wastewater is advanced to drinking water quality. Under ideal conditions, RO can achieve greater than five log removal values (LRVs)—which means it can provide multiple orders of magnitude of pathogen reduction. But confirming monitoring results in real time can be harder than it sounds. RO systems can achieve high LRVs, but it's challenging to verify when real-time monitoring can't distinguish actual integrity changes from ordinary variability. The stakes are high. As regulatory expectations for pathogen removal continue to increase, especially under emerging direct potable reuse frameworks, utilities need alarms that are both fast and trustworthy. A Balancing Act A monitoring system must detect genuine losses in RO integrity quickly, but it must also avoid overwhelming operators with false alarms that interrupt operations without improving reliability. That balance becomes difficult when the statistics behind the alarm system do not match actual data behavior. Traditional RO monitoring thresholds often assume LRV data follows a normal, bell-shaped distribution. With that assumption, operators can set thresholds based on standard deviations and expected probabilities. The problem is that real RO data often doesn't follow that script. A recent Carollo-led research effort challenged a fundamental water quality monitoring assumption—namely that sensor data follows a normal distribution. Funded by the US Department of Energy through the National Alliance for Water Innovation (NAWI), this work introduced a new statistical framework that significantly improves how utilities can interpret RO performance issues and respond to potential integrity issues. At OCWD, RO surrogate LRVs show that real-time monitoring data often departs from a neat bell curve, which can undermine alarm thresholds. High Stakes, Imperfect Data Utilities don't usually measure pathogen removal directly every minute of the day. Instead, operators rely on surrogate water quality parameters, including conductivity, total organic carbon (TOC), and emerging indicators—such as adenosine triphosphate (ATP) or fluorescence—to determine how well membranes are performing. These signals are valuable, but they are also noisy, variable, and sometimes unpredictable. At very low concentrations, even small measurement errors can create outlier LRV values, making it difficult to know whether an alarm reflects a real integrity issue or just unruly data. WHEN DATA BREAKS THE RULES: SMARTER MEMBRANE Performance Monitoring WHEN DATA BREAKS THE RULES: SMARTER MEMBRANE Performance Monitoring

9 Across datasets from three reuse systems, Carollo's research team found that most surrogate LRV datasets were left-skewed, bimodal, or non-stationary. Even when data were averaged over longer periods, many variables still remained non-normal. When standard statistical tools are applied to non-normal data, the result can be systematic error, including more false alarms than expected. A New Approach: The Shewhart Sign Chart To address this challenge, the research team applied a nonparametric statistical method known as a sign test. When implemented in a rolling fashion, this becomes an exploratory and supplemental method known as a Shewhart sign char t. This approach does not assume the data are normally distributed. Instead, it evaluates whether the median of recent data points is likely above or below a target value. The idea is surprisingly intuitive. Each data point is treated like a simple "above or below" result, similar to a series of coin flips. A single low reading does not automatically trigger an alarm. But if multiple values fall below the threshold within a rolling window, confidence increases that system performance has shifted in a meaningful way. This makes the method less sensitive to isolated outliers and more focused on patterns that may indicate a true change in RO performance. POTENTIAL BENEFITS Implementing the Shewhart sign chart resulted in potential monitoring benefits observed across the multiple datasets evaluated. These included: ■ Significant reduction in false alarms. For most surrogates evaluated, it reduced alarm events by at least 50 percent compared to simple threshold-based alarms on individual data points. ■ Faster identification of sustained changes that may warrant further evaluation. With a rolling window of 12 data points, the method has the potential to detect RO integrity issues in as few as three consecutive measurements. Assuming hourly or minutely data points, this means the response may be faster than daily integrity testing or daily averaging approaches currently used for indirect potable reuse. ■ Stable and practical alarm frequency. The approach also produced fewer than one alarm per week across the evaluated datasets, a frequency that may better align with operational needs—reducing unnecessary intervention while maintaining vigilance. From Research to Full-Scale Evaluation This work has progressed from statistical research to a prototype demonstration using data from California's Orange County Water District (OCWD) full-scale RO systems. OCWD and Carollo have developed a cloud-based research dashboard combining high-frequency RO data with real-time statistical calculations, including the Shewhart sign chart. The prototype allows these exploratory statistical indicators to be viewed alongside existing RO performance metrics, providing additional context for evaluating whether an apparent change may represent a meaningful process shift. OCWD's prototype cloud dashboard demonstrates combining RO data, real-time calculations, and operator reporting into a practical monitoring workflow. The Shewhart sign chart uses a rolling sign test to avoid reacting to isolated outliers while still identifying exceedances that may signal a real process shift. Multiple exceedances in a window trigger an alarm Single outliers did not trigger alarm with n ≥ 12 Same LRV threshold as normal-based alarms Broader Industry Implications Although this research was developed for RO monitoring, its implications reach well beyond membrane systems. Other water quality datasets are also often non-normal, heterogeneous, and shaped by sensor limitations and process variability. Carollo has already begun transferring this methodology from RO monitoring surrogates to wastewater effluent nitrate for other clients. The takeaway is simple: better decisions start with better assumptions. When monitoring methods reflect the way real-world data actually behaves, utilities can reduce unnecessary alarms, respond more confidently to potential performance changes, and build more resilient treatment operations. In other words, sometimes the smartest way to monitor RO performance is to stop expecting the data to be normal.

CURRENTS / WHAT'S NEW Develop an Operational Technology (OT) Governance Program. Establish policies, roles, and oversight for operational technology cybersecurity. Segment IT and OT Networks. Separate networks to limit lateral movement and contain potential threats. Replace and Harden Legacy Supervisory Control and Data Acquision (SCADA) Hardware. Upgrade outdated systems and ensure secure configuration of all assets. Deploy Continuous Network Monitoring and Asset Management. Detect anomalies early and maintain visibility of all assets. Implement Role-Based Access Controls and Multifactor Authentication (MFA). Ensure only authorized users have appropriate access to critical systems. Strengthen Physical Security Controls. Protect facilities, equipment, and access points with layered physical security measures. NORM ANDERSON, PE, CISSP, GICSP (nanderson@carollo.com) SHAWN CORRIGAN, CEM, CBDP, ENV SP Reliability, resilience, and public health have always been the core missions of public utility systems. For the last 20 years, cybersecurity has steadily risen as a concern. Yet today, amid escalating geopolitical tensions, cyber threats still pose immediate risks, demanding proactive planning and proven strategies to protect critical operatons. 10 Recent attacks have successfully targeted multiple water systems using internet-accessible programmable logic controllers (PLCs), causing loss of functionality, shifts to manual operations, and significant financial impacts to utilities. THE TIME TO STRENGTHEN CYBERSECURITY IS NOW Public protection is the water industry's essential operational responsibility HOW ATTACKS IMPACT OPERATIONS Internet Exposure. PLC are accessible from the internet. Unauthorized Access. Attackers gain entry. Configuration Change. Critical settings are modified. Operational Disruption. Treatment process are affected. Manual Operations. Operators must respond to maintain service. OPERATIONAL IMPACT FROM AWARENESS TO ACTION Many utilities have completed risk and cybersecurity assess- ments. Implementing them should focus on key priorities. 1 4 2 5 3 6 REPORT SUSPICIOUS ACTIVITY NOTIFY CISA * • FBI STATE + LOCAL AUTHORITIES * Cybersecurity and Infrastructure Security Agency CYBERSECURITY’S NEW FRONT LINE America's Water Systems

ELIMINATE Direct Internet Exposure Keep PLCs, human-machine interfaces (HMI), and OT assets off the internet. Use virtual private networks (VPNs), gateways, and firewalls with strong authentication and logging. SECURE PLC Configurations Place controllers in “run” mode when not programmed and regularly verify settings, IP addresses, and program files. STRENGTHEN Authentication Replace default passwords with strong credentials and deploy MFA wherever possible. PREPARE for Recovery Maintain clean, tested backups of PLC logic, HMI applications, network configurations, and engineering files—stored offline and protected from ransomware. PRACTICE Incident Response Maintain current emergency procedures, manual operating capabilities, vendor contacts, and reporting protocols for rapid recovery. Each initiative should include a defined scope, implementation plan, budget, and clear responsibilities. Well-structured programs achieve measurable improvements. SPOTLIGHT / CURRENTS 11 11 Conner graduated in June with a bachelor's degree in environmental engineering from the University of Nebraska Omaha (UNO), where he was recognized with the 2026 Undergraduate Major Award for Environmental Engineering. In August, he returned to UNO to pursue a master's degree—supported in part by Carollo's Bryant L. Bench Scholarship. A key part of Conner's education over the past four years has been his work with Engineers Without Borders on a bridge project in Zambia. His involvement spanned the entire engineering process, from community engagement, project development, and grant procurement, to design, government approval, and construction oversight. The experience provided hands-on exposure to the real-world challenges and rewards of engineering while making a meaningful impact on the local community. Conner credits experiences like these for shaping his can-do philosophy. 2026 RECIPIENT CONNOR NEVILLE At times, engineering work can be overwhelming. It can be difficult to see the end. I simply remind myself that even when you're in the weeds, you can figure it out and persevere. This scholarship is going to make my life much easier in grad school and allow me to focus on what's most important." CYBER THREATS ARE AN EXTENSION OF GEOPOLITICAL CONFLICT. WATER SYSTEMS ARE PRIME TARGETS. THE EVOLUTION OF CRITICAL INFRASTRUCTURE'S NEW REALITY 2008 • USEPA publishes a 10-year roadmap to secure control systems in the water sector. 2018 • America’s Water Infrastructure Act (AWIA) expands resiliency requirements and places an emphasis on cybersecurity. TODAY • Nation-state actors increasingly target critical infrastructure, posing real cyber threats to utilities every day. HOW CAN UTILITIES REDUCE RISK? Many of the most effective protections are straightforward and achievable. The Bryant L. Bench Scholarship was launched in honor of Carollo’s former water practice director, Bryant Bench, whose innovative treatment concepts helped improve drinking water quality across the country. The scholarship is a one-time $10,000 award that students can use to complete or further their education in their chosen field. SCHOLARSHIP SCHOLARSHIP