Currents 2026 Vol 3: Design Build - Two Paths One Destination

Understanding the

Proposed PFAS Rules

The Critical Role

of Pretreatment

Building Confidence

in RO Monitoring

Cybersecurity New

Front Line

PLUS —

Bryant L. Bench

Scholarship Winner

CAROLLO ENGINEERS VOLUME 3 2026

DESIGN-BUILD DESIGN-BUILD DESIGN-BUILD

TWO Paths

ONE Destination

TWO Paths

ONE Destination

TWO Paths

ONE Destination

TWO Paths

ONE Destination

Are you ready for your next design-build

opportunity? Our feature story looks at

two paths to readiness you can follow

to optimize this dynamic delivery

capability. Either one—when done right—

can greatly increase your organization's

chances of a successful project outcome.

This issue also explores the critical role pretreatment plays

in protecting wastewater treatment plants and receiving

ecosystems from excessive or harmful industrial pollutants.

Plus we detail some recent advancements in reverse osmosis

monitoring that help maintain system reliability when RO

data doesn't behave as expected.

In our cybersecurity article we alert you to the growing threat

posed by recent world events to US water and wastewater

systems, and outline some critical measures to safeguard

these essential public amenities from bad actors. And finally,

we proudly introduce the 2026 winner of Carollo’s Bryant L.

Bench scholarship.

From developing trends to innovative strategies, we hope

this issue informs and inspires you. Please reach out to

me or our authors with your thoughts. We’d love to hear

from you!

CURRENTS / IN THIS ISSUE

ROSA YU, PhD, PE (ryu@carollo.com)

ALAN ROBERSON, PE

On May 18, 2026, the US Environmental

Protection Agency (USEPA) proposed two new

rules that will impact the regulation of per- and

polyfluoroalkyl substances (PFAS) in drinking

water. The first would allow public water

systems to seek an extension to comply with

the maximum contaminant levels (MCLs) for

the two most common PFAS. The second

would rescind existing MCLs for other PFAS.

PROPOSED PFOA AND PFOS

COMPLIANCE EXTENSION RULE

This rule would allow utilities to seek a two-year federal

extension to comply with MCLs for perfluorooctanoic acid

(PFOA) and perfluorooctane sulfonic acid (PFOS)—both set

at 4.0 nanograms per liter (ng/L). For approved systems, the

compliance deadline would shift from April 26, 2029, to

April 26, 2031.

Why Primacy Matters. So far, nine states—Colorado,

Connecticut, Idaho, Illinois, Maryland, North Carolina,

Vermont, Washington, and Wisconsin—have incorporated

the new PFOA and PFOS standards into state drinking

water regulations and submitted primacy program revision

applications to USEPA.

Once states obtain primacy, they may choose to shorten or

end an exemption granted by USEPA.

PROPOSED NEWPROPOSED NEW

PFAS DRINKING PFAS DRINKING

WATER RULESWATER RULES

What Utilities Need to Know

EDITORIAL

DIANA LEONARD (dmleonard@carollo.com)

CONTENT EDITOR

Diana Leonard / dmleonard@carollo.com

COPY EDITOR

Mary Ann Mavrogianes

GRAPHIC DESIGNER

Silvia Higuera-Backlund

IN THIS ISSUE

Understanding the Proposed PFAS Rules

The Critical Role of Pretreatment

Design-Build: Two Paths, One Destination

Building Confidence in RO Monitoring

Cybersecurity New Front Line

Bryant L. Bench 2026 Scholarship Winner

Early Engagement is Critical

Utilities that align with regulators, secure equipment, and

communicate with customers will be best positioned for

whatever emerges from this rule-making process.

REGULATORY CORNER / CURRENTS

Extension Rule Interim Control

Measures. Systems with a PFOA

or PFOS sample at or above 12 ng/L

would be required to implement at

least two of six control measures

during the exemption period.

1 Provide water pitchers and a

two-year supply of filters certified

to reduce PFOA and PFOS levels.

2 Deliver alternative water supplies

with lower PFOA and PFOS levels

by distributing bottled water,

temporarily switching to a

new source,

or blending

water supplies.

3 Install, operate,

and maintain

point-of-use or

point-of-entry

devices certified

to decrease PFOA

and PFOS in all

customer locations.

4 Implement actions and plans to

decrease PFOA and PFOS levels

in drinking water sources via

source identification and

source control.

5 Distribute written public education

materials to consumers on PFOA

and PFOS exposure sources.

6 Conduct community education

and outreach activities on PFOA

and PFOS in drinking water.

Note that the control measures selected

cannot include options 5 and 6 only.

Control measures for systems

with PFOA and PFOS levels above

4 ng/L but below 12 ng/L would

not be required during the

exemption period.

Jan. 1 Apr. 26 Apr. 26 Apr. 26

2027 2029 2031

Initial monitoring begins

Compliance

monitoring begins

MCL compliance begins Potential PFOA and

PFOS MCL compliance

extension

Initial monitoring must be

completed and submitted

Public notiﬁcation required

for MCL violations

2019-2026

Engage early and often with

your state primacy agency.

States will ultimately decide if they

want to allow for the federal exemption. Once

states obtain primacy, they may choose to shorten

or end an exemption granted by USEPA. Early

engagement can clarify expectations and

reduce uncertainty.

Continue advancing treatment

planning and implementation.

Do not pause or delay technology

evaluation, system design, construction, or system

commissioning while these two proposed rules are

being ﬁnalized.

Consider alternative project delivery

approaches. For capital improvement

projects, advance early work packages

or pre-procurement strategies to secure long-lead-

time items and reduce schedule risk.

Plan for interim actions. Utilities

may need to identify and implement

interim measures, such as raw water

blending, powdered activated carbon application,

and other available tools. Communicate with state

primacy agencies and customers about these

interim control strategies.

Establish a public communication

and outreach plan. Seeking a

compliance extension requires formally

certifying noncompliance, which may necessitate

public perception strategies.

Proposed changes may offer more time for

PFOA and PFOS compliance, but they do not

reduce the need for planning. The period for

public and written comments has passed;

however, utilities can still implement several

proactive measures to better navigate the

evolving PFAS regulatory landscape.

ACTIONS UTILITIES CAN

TAKE TO STAY AHEAD

Carollo Can Help

Carollo can help utilities understand

the proposed rules, coordinate with

state primacy agencies, prepare

extension applications, determine

treatment needs, design treatment

systems, advance procurement

and construction strategies, and

develop public outreach to foster

consumer trust while utilities

prepare for compliance.

PROPOSED PFAS MAXIMUM

CONTAMINANT LEVEL

RESCISSION RULE

This rule would rescind the MCLs

for perfluorohexane sulfonic acid

(PFHxS), perfluorononanoic

acid (PFNA), hexafluoropropylene

oxide dimer acid (HFPO-DA), and

hazard index (HI) mixtures that

include these three compounds

plus perfluorobutanesulfonic

acid (PFBS).

This rescission will not affect the

PFOA and PFOS regulation. NA,

HFPO-DA, and PFBS would

not be regulated beyond the

final date. USEPA emphasizes

that this change is not an

abandonment of concern

about these PFAS, but rather

a restart to consider regulating

them in the future with proper

scientific review and public input.

As of January 2026, only nine

systems nationwide exceeded

MCLs for PFHxS, PFNA, HFPO-DA,

and/or HI mixtures—indicating

that only a small percentage of

systems will be able to avoid

PFAS treatment under the MCL

rescission rule.

PFAS monitoring and data reporting milestones remain unchanged

by the proposed compliance extension and MCL rescission rules.

Awareness. Organized pretreatment programs must

remain current to respond to ongoing regulations and

local ordinances, such as sewer use ordinances, enforcement

response plans, and inter-jurisdictional agreements.

Adaptability. Change is constant. This is evidenced by

the recent surge in large-scale industrial facilities such

as data centers and semiconductor facilities—as well as

the adoption of direct potable reuse in many communities.

Utilities must remain nimble to develop, evaluate, or update

pretreatment programs that reflect the current service area,

treatment train, and compliance priorities. Adaptability is

essential in responding to unexpected changes, such as

abrupt pollutant discharges, unexpected industrial

development, or upcoming water reuse needs.

It's important to recognize that wastewater treatment

plants frequently discharge to bodies of water that may

ultimately become sources of drinking water. Protecting

them is a shared responsibility—affecting utilities, dischargers,

and rate payers alike.

The Preventative Mitigation Toolbox

Industrial pretreatment programs (IPPs) are the first barrier

for publicly-owned treatment works (POTWs) to safeguard

their facilities and the receiving ecosystems from excessive or

harmful pollutants. Developing regulations and requirements

for industrial users can protect utilities from toxic or high-

strength discharges that the POTW was not specifically

designed to treat—such as heavy metals, toxic chemicals,

or corrosive acids. These harsh pollutants can corrode

pipes or destroy fragile biological processes, and eventually

reach a receiving lake or river.

Because many pollutants adhere to solids during the

wastewater treatment process, high-influent loading can

cause excessive pollutant concentrations in the biosolids as

well, making the disposal of municipal sludge increasingly

difficult or even impossible.

Alleviating these issues is especially important for water

reuse or recycling programs.

Local limit maintenance. One of the most common tools

in a utility’s pretreatment toolbox is maintaining local limits

that reflect the current service area and its limitations. Local

limits regulate industrial discharges to protect treatment plant

infrastructure, improve worker safety, and secure environmental

compliance. They should be evaluated every National Pollutant

Discharge Elimination System (NPDES) permit cycle or when

significant modifications or end uses change at the POTW.

Industrial protocols. Industrial dischargers have a

primary impact on pretreatment programs. Protocols

are a requirement of a federally-approved IPP and include

frequent inspections, updated permits, and recurring

industrial waste surveys.

CURRENTS / PROJECT UPDATE

OLIVIA TAHTI (otahti@carollo.com)

KRISTEL BAUMGARDNER-KRANZ, PE

MARY KATE FORKAN

SYDNEY PAZERA

THE IMPORTANCE OF

A well-defined pretreatment program

sharpens the tools needed to protect

POTWs and mitigate potential problems if

discharges in the collection system go awry.

PRETREATMENT

Pretreatment in the wastewater cycle helps safeguard

facilities, receiving ecosystems, and residential,

agricultural, and industrial recycled water users.

From the smallest towns to the largest cities, wastewater treatment

plants are an essential element of effective water management—

purifying wastewater before it's returned to the environment,

preventing the spread of waterborne pathogens, and safeguarding

aquatic ecosystems. Communities rely on these facilities to help

protect their quality of life. But what protects your treatment plant?

in Protecting Wastewater

Treatment Facilities

For OCUD, the maximum

allowable headworks loading

analysis helped determine

that existing local limits were

adequate for all three plants.

allowable headworks loadings (MAHLs)—back-calculated

from OCUD’s existing local limits to the AAPLs—to determine

if the existing local limits were enough to protect each plant.

Challenging Project Meets a Tight

Schedule in the Sunshine State

The Orange County Utilities Department (OCUD) in central

Florida reached out to Carollo to re-evaluate its industrial local

limits as part of its NPDES permit renewal. Typically, local limits

re-evaluations are scoped for around six months for a single

treatment plant. However, for this project OCUD required a

meticulous evaluation of a large water quality dataset from

three water reclamation facilities (WRFs) and a key report

delivered to a state agency in just two months.

The work addressed four major components:

1. Compliance history.

2. A headworks loading comparison of existing local

limits and pollutants of concern.

3. Identification of new pollutants of concern.

4. Potential WRF design or operational modifications.

The team also evaluated historical water quality data, NPDES

permit requirements and modifications, disposal practices,

flow data, and design-based loading capacities at each WRF.

To be effective, a local limits evaluation typically includes

a headworks loading analysis. If the pollutant load at the

headworks is greater than the treatment process can

remove, a more stringent local limit may be required.

Historical water quality and flow data provided a basis to

calculate average annual pollutant loadings (AAPLs) for

each local limit pollutant entering each WRF every year for

a four-year period. This enabled comparing the maximum

While neither pollutant had existing local limits, the

evaluation recommended they be considered during

OCUD’s next local limits evaluation.

Carollo’s review of OCUD’s priority pollutant scans at each

WRF identified a total of 11 new pollutants of concern but

determined that no immediate action was currently required.

Because pretreatment projects require extensive review,

this project is still in negotiations with the state of Florida.

No two local limits evaluations are alike. Each pretreatment

program has different industrial users, relevant end uses,

and opportunities for improvement. Tailoring solutions for

each utility requires diligence, foresight, and expertise—all

of which are specialties of Carollo's pretreatment team.

■ All existing local limits protected each WRF.

■ Two pollutants of concern showed MAHL exceedances:

Ò Total Kjeldahl Nitrogen (as N).

Ò Total dissolved solids (TDS).

KEY FINDINGS

PRETREATMENT IN ACTION How OCUD Applied These Principles to Protect its Facilities

The Carollo pretreatment team has refined all the tools

necessary to close the loop between scientific analysis,

wastewater treatment facility planning and design, and

potable reuse implementation to protect POTWs, their

receiving waters, and the communities they serve.

6666

POISED FOR DELIVERY

TWO PATHS

TO DESIGN-BUILD

SUCCESS

Public agencies are increasingly turning to design-build (DB) to save

time, control costs, and attract skilled builders in a tight market. Based

on Carollo's experience, one DB pattern stands out—the agencies

excelling in DB aren't necessarily the ones bringing the most DB

experience to the table. They're the ones who show up ready.

One of the most common miscon-

ceptions about the DB delivery

method is that it is primarily a

procurement choice. Match the

project to the method, select a

team, sign the contract, and the

benefits follow. But in practice,

DB project benefits accrue

from capability deeply rooted in

organizational readiness.

When teams haven't built that

capability, the familiar challenges

emerge: slower decisions; mis-

aligned expectations between

owner, engineer, and contractor;

unclear roles; and uncertainty

about who owns which risk.

The method itself doesn't resolve

these challenges. Discipline and

alignment do. Teams that make

timely decisions, integrate construc-

tion thinking early, and stay aligned

when conditions shift are the ones

who realize DB's full value.

EARNING READINESS

THROUGH EXPERIENCE

PATH

Applying Lessons Learned

in Baytown, Texas

The Baytown Area Water Authority (BAWA) is

expanding its East Surface Water Treatment Plant

(ESWTP) from 6 to 12 mgd via progressive DB.

The expanded plant will meet growing water

demands, enhance system reliability, and

support regional planning.

This smaller-scale DB project is drawing

on lessons learned by team members

involved in other DB projects in the region,

including the 320-mgd expansion of Houston's

Northeast Water Purification Plant.

While the ESWTP is more than an

order of magnitude smaller than

the $2 billion Houston project,

the team is leveraging best

practices—such as educating

stakeholders, using

standard-form

contracts, leaning

into collaboration,

and establishing

proven conflict resolution

strategies—to shape the BAWA project.

Expected to be operational by the summer

of 2028, the project's success will not hinge

on its smaller size, but rather on the applied

discipline developed on larger, more complex

work. The BAWA team has engaged stakeholders

early. Local construction realities have informed

design. Decisions are moving quickly. Second-

guessing is rare.

For utilities and partners who have delivered

DB before, this discipline is one of the strongest

arguments for starting with a successful project

and building from there.

TWO

PATHS

ONE

DESTINATION

CHITRA FOSTER, PE, DBIA (cfoster@carollo.com)

PAUL WALKER, PE

It Pays to Invest Early

Working alongside many utilities

that have implemented DB projects,

Carollo has seen readiness built two

ways. Some agencies earn it through

experience—developing discipline

across a series of projects. Others

build it purposefully—structuring

the organization, governance, and

decision-making before the first DB

project begins. Both paths work.

Both rely on intention.

DB is a Delivery Capability,

Not a Procurement Decision

More than just infrastructure, BAWA's

ESWTP expansion is about planning

ahead, collaborating openly with multiple

partners, and building with purpose.

CURRENTS / FEATURE STORY

7777

Planning for Flood Control

Preparedness in Hurricane Country

The Harris County Flood Control District took

a different route. On the Gulf Coast, disasters,

storms, and the ensuing flooding events are

a seasonal certainty. For Texas' third-largest

county, waiting until after the next hurricane

to plan its first major DB program would be

politically and operationally untenable.

In 2025, the flood control district established

a Collaborative Delivery Task Force,

bringing together engineering, construction,

infrastructure, procurement, O&M, and the

county attorney’s office to execute a holistic

playbook to tackle the issue. Ongoing

work includes:

■ Compliant contract templates purposed

from the county's existing general conditions

and skillfully adapted to DB by the county

attorney's office.

■ Workflows—vetted through the flood control

district's purchasing and legal departments—

to streamline procurement.

■ Staff training programs and industry

engagement to build organizational fluency.

Currently the effort involves launching this first

progressive DB project as a pilot to stress-test

the playbook. It's a proactive, politically-aware

approach that positions this agency so that

when federal disaster recovery funds arrive,

the Harris County Flood Control District is

ready to deliver competitively, transparently,

and at speed.

BUILDING READINESS

BY DESIGN

PATH

Agencies with DB experience should use it deliberately. Assign

people who have done it before. Carry forward what worked.

Give a smaller project the same rigor as a larger one, and

favorable results tend to follow.

Agencies preparing for their first DB program should understand

experience isn't a prerequisite. Utilities that thrive on their first

program are the ones who prepare as if it were their tenth—with

governance defined, stakeholders aligned, risk allocation clear,

and construction perspective built in from day one.

Design-build rewards the teams who are READY.

Plagued by flooding in the Houston

area for nearly a century, the

Harris County Flood Control District

is actively working with project

partners to plan for its first county-

wide DB flood control strategy.

For agencies preparing for their first DB program, readiness depends

on a handful of deliberate actions taken before procurement begins.

POSITIONING FOR READINESS

AS A FIRSTTIME DB UTILITY

Define how decisions get made, and by whom.

DB moves quickly. Mapping decision authority,

approval paths, and escalation routes early keeps

the project moving forward.

Engage the right stakeholders.

Legal, operations, executive leadership, and technical

staff all benefit from being at the table from the start.

Clarify risk tolerance.

Understanding what risks the agency and contractor

will each hold, and where the engineer fits in, removes

one of the biggest sources of DB friction.

Bring construction thinking into design.

DB's value emerges when designers understand how

projects get built. Constructability reviews and early

contractor input make that real.

Set expectations for team collaboration.

Defining how the owner, engineer, and contractor

will communicate, resolve issues, and align on goals

is a foundation to build on.

The common thread across all five actions: none of this requires

prior DB experience. It requires awareness and intention.

KYLE THOMPSON, PhD, PE (kthompson@carollo.com)

YOKO KOYAMA, PE

ANDREW SALVESON, PE

CURRENTS / PROJECT UPDATE

How can utilities

achieve more reliable

and cost-effective

RO performance

results—even when

data doesn't behave

as unexpected?

Reverse osmosis (RO) systems are among the workhorses of potable

reuse, helping provide reliable pathogen removal when treated

wastewater is advanced to drinking water quality. Under ideal conditions,

RO can achieve greater than five log removal values (LRVs)—which means

it can provide multiple orders of magnitude of pathogen reduction. But

confirming monitoring results in real time can be harder than it sounds.

RO systems can

achieve high LRVs,

but it's challenging

to verify when

real-time monitoring

can't distinguish actual

integrity changes from

ordinary variability.

The stakes are high. As regulatory

expectations for pathogen removal

continue to increase, especially

under emerging direct potable reuse

frameworks, utilities need alarms

that are both fast and trustworthy.

A Balancing Act

A monitoring system must detect genuine

losses in RO integrity quickly, but it must

also avoid overwhelming operators with

false alarms that interrupt operations

without improving reliability.

That balance becomes difficult when the

statistics behind the alarm system do not

match actual data behavior. Traditional

RO monitoring thresholds often assume

LRV data follows a normal, bell-shaped

distribution. With that assumption,

operators can set thresholds based

on standard deviations and expected

probabilities. The problem is that real RO

data often doesn't follow that script.

A recent Carollo-led research effort challenged a fundamental water quality

monitoring assumption—namely that sensor data follows a normal distribution.

Funded by the US Department of Energy through the National Alliance for

Water Innovation (NAWI), this work introduced a new statistical framework that

significantly improves how utilities can interpret RO performance issues and

respond to potential integrity issues.

At OCWD, RO surrogate LRVs show that real-time monitoring data often

departs from a neat bell curve, which can undermine alarm thresholds.

High Stakes, Imperfect Data

Utilities don't usually measure pathogen removal

directly every minute of the day. Instead, operators

rely on surrogate water quality parameters,

including conductivity, total organic carbon (TOC),

and emerging indicators—such as adenosine

triphosphate (ATP) or fluorescence—to determine

how well membranes are performing. These signals

are valuable, but they are also noisy, variable, and

sometimes unpredictable. At very low concentrations,

even small measurement errors can create outlier

LRV values, making it difficult to know whether an

alarm reflects a real integrity issue or just unruly data.

WHEN DATA BREAKS THE RULES: WHEN DATA BREAKS THE RULES:

Across datasets from three reuse systems,

Carollo's research team found that most

surrogate LRV datasets were left-skewed,

bimodal, or non-stationary. Even when

data were averaged over longer periods,

many variables still remained non-normal.

When standard statistical tools are applied

to non-normal data, the result can be

systematic error, including more false

alarms than expected.

A New Approach:

The Shewhart Sign Chart

To address this challenge, the

research team applied a nonparametric

statistical method known as a sign

test. When implemented in a rolling

fashion, this becomes an exploratory

and supplemental method known as

a Shewhart sign chart. This approach

does not assume the data are normally

distributed. Instead, it evaluates whether

the median of recent data points is likely

above or below a target value.

The idea is surprisingly intuitive.

Each data point is treated like a simple

"above or below" result, similar to a series

of coin flips. A single low reading does

not automatically trigger an alarm. But if

multiple values fall below the threshold

within a rolling window, confidence

increases that system performance has

shifted in a meaningful way. This makes

the method less sensitive to isolated

outliers and more focused on patterns

that may indicate a true change

in RO performance.

POTENTIAL BENEFITS

Implementing the Shewhart sign chart resulted in potential monitoring benefits

observed across the multiple datasets evaluated. These included:

For most surrogates evaluated, it reduced alarm

events by at least 50 percent compared to simple threshold-based alarms on individual

data points.

With a

rolling window of 12 data points, the method has the potential to detect RO integrity issues

in as few as three consecutive measurements. Assuming hourly or minutely data points, this

means the response may be faster than daily integrity testing or daily averaging approaches

currently used for indirect potable reuse.

The approach also produced fewer than one alarm

per week across the evaluated datasets, a frequency that may better align with operational

needs—reducing unnecessary intervention while maintaining vigilance.

From Research to Full-Scale Evaluation

This work has progressed from statistical research to a prototype demonstration

using data from California's Orange County Water District (OCWD) full-scale RO

systems. OCWD and Carollo have developed a cloud-based research dashboard

combining high-frequency RO data with real-time statistical calculations, including

the Shewhart sign chart. The prototype allows these exploratory statistical

indicators to be viewed alongside existing RO performance metrics, providing

additional context for evaluating whether an apparent change may represent a

meaningful process shift.

OCWD's prototype

cloud dashboard

demonstrates

combining RO data,

real-time calculations,

and operator reporting

into a practical

monitoring workflow.

The Shewhart sign chart uses a rolling sign test to avoid reacting to isolated

outliers while still identifying exceedances that may signal a real process shift.

Multiple exceedances

in a window trigger

an alarm

Single outliers did

not trigger alarm

with n ≥ 12

Same LRV threshold as

normal-based alarms

Broader Industry Implications

Although this research was developed for RO

monitoring, its implications reach well beyond

membrane systems. Other water quality datasets

are also often non-normal, heterogeneous,

and shaped by sensor limitations and process

variability. Carollo has already begun transferring

this methodology from RO monitoring surrogates

to wastewater effluent nitrate for other clients.

The takeaway is simple: better decisions

start with better assumptions. When monitoring

methods reflect the way real-world data actually

behaves, utilities can reduce unnecessary alarms,

respond more confidently to potential performance

changes, and build more resilient treatment

operations. In other words, sometimes the

smartest way to monitor RO performance is

to stop expecting the data to be normal.

CURRENTS / WHAT'S NEW

Develop an Operational

Technology (OT)

Governance Program.

Establish policies, roles,

and oversight for operational

technology cybersecurity.

Segment IT and OT

Networks. Separate

networks to limit

lateral movement and

contain potential threats.

Replace and Harden Legacy

Supervisory Control and Data

Acquision (SCADA) Hardware.

Upgrade outdated systems and

ensure secure configuration

of all assets.

Deploy Continuous

Network Monitoring and

Asset Management.

Detect

anomalies early and maintain

visibility of all assets.

Implement Role-Based

Access Controls and

Multifactor Authentication

(MFA).

Ensure only authorized

users have appropriate access

to critical systems.

Strengthen Physical

Security Controls. Protect

facilities, equipment, and access

points with layered physical

security measures.

NORM ANDERSON, PE, CISSP, GICSP (nanderson@carollo.com)

SHAWN CORRIGAN, CEM, CBDP, ENV SP

Reliability, resilience, and public

health have always been the

core missions of public utility

systems. For the last 20 years,

cybersecurity has steadily risen

as a concern. Yet today, amid

escalating geopolitical tensions,

cyber threats still pose immediate

risks, demanding proactive

planning and proven strategies

to protect critical operatons.

Recent attacks have

successfully targeted

multiple water systems

using internet-accessible

programmable logic

controllers (PLCs), causing

loss of functionality, shifts

to manual operations,

and significant financial

impacts to utilities.

HOW ATTACKS

IMPACT OPERATIONS

Internet Exposure.

PLC are accessible

from the internet.

Unauthorized Access.

Attackers gain entry.

Configuration Change.

Critical settings

are modified.

Operational Disruption.

Treatment process

are affected.

Manual Operations.

Operators must respond

to maintain service.

OPERATIONAL

IMPACT

FROM AWARENESS TO ACTION

Many utilities have completed risk and cybersecurity assess-

ments. Implementing them should focus on key priorities.

1 4

2 5

3 6

REPORT

SUSPICIOUS ACTIVITY

NOTIFY

CISA

• FBI

STATE + LOCAL AUTHORITIES

Cybersecurity and Infrastructure Security

Agency

NEW FRONT LINE

ELIMINATE Direct Internet Exposure

Keep PLCs, human-machine interfaces (HMI),

and OT assets off the internet. Use virtual private

networks (VPNs), gateways, and firewalls with strong

authentication and logging.

SECURE PLC Configurations

Place controllers in “run” mode when not programmed

and regularly verify settings, IP addresses, and

program files.

STRENGTHEN Authentication

Replace default passwords with strong credentials

and deploy MFA wherever possible.

PREPARE for Recovery

Maintain clean, tested backups of PLC logic, HMI

applications, network configurations, and engineering

files—stored offline and protected from ransomware.

PRACTICE Incident Response

Maintain current emergency procedures, manual

operating capabilities, vendor contacts, and reporting

protocols for rapid recovery.

Each initiative should include a defined scope, implementation plan,

budget, and clear responsibilities. Well-structured programs achieve

measurable improvements.

SPOTLIGHT / CURRENTS

Conner graduated in June with a

bachelor's degree in environmental

engineering from the University

of Nebraska Omaha (UNO), where

he was recognized with the 2026

Undergraduate Major Award

for Environmental Engineering.

In August, he returned to UNO to

pursue a master's degree—supported

in part by Carollo's Bryant L. Bench Scholarship.

A key part of Conner's education over the past

four years has been his work with Engineers

Without Borders on a bridge project in Zambia.

His involvement spanned the entire engineering

process, from community engagement, project

development, and grant procurement, to design,

government approval, and construction oversight.

The experience provided hands-on exposure to the

real-world challenges and rewards of engineering

while making a meaningful impact on the

local community.

Conner credits experiences like these for shaping

his can-do philosophy.

2026 RECIPIENT

CONNOR NEVILLE

At times, engineering work can be overwhelming.

It can be difficult to see the end. I simply remind

myself that even when you're in the weeds, you can

figure it out and persevere. This scholarship is going

to make my life much easier in grad school and allow

me to focus on what's most important."

CYBER THREATS ARE AN

EXTENSION OF GEOPOLITICAL

CONFLICT. WATER SYSTEMS

ARE PRIME TARGETS.

2008 • USEPA publishes a 10-year roadmap to secure

control systems in the water sector.

2018 • America’s Water Infrastructure Act (AWIA)

expands resiliency requirements and places an

emphasis on cybersecurity.

TODAY • Nation-state actors increasingly target

critical infrastructure, posing real cyber threats to

utilities every day.

Many of the most effective protections are straightforward

and achievable.

The Bryant L. Bench Scholarship was launched in honor

of Carollo’s former water practice director, Bryant Bench,

whose innovative treatment concepts helped improve

drinking water quality across the country. The scholarship

is a one-time $10,000 award that students can use to

complete or further their education in their chosen field.

SCHOLARSHIPSCHOLARSHIP

CAROLLO ENGINEERS VOLUME 4 2025

800.523.5826 / carollo.com

Talk is easy. Impact is earned. At Carollo, we approach innovation as something to be built, tested, and

proven in the ﬁeld, not just imagined. From breakthroughs like XBAT, Blue Plan-It®, and I-FLOAT® to integrated

AI/ML solutions, we focus ingenuity where it matters most: solving water challenges for our clients and

communities. The result is progress you can measure in real terms—protecting public health, strengthening

ecosystems, and delivering resilience that lasts. That’s Carollo Innovation.

Innovation

is just a buzzword.

Until it has proven impact.