NEWS AND EVENTS
The Norwegian Food Safety Authority's new guide makes one thing clear: Waterworks must now take OT security seriously
Author: Tor Ommund Ljosland
The Norwegian Food Safety Authority (Mattilsynet) has now published the first official guide to the Digital Security Regulations for drinking water. It is an important milestone for Norwegian water supply – and a clear signal that the authorities are now stepping up work on digital security in the sector.
The Digital Security Act entered into force in October 2025 and sets concrete requirements for organizations providing critical services. For the water sector, the Digital Security Regulations apply to water supply systems producing at least 2,000 m³ of drinking water per day.
This means that many of Norway's largest waterworks are already subject to these requirements.
But the guide also shows something important:
Even smaller waterworks, which are not directly covered by the regulations, can and should use them as an aid if hazard mapping reveals a risk of cyber incidents.
This makes the guide relevant for far more than just the largest players.
And it makes one thing clear:
Digital security in water supply is no longer a choice.
A guide designed to make the requirements clearer
What is interesting about this publication is not just that the Authority refers to the regulations.
The guide goes much deeper.
It explains the requirements of the Digital Security Regulations, breaks down key terms in the legal text and gives concrete advice on how waterworks can actually comply with the requirements in practice.
It also points to useful resources such as:
- security standards
- checklists
- frameworks
- risk assessment methods
- preparedness models
This matters.
For many years, the water sector has worked on security with varying maturity, differing practices and often limited insight into OT environments.
Now the expectations are clearer.
And so is the responsibility.
OT systems are now explicitly part of the responsibility
One of the most important clarifications in the guide is that operational technology (OT) is an integral part of waterworks' digital security responsibility.
This means that systems such as:
- SCADA
- PLCs
- sensors
- control networks
- remote access
- operationally critical servers
can no longer be treated as isolated technical environments outside other security work.
These are the systems that control water treatment, pumping and distribution.
In short: the systems that ensure society gets clean and safe drinking water.
The guide points to concrete measures
The Authority is clear about which areas waterworks must now have under control:
- establishing a security management system
- risk assessment of both IT and OT
- risk management and action plans
- network segmentation
- strong authentication and access control
- security monitoring
- physical security
- supplier follow-up
- incident handling and preparedness
For many waterworks, this will mean raising their work significantly.
Not because the risk is new.
But because the requirements are now clear, concrete and verifiable.
From theory to practice – experiences from IVAR IKS
At Securenok, we have already seen what this looks like in practice.
Through our collaboration with IVAR IKS, we have assisted with an OT health check, mapping of critical networks and the establishment of continuous monitoring in water and wastewater facilities.
What we often see in such environments is not necessarily active attacks.
But a lack of overview.
Old systems still in operation. Unknown connections between IT and OT. Supplier access without sufficient control. Flat networks and blind spots where activity goes undetected.
This is not unusual.
And these are precisely the conditions the new guide is designed to help waterworks deal with.
Now it's about being prepared
The Authority's guide is not primarily a warning.
It is an opportunity.
An opportunity to better understand the requirements. An opportunity to get an overview of your own vulnerabilities. And an opportunity to build resilience before an incident occurs.
Because when digital incidents hit the water supply, it is not just about technology.
It is about security of supply.
It is about preparedness.
It is about public health.
And it is about trust.
Clean water is critical societal infrastructure.
And critical societal infrastructure must be protected where the risk actually exists.
Would you like to learn more about how modern OT security can help protect waterworks against today's threat landscape while supporting compliance with regulatory requirements?
Download our white paper on OT security and critical infrastructure, or get in touch with us for a no-obligation chat about how our solutions and OT health checks can help strengthen security in your organization.
See more, fear Less. Explore
OT cybersecurity insights.
Insights from Norway’s cybersecurity experts
My first Attack conference: Golf, good conversations and a more serious backdrop
How do you present a cybersecurity company to potential customers while you are still learning about it yourself? I got to practise that when I attended my very first conference, the Attack conference, with SecureNOK on 13 October.
SNOK Health Check picks up speed – we are delivering OT overview after OT overview
What equipment is connected to the OT network, and who is communicating with whom? After several projects with the SNOK Health Check, I see how useful it is to get answers to these questions before deciding on the next security measure.
Water supply and critical infrastructure in focus at the Homeland Security Conference in Denmark
What does it take to keep society running when critical infrastructure is exposed to attacks and disruptions? This question was central when I attended the Homeland Security Conference in Copenhagen on 7 October with the Norwegian Cybersecurity Cluster.
Halfway through the OT Roadshow – time for the conversations that often have to wait
Trondheim, Bergen and Stavanger are done, and we are halfway through the OT Roadshow. For me, this is a valuable opportunity to look up from technology development and discuss security with those who know the everyday reality of industry.
Full house as IVAR IKS shared its experiences with OT security
Interest in the webinar with IVAR IKS was greater than we had dared to hope. Through our October campaign on health checks for water and wastewater facilities, we are now making it easier for more organizations to take the same first step towards better overview and control of their OT environments.
ON 104 has been updated: New requirements for safer and more robust operations on the Norwegian continental shelf
From 1 June 2026, the updated version of Offshore Norge Guideline 104 (ON 104 Rev. 7) applies – one of the most important frameworks for cybersecurity in operational technology (OT) in the petroleum industry.
OT Konferansen shows the Nordics taking a leading role in OT security
Today, many industrial environments consist of industrial networks, virtual environments, Windows and Linux systems, remote access, patching and backup solutions, security tools, cloud services and integrations with IT.
OT security in the food industry starts with insight
As a project manager on OT security projects, I often encounter the same starting point at industrial companies: They know a great deal about production, processes and equipment – but far less about what the digital infrastructure actually looks like in practice.
Norwegian-developed OT security technology for industry and critical infrastructure
Norwegian industry is becoming increasingly digitalized. Production lines, process plants, energy systems and critical infrastructure are being connected more closely to modern IT systems, external suppliers and digital services. At the same time, there is a growing need for cybersecurity solutions actually developed for industrial environments.
Strong support for OT Konferansen 2026 – bringing together leading experts in Stavanger
OT Konferansen 2026 takes place on 29 April in Stavanger, and this year's edition already stands out with a programme that brings together some of the most central players in OT security and industrial digitalization.
Growing need for control in complex automation environments in oil and gas
In recent years, the digitalization of the oil and gas industry has brought significant gains in efficiency, better data and greater flexibility. At the same time, this development has led to a significant increase in complexity – and therefore also in risk.
How to gain control of the OT environment in practice – experiences from IVAR
For IVAR IKS, stable operations are not just a goal – they are a prerequisite for society to function. As a provider of water and wastewater services to around 360,000 residents in Nord-Jæren, the organization manages critical infrastructure where the consequences of failure are immediate and extensive.
The Preparedness Year 2026: Are water and wastewater in Norwegian municipalities secure enough?
Municipal water supply is among the societal functions covered by the Digital Security Act. The Act entered into force on 1 October 2025 and sets basic requirements for digital security in organizations of particular importance to society. The regulations also place responsibility for digital security clearly with the organization's top management.
Stricter Security Requirements for Critical Services from 1 October 2025 under theDigital Security Act
O nFriday, 20 June, the Norwegian government decided in a Council of State meeting that the Digital Security Act will enter into force on 1 October 2025. At the same time, the Digital Security Regulation was adopted, entering into force concurrently with the Act.
Bremanger Breach: Lessons from a Norwegian Dam Hack
Earlier this year, unidentified hackers breached the control system of a Norwegian dam at Risevatnet, in Bremanger. The hackers discovered that the dam had a Human Machine Interface (HMI) exposed on the Internet and was able to gain access by exploiting a weak password.p
Digitalization: Opportunities and New Risks
Digitalization offers enormous opportunities for efficiency, but it also introduces new risks. When OT systems (Operational Technology) are connected to the internet, vulnerability to attacks increases—attacks that threaten not only data, but also lives, health, and critical societal functions.