Decision RecordActivePublished without chair review
CRT-2026-024518 Aug 2026MORNING EDITIONDaily Roundtable
Harden internet-exposed water-facility controllers
Remove programmable controllers from direct internet exposure, restrict operational-technology ports, rotate credentials, require multifactor authentication, preserve evidence, verify configurations and water quality, rehearse manual operation, and notify relevant authorities.
Current public guidance · the full record
What to do now
At a glanceThe edition's authoritative action board carries no action for this record's subjects — no What to do now guidance.
Why now
Partially supportedThe August 18, 2026 Roundtable contributions reported that controller equipment across at least seven states had been affected and that operations were temporarily degraded.
The evidence audit found that both contributions tied those reported operational effects to immediate defensive controls, while also finding no primary source that independently verifies the scale.
The urgency is therefore to reduce direct controller exposure and verify operations now—not to assign responsibility or claim a coordinated campaign.
Who is affected
Under reviewWater-facility operators and control-room staff managing directly internet-reachable programmable controllers face the reported possibility of temporary operational degradation and need a rehearsed manual-operation path.
Operational-technology and security administrators responsible for ports, credentials, multifactor authentication, logs, configurations and project files must remove exposure and verify controller integrity.
Water-quality and incident-response personnel at facilities with suspected controller activity must verify water quality, preserve evidence and notify relevant authorities.
The packet identifies no controller vendor, model, firmware version, named facility, state or specific OT port, and it reports no drinking-water disruption.
What supports this
SupportedSupport — Elena Rossi’s August 18, 2026 geopolitical contribution reported that equipment across at least seven states was affected, operations were temporarily degraded and no drinking-water disruption was reported; it explicitly rejected incident-level attribution.
Contextual support — Halil Öztürkci’s moderator synthesis repeated that operational assessment and linked it to stronger defenses, while preserving the attribution caution; this was a restatement, not independent corroboration.
Support — the evidence auditor found that both contributions prescribed the listed controller-hardening, verification and evidence-preservation controls.
Evidence gap — the same audit found no authoritative source for the reported scale or degradation, so those details are not treated as established facts.
How the Roundtable reached this
Under reviewThe decision scout identified stronger defensive action based on reported multi-state effects and temporary operational degradation.
The linker found no prior decision to update. The evidence auditor found that both August 18, 2026 contributions supported the listed controls, but also found that the moderator’s account did not independently corroborate the reported scale.
The boundary reviewer separated the supported defensive measures from unsupported incident counts and actor attribution. The arbiter therefore chose a new operational decision limited to immediate hardening, verification and evidence preservation.
Positions are generated by AI specialist personas and chaired by Halil Öztürkci.
Panel composition
- Scout (AI panel role)Scout identified 5 candidate signals.
- Linker (AI panel role)Linker evaluated 5 relation judgments.
- Evidence Auditor (AI panel role)Evidence Auditor recorded 12 evidence signals; 7 gaps.
- Prediction Steward (AI panel role)Prediction Steward accepted 0 predictions and rejected 2 claims.
- Boundary Reviewer (AI panel role)Boundary Reviewer recorded 10 public/private findings.
- Arbiter (AI panel role)Arbiter produced 5 decision envelopes.
Key disagreement
Scout (AI panel role)
No drinking-water disruption was reported, and public evidence does not establish coordination, shared tooling, Iranian direction, or incident-level attribution.
Arbiter outcome
Arbiter outcome: new decision record. The defensive action is supported and no existing record was retrieved. Because the precise incident scale and operational effects lack a primary source, publication should omit those specifics and avoid actor attribution.
Candidates considered
Considered 5 candidates · opened 1 · 4 not opened (4 other)
Considered, not opened
Sign in to preview Considered-Not-Opened entries (moves to Pro at launch).
Sign in to preview practitioner entries.
What is uncertain
MissingThe precise incident count, affected states, facilities and operational effects remain unverified by a primary source.
The available discussion does not establish coordination, shared malware, common direction, IRGC involvement or incident-level Iranian responsibility. No controller vendor, model, firmware version, configuration or specific OT port is identified.
The discussion reports no drinking-water disruption, but the packet contains no facility measurements that independently confirm that result.
What evidence is missing
ConflictingThe packet lacks a primary advisory or authoritative incident report confirming the number of affected facilities or states, the nature and duration of operational degradation, and the absence of drinking-water effects.
It also lacks facility-level controller inventories, vendors, models, firmware versions, exposed OT ports, configuration baselines, project files, logs and water-quality measurements.
Incident-level forensic evidence—such as common infrastructure, synchronized targeting or shared tooling—is also missing for any coordinated-campaign or actor-attribution finding.
What would change this
Under reviewAn authoritative incident report confirming the reported multi-state scope and temporary degradation would support publishing those details as established facts.
A primary report contradicting those effects would reduce the scale-based urgency, although direct internet exposure would still require remediation.
Common infrastructure, synchronized targeting, shared tooling or other incident-level forensic evidence could change the coordination or attribution assessment.
A verified inventory showing that a deployment has no directly internet-reachable controllers would complete the immediate exposure-removal task for that deployment.
What to watch next
Partially supportedMonitor controller logs, configurations, project files and water-quality results for unexpected changes.
If a discrepancy or suspected controller compromise appears, preserve the evidence, remove direct internet exposure, activate the rehearsed manual-operation process and notify relevant authorities.
Watch for an authoritative incident report and for common infrastructure, synchronized targeting or shared tooling; those findings should trigger a reassessment of campaign coordination and attribution.
Evidence basis
What changed is the assessed scale and operational effect, not the attribution. Equipment in at least seven states was affected and operations were temporarily degraded, but no drinking-water disruption was reported. That strengthens the ca…
Public value history
- 18 Aug 2026Initial public guidanceCurrent guidance
Created the first public value version for this Decision Record.
Source RoundtableMorning roundtableConvened 18 Aug 2026Methodology
How the panel reaches a Public Decision Record.