AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association): every control, and what you already have

37 controls 320 frameworks share controls with it United States (AWWA) held in the corpus

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
NIST Cybersecurity Framework 2.0	16	measure it →
South Korea ISMS-P	13	measure it →
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security	12	measure it →
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0	11	measure it →
ISMAP (Japan)	11	measure it →
ISO 27017	11	measure it →
ISO 27018	11	measure it →
ISO/IEC 27043:2015	11	measure it →
ISO/SAE 21434	11	measure it →
MITRE ATT&CK	11	measure it →
MITRE D3FEND	11	measure it →
MTCS (Singapore)	11	measure it →

Every control

Code	Control	Also in
`AWWA-1.1`	Security Policy and Governance	164
`AWWA-1.2`	Risk Assessment	156
`AWWA-1.3`	Security Awareness and Training	90
`AWWA-1.4`	Compliance and Regulatory Alignment	0
`AWWA-2.1`	User Access Management	154
`AWWA-2.2`	Authentication Mechanisms	85
`AWWA-2.3`	Account Management	40
`AWWA-2.4`	Physical Access Controls	130
`AWWA-3.1`	Network Segmentation	64
`AWWA-3.2`	Remote Access Security	135
`AWWA-3.3`	Wireless Security	0
`AWWA-3.4`	Encryption and Data Protection	174
`AWWA-4.1`	Malware Protection	50
`AWWA-4.2`	Patch Management	17
`AWWA-4.3`	Configuration Management	57
`AWWA-4.4`	Audit Logging and Monitoring	71
`AWWA-G430-1`	Cybersecurity Program Governance	0
`AWWA-G430-10`	Incident Response for Water Utilities	1
`AWWA-G430-11`	Manual Operations Capability	0
`AWWA-G430-12`	Backup and Recovery for Control Systems	1
`AWWA-G430-13`	Supply Chain and Vendor Risk	1
`AWWA-G430-14`	Personnel Security and Insider Threat	0
`AWWA-G430-15`	Cybersecurity Training for Operators	0
`AWWA-G430-16`	Logging and Audit	0
`AWWA-G430-17`	Physical Security of Cyber Assets	0
`AWWA-G430-18`	Configuration and Change Management for OT	0
`AWWA-G430-19`	AWIA Risk and Resilience Assessment Compliance	0
`AWWA-G430-2`	Asset Inventory and Classification	0
`AWWA-G430-20`	Information Sharing and Reporting	0
`AWWA-G430-21`	Cybersecurity Program Review	0
`AWWA-G430-3`	Risk Assessment for Water Systems	4
`AWWA-G430-4`	Network Segmentation IT/OT	0
`AWWA-G430-5`	Access Control for SCADA and Control Systems	1
`AWWA-G430-6`	Remote Access Management	0
`AWWA-G430-7`	Patch and Vulnerability Management	0
`AWWA-G430-8`	Malware Protection	3
`AWWA-G430-9`	Boundary Protection and Monitoring	0

Tell me when AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Segmentation diagram
DMARC reject record
Encrypted DNS policy
Firewall rule review
Network segmentation diagram
Network segmentation (VPC/subnets/security groups)
Board or executive committee charter with security or risk remit
RACI matrix for accountable owners
Process owner attestation
Tooling configuration export

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Flat network named by 7 frameworks
Roles overlap without clear accountable owner named by 3 frameworks
Audit findings without closure dates named by 3 frameworks
Management review skipped one or more cycles named by 3 frameworks
IT and OT response teams not aligned named by 3 frameworks
ICS forensics tooling not in place named by 3 frameworks

What this page is

A control-level reference for AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition