Water and wastewater SCADA systems have zero EMP hardening requirements

Municipal water treatment and wastewater systems across the U.S. are controlled by SCADA (Supervisory Control and Data Acquisition) systems that use unshielded PLCs, RTUs (remote terminal units), and radio/cellular telemetry links. EPA regulations and AWWA (American Water Works Association) standards address cybersecurity since 2018 (America's Water Infrastructure Act) but contain zero requirements for electromagnetic pulse resilience. An EMP event that damages SCADA controllers means water treatment plants cannot monitor chlorine levels, adjust pH, manage pump stations, or detect contamination. Raw sewage backup begins within hours as lift stations fail. Within 2-3 days without treated water, a city faces a public health emergency — hospitals cannot sterilize, dialysis centers shut down, and fire departments lose hydrant pressure. The EPA's own worst-case scenarios assume grid failure with SCADA intact; the possibility that SCADA itself is destroyed is not modeled. This persists because water utilities are mostly municipal, operating on razor-thin budgets funded by ratepayers who resist rate increases. The average U.S. water utility serves fewer than 10,000 people and has an annual capital budget under $1 million. EMP hardening of a SCADA system costs $100,000-500,000 — often more than the utility's entire annual technology budget. The EPA has explicitly chosen not to regulate EMP resilience, deferring to DHS sector-specific guidance that is advisory only.