You might wanna have a look at this...
From the above...
“...Recognizing that water utilities tend to have less mature cybersecurity programs and, as such, a weaker posture, Markus Mueller, field CISO at Nozomi Networks, wrote in a statement that they tend to rely more on third-party integrators and service providers. “They tend to be underfunded and smaller compared to other utility sectors...”
It gets worse.
I have (yet another) dumb question:
Do these facilities really need to internet connected to function?