Cybersecurity for water technology
At Xylem, we seek to inspire trust in our solutions, empowering customers to solve the world’s greatest water challenges with innovative products, services and solutions.
Xylem's Security Strategy
Embracing potential, reducing risk
Developing an effective cybersecurity approach allows you to enjoy the benefits digital technologies bring while reducing the risk. Our approach and expertise as a water technology provider are based on two key principles:
- An ongoing journey - Technology and cyber risks are always evolving. An effective cybersecurity program is a journey, not a destination requiring continued vigilance and development.
- A shared process - While digital technologies support all element of operations, they can also introduce risk. We partner with our customers to help them manage the risk and ease their concerns through shared responsibility.
We assess cyber risk and work to embed security in all critical phases of water.
Xylem is a water technology company with a commitment to innovation and to the cybersecurity of our solutions through continuous improvement. Along with a risk‐based design and implementation approach, our engineering, development, and cybersecurity teams remain diligently focused on the identification and management of cybersecurity risk. Our strategy includes secure software development processes guided by industry-standard frameworks:
-
Secure solutions
We include secure by design principles in our products, minimizing vulnerabilities and building in security features through development, testing, and deployment.
-
Swift response
Develop response plans and provide industry-leading forensics and response for your organization when facing cyber incidents.
-
Secure operations
We prioritize continuous operational resilience by conducting ongoing assessments, upgrades, and monitoring, guided by industry standard frameworks such as NIST CSF, ISO 27001, and SOC 2 Type II
To Xylem, 'secure solutions' means:
- Our security engineers perform threat modeling to identify testable controls
- Security controls are verified through automated and manual tests
- We’re a member of ISA Global Cybersecurity Alliance (ISAGCA) to set standards for next-generation Industrial Internet of Things (IIOT)
'Swift response' means
- Our Product Security Incident Response Team (PSIRT) provides a single point of contact and coordination across all product teams for rapid vulnerability remediation
- Water Information Sharing and Analysis Center (Water ISAC) for threat intel
- Forum of Incident Response and Security Teams (FIRST) for cross-organizational mentoring, standard process sharing, and for PSIR standard practices
- Common Vulnerabilities and Exposures (CVE) Numbering Authorities (CNA) for access to NVD to responsibly disclose vulnerabilities and patches
'Secure operations' mean
- Our product security operations center (PSOC) monitors aggregated logs for Xylem-hosted products
- We partner with Cyderes for tier 2 security operations support
- We actively participate in the US CISA Joint Cyber Defense Collaborative (JCDC) for early warning and rapid information sharing, as well as to help establish new standards
Xylem’s approach to product security
Digital transformations increase the importance of secure solutions
As technology transforms the water sector, making it more efficient, resilient, and cost-effective, having a strategy to address cyber risks in a digitally-connected world is key. To ensure digital transformation and operational resilience go hand-in-hand, governments, water operators, and technology partners must work together to keep critical water and wastewater systems safe.
Strong cybersecurity preserves the value of digital technology
Staying secure in a digital world is essential to safeguarding your success. A robust and agile cybersecurity program can keep water flowing safely and efficiently while minimizing disruption. Developing and maintaining a cybersecurity strategy requires expertise and continuous effort. At Xylem, we partner with our customers, utilities, suppliers, and other businesses worldwide to mitigate cyber risk and ensure their operations are resilient. Our cybersecurity approach helps to build customer trust, so that digital technologies can be used safely and seamlessly.
Our approach
Prioritizes:
- Secure solutions: We ensure our systems are secure by design – minimizing cybersecurity vulnerabilities and building in security features.
- Swift response: We monitor connected units’ performance to rapidly respond to any newly discovered threats to the system.
- Secure operations: We help customers to deliver optimally by staying on top of cybersecurity threats and protections.
Based on two key principles:
- An ongoing journey: Technology – and cyber risk – are always evolving. An effective cybersecurity program is a journey, not a destination, requiring continued vigilance and development.
- A shared process: While digital technologies support all elements of operations, they can also introduce risk. We partner with our customers to help them manage the risk and ease their concerns through shared responsibility.
Report security-related information
If you’ve identified a potential security issue, visit our contact page to report it directly to our cybersecurity team.