[halJordan]

CISA is the one who mandates these controls and who manages the public/private relationship. Who issues the active exploration warnings. Who suggests legislation to prevent this in the future, including mandatory software updates.

If your question was only a trite recitation of the fact that private enterprise consistently refuses to practice cybersecurity then you've added nothing.

If your question was about who watches the watchers and what we're doing about the fact that private enterprise refuses to practice cybersecurity then it was an incredibly relevant statement.

[lorreyfum]

A public water authority needs to step it up, at least to the level of other public water authorities who don’t have the problem. Simple matter of disconnecting it from the internet and running security patches, c’mon man!