A board cannot approve a severity score. It can approve a decision.

A water utility board meets once a month. It approves chemical contracts, rate studies, main replacements, and the occasional emergency repair. Every item on that agenda arrives in a form the board understands: what it costs, what it fixes, and what happens if it waits.

OT cybersecurity findings rarely arrive that way. They arrive as a severity score, a vulnerability identifier, and a recommendation written for an engineer. The board is asked to fund something it cannot picture, so it does the reasonable thing. It tables the item, asks for more information, or approves it without knowing what it bought.

The problem is not the board; it is the brief. This article follows one fictional finding from the assessment report to the board vote so that you can structure your OT requests in a way that brings clarity and, often, a faster approval.

The Finding: A Pump Station With an Open Door

Picture a mid-sized utility. During an OT assessment, the team finds that a remote booster pump station has a cellular modem connected to its PLC. The modem was installed years ago so an integrator could troubleshoot remotely. It is reachable from the internet, protected by a weak shared password, and it sits on the same flat network as the station HMI.

The assessment report rates it critical. That is accurate. It is also nearly useless to the board.

Fixing it properly means replacing the modem with a managed connection through the utility's remote access broker and segmenting the station network. The assessment also identified outdated PLC firmware. A firmware update belongs in the plan only where there is an identified need, the vendor confirms compatibility, and the update has been tested before it reaches the station. If the work requires taking the station offline, operations confirms the outage plan: how pressure will be maintained through an adjacent station, what the temporary operating plan is, and what service impacts customers could see.

That is a funding request and an outage request. Neither shows up in a severity score.

Related Read: The Minnesota Water Attack Was a Warning. Here's What Public Works Leaders Should Do Now.

Why a Severity Score Tells the Board Very Little

Severity scores describe how bad a weakness could be in general. They do not describe what it means for this utility or this station. A critical rating on a station that feeds a hospital and a critical rating on a lab workstation are not the same decision, even when the number matches.

Board members think in service, consequence, cost, and accountability. Will residents lose pressure? Could this affect water quality? What does it cost? Who is responsible? A score answers none of those questions.

The board is not being asked to understand the vulnerability. It is being asked to own the decision. Here is how you can help them make decisions with confidence.

The One-Page Decision Brief

A useful brief fits on one page and covers six things:

• Service affected. Booster Station 4, which maintains pressure for about 3,000 residential connections and one elementary school.
• Credible operating consequence. Unauthorized access to the PLC could stop the pumps or change setpoints. The realistic result is a pressure loss in the zone, a possible boil-water advisory, and manual operations until the station is verified. A bad week that residents notice.
• Immediate safeguard. Staff have already disabled inbound access on the modem and moved troubleshooting to scheduled, supervised sessions. That reduces exposure now, but it depends on people following a workaround.
• Corrective options. Option A is the full fix. Option B is managed access and segmentation now, with any needed firmware update at the next scheduled maintenance, after vendor compatibility is confirmed and the update is tested. Option C keeps the interim safeguard and revisits the work next budget cycle.
• Cost and outage assumptions. The estimated cost of each option, the planned outage window, how pressure will be maintained during it, the potential service impacts operations has confirmed, and what could make the estimate wrong.
• Owner. The utility director, or whoever utility policy authorizes, owns the decision. The operations superintendent owns execution, with a date to report back.

Keep the technical detail in an appendix for anyone who asks.

Three Decisions the Board Can Make

A good brief ends with a clear ask. For most OT findings, the board has three reasonable choices.

Approve now. Fund the work and schedule the outage once operations has confirmed the plan. This fits when the consequence is serious, the interim safeguard is fragile, and the cost fits within existing authority or reserves.

Budget for the next cycle. Keep the safeguard in place, add the work to the capital or operating plan, and record it in the risk register. This fits when the safeguard is solid, and the work competes for the same crews and outage windows.

Retain the risk. A decision-maker with the authority to accept the risk does so for a defined period, documents why, and sets the date the board will see it again. The decision must stay within the utility's regulatory, contractual, and policy requirements. Some exposures cannot be retained at all. A review date alone does not make this choice defensible. The authority, the requirements check, and the documented reasoning do.

Any of these choices can be defensible when the right authority makes it, within applicable requirements, and on the record. An item tabled with no owner and no return date is not. That is a decision too. It is just one you should avoid or push back against when you see it.

What Staff Should Bring to the Meeting

The brief is one piece. Staff should also be ready to explain what else the assessment turned up and where this item ranks. Boards reasonably ask, "Is this the only one?" A short list of other findings, grouped by the service they affect, answers that question before it becomes a reason to delay.

Staff should also explain how completion will be verified. A board that funds work should see it closed, not just started.

Related Read: Public Works OT Cyber Resilience, our practical guide for water and wastewater organizations, including how a rapid assessment ranks findings and builds a roadmap leadership can fund.

Five Questions Every Board Member Can (and Probably Will) Ask

Board members do not need to be technical to ask these five questions. Be prepared to answer the following:

1. What service is affected?
2. What happens if we wait?
3. What are the options?
4. What will each option require in money, outage time, and staff effort?
5. Who owns the decision, and when do we hear back?

If staff can answer all five in plain language, the board can decide. If they cannot, the item is not ready for a vote.

30-Day 'Do This Now' Checklist

1. Pick one open OT finding and rewrite it as a one-page decision brief using the six elements above.
2. Map your highest-severity findings to the services they affect. Sort by service, not score.
3. Confirm every interim safeguard has an owner and is written down, not just remembered.
4. Walk your board chair or finance committee through the three-decision format before the next budget cycle.
5. For every risk the utility has chosen to retain, confirm that an authorized decision-maker accepted it, that it stays within applicable requirements, and that it has a review date.

A Clear Ask Gets a Clear Answer

Boards are not the obstacle to OT security. They approve hard, expensive, unglamorous work every month when the request is clear about service, consequence, cost, and ownership. Give them the same clarity on cyber, and they will decide. Sometimes the decision will be to wait. That is fine, as long as it is a decision based on high-quality information and understood consequences.

Make the above a standard practice and not only will your board appreciate your approach, but you will also likely increase trust and confidence in that room. The board will understand that each time you or your team present an OT risk, a confident decision can be, and will be, made.

Find the content useful? Subscribe to The Catch, our exclusive weekly LinkedIn newsletter focused on real-life experiences doing cyber right in the most highly regulated industries.