Back to the archive
    ARC-004CONFIDENCIAL · AnonimizadoCRÍTICO

    Security Plan — WWTP Litoral Sud (Water sector / CI)

    Operator Security Plan (PSO) — basis for a Specific Protection Plan — over a wastewater treatment plant classified as critical infrastructure within the water sector. Covers physical security, OT/SCADA cybersecurity under IEC 62443, hazardous-substance management (chlorine, hypochlorite, biogas), vigilance organisation and contingency/emergency plans.

    Analysis type
    Operator Security Plan · Critical infrastructure
    Sector
    Water · Essential-service operator (Spanish Law 8/2011)
    Status
    Version 1.0 delivered
    Date
    2025
    Ley 8/2011PSONIS2IEC 62443ISO 31000OT/SCADAATEXISO 22301
    01

    Context

    • ·Metropolitan water-services operator. Essential service under NIS2 and Spanish Law 8/2011.
    • ·Facility with sensitive physical assets (biological reactor, settlers, chlorine tank), ATEX zone due to biogas and the SCADA/CCS room as the single most critical technological asset.
    • ·Night shift with no process operators 22:00–06:00 — single private guard with no backup: an unacceptable single point of failure in CI.
    02

    Methodology

    • ·Regulatory framework: Spanish Laws 5/2014 and 8/2011, RD 704/2011, NIS2 (EU 2022/2555), RD 311/2022 (ENS), IEC 62443, ISO 31000:2018, ISO 22301:2019, GDPR/LOPDGDD, RD 681/2003 (ATEX).
    • ·Risk analysis and evaluation under ISO 31000 with a 1–5 P×I matrix.
    • ·Design of security zoning, perimeter protection, access control and specific protection of critical zones.
    • ·OT/SCADA cybersecurity segmented into zones and conduits (IEC 62443).
    • ·SOPs, contingency plans (ISO 22301), incident response, training, drills and crisis management.
    03

    Findings

    01Night shift with a single private guard · single point of failure
    CRÍTICO
    02Sabotage of biological process / chemical dosing
    CRÍTICO
    03OT/SCADA cyberattack — NIS2 exposure
    CRÍTICO
    04Tampering with chlorine / hypochlorite storage
    CRÍTICO
    05Biogas-driven ATEX zone without updated procedures
    ALTO
    06Public asset map visible from the perimeter
    ALTO
    04

    Operational impact

    • ·Essential service: any disruption directly affects public health and the metropolitan environment.
    • ·Combined regulatory exposure: Spanish Law 8/2011 + NIS2 + ENS + GDPR + environmental liability.
    • ·Mandatory incident notification to CNPIC, CCN-CERT and AEPD by category (GDPR: 72h max).
    05

    Full document

    RESTRICTED ACCESS
    21 pp· 108 KB· PDF

    Document from the private archive

    This report is part of Zero101OSINT's private research archive. Access is individual, logged and traceable. No spam, no mailing list.

    Basic privacy information. Project: Zero101OSINT. Legal identity of the controller: pending owner confirmation. Manage the requested document and record the access request.

    Technology and email providers may process the submitted data. Legal basis, retention periods and international transfer arrangements remain pending owner confirmation. This request does not authorize advertising.

    Rights: access, rectification, erasure, objection, restriction and portability, where applicable. Contact: contacto@zero101osint.com. Privacy policy.

    PDF delivered through a temporary signed URL. The access request is recorded.