Certified Coach Approach: Enhancing Cyber Resilience for Water Utilities

### Overview In this presentation at RSA Conference, Karen Evans, Managing Director of the Cyber Readiness Institute (CRI), discusses how CRI uses a certified coach model to improve cybersecurity resilience for small and medium-sized organizations, focusing on a case study within small and medium water and wastewater utilities. CRI was founded as a nonprofit following the Obama administration's Commission on Enhancing National Cybersecurity by companies including Mastercard and the Center for Global Enterprise (led by commission co-chairs Sam Palmisano and Ajay Banga). CRI creates free, practical cyber hygiene materials designed for entities lacking dedicated IT staff or CISOs.

### Key Topics - **Foundational Cyber Readiness Program:** Focuses on organizational culture and policies across four core areas: "Passwords+" (emphasizing multifactor authentication or 15-character passphrases), automatic updates, phishing awareness (including weekly "Phishing Friday" exercises), and removable media storage. Participating entities complete playbooks, conduct data and asset inventories, establish backup routines, create incident response plans, and designate an internal "cyber leader." - **The Coach Approach and Completion Rates:** Research pilots demonstrated that while sending simple participation notifications achieved roughly a 30% completion rate and preferred-provider incentives yielded about 47%, pairing organizations with a human coach who answered questions and held weekly check-ins boosted completion to 78%. - **Water Utility Pilot Case Study:** Partnered with Microsoft, the Center for Cybersecurity and Technology and Innovation at the Foundation for Defense of Democracies (FDD / Cyberspace Solarium Commission 2.0), Idaho National Labs, and WaterISAC. The initial pilot targeted up to 50 small utilities (serving populations under 10,000, averaging roughly 19 personnel), with a planned expansion to 200 utilities.

### Technical Details - **Coach Workload & Role:** Coaches manage up to 10 entities concurrently. Programs typically take six to eight weeks to complete. Coaches do not require deep technical knowledge but must complete the foundational CRI program and pass a simulated role-playing session (often role-played by Evans) to test communication and objection-handling. - **Bridging IT and OT Systems:** When coaching water utilities, coaches help staff identify operational systems (ICS, SCADA, data historians) beyond basic office email/IT, ensuring industrial controls and engineering data are inventoried and backed up. - **Verification & Attestation:** Beyond completing the playbook, organizations can pursue verified "certified cyber ready" status, requiring a virtual review session and a signed attestation letter by both the cyber leader and the head of the organization confirming all personnel have been trained.

### Takeaways Small entities often fail to implement free guidance due to lack of time and confidence rather than lack of materials. Active coaching, paired with high-touch direct communication (such as phone calls instead of just emails), drastically increases follow-through. Evans encourages security practitioners and newcomers to volunteer as certified CRI coaches to assist critical infrastructure utilities and small businesses.