By Ann Marie van den Hurk, Mind The Gap Advisory
Two water utilities got hacked in New Jersey this August. Nobody’s water stopped running. The story mostly ends there in the headlines.
It shouldn’t end there for the people running critical infrastructure.
Officials didn’t name the utilities. They didn’t need to. What matters is what happened next: attackers got into the control systems that manage pumps and valves, operators lost the ability to monitor and manage remotely, and staff switched the system to manual. Service never stopped.
That’s a genuine cybersecurity win. It’s also incomplete, because a working fallback and a working governance structure are two different things, and only one of them showed up in the reporting.
The question nobody’s asking
Having a manual fallback is one thing. Does the person who needs to invoke it know when they’re authorized to do so?
That’s the Manual Override Problem. Resilience isn’t demonstrated by having a backup. It’s demonstrated by an organization’s ability to activate that backup quickly, safely, and with clear authority — all three, under pressure, without anyone stopping to figure out the chain of command in real time.
What actually had to happen
Someone had to recognize that remote operations could no longer be trusted. Someone had to know manual operation was technically possible. Operators had to know how to do it safely. And someone had to have the authority to make the call.
The last one is the easiest to overlook. When it works, it looks invisible. When it’s missing, it’s the whole crisis.
Two clocks, one water tower
Cybersecurity wants certainty before acting. What was accessed, what changed, can the environment be trusted again. Those are reasonable questions, and they take time to answer honestly.
Operations doesn’t have that kind of time. Water still needs to flow. New Jersey’s operators didn’t wait for a completed forensic picture before switching to manual. They couldn’t, and they shouldn’t have.
Authority thresholds built entirely around confirmed cyber findings will always run behind the operational clock. Loss of visibility, unexplained equipment behavior, and the inability to verify system integrity are each reasons to change operating mode, on their own, before anyone knows the cause.
A clean outcome doesn’t prove the governance worked
No water disruption. No public panic. Systems reportedly secured within days. Every account of the New Jersey incidents reads like a success story, and mostly, it is one.
But a clean outcome and a tested governance structure are not the same evidence. The fallback existed. Operators knew how to run it. Somebody happened to be reachable, and happened to have the standing to make the call. Change any one of those variables and the story reads very differently, without a single additional line of malicious code.
The FBI and EPA have been explicit that critical infrastructure operators should practice and maintain the ability to operate OT systems manually — testing continuity plans, fail-safe mechanisms, backups, and standby systems. That’s the technical half of readiness. The other half, who is authorized to pull that switch and under what conditions, has to be engineered with the same discipline.
What CMMC and similar frameworks are already asking for
For organizations working toward CMMC or comparable compliance requirements, this isn’t a new category of work. Documented authority, communicated roles, and an accountable decision trail are baseline expectations, not enhancements layered on top.
The compliance and crisis readiness intersection
A procedure that says “switch to manual operations” describes an action. It does not establish who can order it, who backs them up, or what happens at 2:00 a.m. when the usual person can’t be reached. Assessors ask for that structure. So does the first 20 minutes of a real incident.
The test worth running
Ask your leadership team the question New Jersey answered without anyone planning to ask it: if your automated environment became unreliable right now, could an operator tell you exactly who can authorize the fallback?
Most organizations can’t answer that cleanly, and that’s not a criticism. It’s a gap that stays invisible until the moment it isn’t, and by then you’re not testing governance anymore. You’re doing damage control.
Resilience is not demonstrated by having a backup. It is demonstrated by the organization’s ability to activate the backup quickly, safely, and with clear authority.
If you want to test whether your fallback has an owner
CrisisOS5™ Cyber Crisis Tabletop Simulation
A structured simulation that stress-tests how Operations, Cybersecurity, Legal, Communications, and executive leadership behave when the technology still works but nobody’s sure who’s allowed to use it.
Ann Marie van den Hurk, MSc., APR is the founder of Mind The Gap Advisory and originator of the CrisisOS5™ Framework. She advises CISOs, General Counsel, Chief Risk Officers, and boards on decision authority and executive crisis readiness for the AI era. Based in Newport, Rhode Island — serving organizations across New England, nationally, and globally. mindthegapcyber.com