Deep Dive with WCAT: cybersecurity training across New Jersey
Three mornings, three counties, and a room full of water professionals learning how to approach their own cybersecurity self-assessments.
The CoStream team · Published: November 5, 2026
At the end of October, CoStream partnered with the New Jersey Water Association to host three half-day training sessions on the EPA Water Cybersecurity Assessment Tool, known as WCAT. Over three consecutive mornings, water and wastewater professionals gathered in Whippany, Hamilton, and Barnegat to learn the tool, see how it works, and leave with a clear next step for their own systems. Registration was free, and CoStream was glad to provide breakfast and lunch at every session. More than 40 operators, managers, and engineers from 25 systems took part across the three sessions
A practical place to start
WCAT is a free self-assessment tool from the EPA, built to help water and wastewater systems take stock of their cybersecurity practices. It walks a utility through a structured set of questions and turns the answers into a picture of where things stand today and where to focus next. For many systems, it is the most practical first step toward a cybersecurity program that grows with them.
That is what made these sessions worth hosting. A self-assessment is something a utility can own, revisit, and build on year after year. Our goal was to help each attendee feel confident completing one for their own system.
What the mornings covered
Each session followed the same agenda, designed to move from context to practical application in a single morning.
Orientation. The sessions opened with why cybersecurity matters for water systems, an overview of the regulatory landscape and the assessment options available to utilities, and an introduction to how WCAT is structured around the NIST Cybersecurity Framework.
Walking the functions. Next, attendees walked through the framework's core functions one at a time: Identify, Protect, Detect, Respond, and Recover. Each one was grounded in what it looks like inside a working plant.
Inside the assessment. The second half of the morning focused on the tool itself. Attendees saw how WCAT works, learned how to read its results, and worked through a knowledge check and open discussion before wrapping up with resources for continued improvement.
Credit for the time invested
Each session carried professional credit for the people who keep New Jersey's water systems running:
3.0 Training Contact Hours for NJ-licensed water and wastewater operators.
3.0 hours toward license renewal for NJ Certified Public Works Managers.
3.0 Continuing Professional Competency credits for NJ Professional Engineers.
Why this matters to us
At CoStream, we think of security as something built in from the start by design and carried through for the long run. Our team of technology, engineering, and cybersecurity experts spends every day on the systems that keep water flowing and sharing that knowledge with the wider water community is part of the work we care about most. Training like this helps utilities build a stronger foundation, whatever platform they run on.
Thank you
Our thanks go to the New Jersey Water Association for a great partnership, to the teams at each venue for hosting us, and most of all to every attendee who gave a morning to this work. The questions and conversations in the room were the best part of the week.
If you would like to talk through cybersecurity for your own system, or hear about future training opportunities, we would be glad to connect.
Comments