The answer, up front
Water and wastewater utilities are being urged to build post-quantum roadmaps, but the sector has thin, mostly adjacent guidance to work from. One source is water-specific but US-only with unconfirmed metadata, and the others cover critical-infrastructure operational technology in general. The practical message is consistent across them: utilities run long-lived operational systems whose cryptography will one day be breakable, so they should start a transition plan aligned to NIST standards now, even without sector-specific rules.
The Senate testimony
Written testimony prepared for a US Senate Environment and Public Works hearing on the cybersecurity state of the water sector says advances in quantum computing will make conventional asymmetric cryptography unsafe, and it urges utilities to build a post-quantum transition plan and roadmap aligned to NIST standards and to accelerate compliance with zero-trust and post-quantum expectations 1. It lists sector weaknesses including tens of thousands of fragmented systems, internet-exposed operational interfaces and legacy operational technology with tight patch windows 1. The document gives no author or date in its text; both were inferred from the file name, so confirm them before citing.
The critical-infrastructure read
The UK's Bloomsbury Intelligence and Security Institute names water-treatment plants among exposed systems in its March 2026 report, arguing that post-quantum deployment is hard on resource-constrained legacy systems with long lifespans, and that quantum attacks on critical infrastructure look unlikely before 2030 but highly likely over the long term without proactive migration 2. That report addresses critical infrastructure broadly rather than water specifically, so it supports the picture rather than providing sector guidance.
The OT reality
Trade coverage of the DHS and CISA operational-technology guidance supplies the operating reality. Water appears among OT-reliant sectors, and the guidance points to slow patch cycles, decades-old equipment, unsupported operating systems and strong network segmentation as an effective way to narrow what must migrate first 3. That coverage summarizes a government document the reporting did not read directly, so it is a secondary account.
What this means for water utilities
With little tailored guidance, the defensible path is the general one applied to safety-critical service: inventory where public-key cryptography protects control, monitoring and billing systems, segment networks to narrow the first wave of migration, prioritize internet-exposed interfaces, and write crypto agility into new equipment so a future change does not require replacing hardware across many small sites.
How ArcQubit approaches it
ArcQubit treats discovery as the first move for a sector with fragmented systems and thin guidance. QuCode builds the cryptographic inventory across water OT and IT, and QuTrust holds the prioritized plan so segmentation and phased upgrades proceed in a defensible order a regulator or board can follow.