Skip to content
Vinod Jose

13 min· water· building

Years before the award

Two small posts on the same day: an Oklahoma City RFP for OT asset discovery, and Missouri Clean Water SRF awards to Springfield and Benton. Behind each one, the decision had been in public documents for years: board minutes, a council bill index, a construction permit. A different type of document each time.

On October 17, two small items came through my feed. A bid-support firm posted that the Oklahoma City Water Utilities Trust wants proposals for software to find and scan the equipment on its control network, RFP OCWUT-20-26, due November 18 at 4 PM. The same day, the Missouri Department of Natural Resources posted that its Clean Water State Revolving Fund had paid for wastewater upgrades in Benton, Fulton and Springfield.

I have already been through Fulton's file. I wanted to know what was behind the other three: Oklahoma City, Springfield and the city of Benton, a town of 866 in Scott County.

I believe a post like this is where a project becomes visible to most people. It is not where the project starts. For all three, the decision was in the public domain years before the post, and in two of them the contractor or the scope was settled months before. What changed my thinking is where each one was written down. None of the three was in the same type of document.

1. Oklahoma City: seven years of control systems in the board minutes

The bid-support firm described the Oklahoma City job as finding and scanning operational technology (OT) assets on an air-gapped SCADA network. I could confirm the title, the number and the dates on the city's own BidNet Direct page: published September 16, closing November 18. The contract runs three years with two three-year renewals, and it is locally funded. The documents sit behind a vendor login, so I have not confirmed the "air-gapped" detail.

The RFP matters on its own, and I come back to why below. The trail behind it matters too. The Trust's board minutes are public back to 2015, and they show a utility working through its control layer one step at a time:

  1. Consolidate (2019 to 2021). In July 2019 the Trust approved a scope to move the SCADA at three wastewater plants and a lift station "from their individual obsolete systems" to one enterprise system, estimated at $1.78 million. In September it approved another $2.81 million for hardware, software and installation, and a $1.75 million support scope. The implementation contract, $384,308, was awarded in May 2020 and accepted in February 2021.
  2. Plan (2022). In December 2022 the board heard a SCADA Master Plan. The presenter, then the Business Systems Manager, is now an Assistant Director.
  3. Extend (2023 to 2024). A $1.84 million SCADA instrumentation and control job at Tinker Air Force Base in 2023. A telemetry and SCADA RFP in January 2024 that was rejected in May and put out again, then awarded in October to two firms at an estimated $400,000 a year through 2029.
  4. Secure (2026). An EPA case study published in February says the Trust received over $55 million in Clean Water SRF assistance for work that included its SAP billing system, its call center phone system and its SCADA firewalls. Then, in September, the OT asset RFP.
Oklahoma City: seven years of OT in the minutes
Oklahoma City Water Utilities Trust board actions on SCADA, telemetry and OT security, 2019 to 2026.

This work matters more than its contract size suggests. In November 2023, attackers took over a controller at a booster station of the Municipal Water Authority of Aliquippa, Pennsylvania, and Check Point Research tied the group to Iran. In September 2024, Arkansas City, Kansas, switched its water treatment plant to manual operations after a cyber incident. A month later, American Water reported unauthorized activity in its computer networks and called in law enforcement. In July 2026, more than 30 Minnesota communities had their water and wastewater systems disrupted over two days. Braham's plant went offline, and the city asked residents to limit water use until it came back.

EPA's May 2024 enforcement alert names the actors behind attacks like these: groups tied to Iran's Revolutionary Guard, pro-Russia hacktivists and Chinese state-sponsored groups. It also says over 70% of the systems EPA inspected since September 2023 were in violation of basic Safe Drinking Water Act Section 1433 requirements. Its list of actions to take now includes "Conduct an inventory of OT/IT assets." That is the job Oklahoma City has put out to bid.

I believe the inventory is the right place to start. A utility cannot protect a controller it does not know is on the network. The order I see in the minutes is my reading. The rest is in the record.

I have seen utilities that still run on Windows 98, and those systems are exposed to exactly these attacks. Oklahoma City is not one of them, and the record shows why: someone wrote a plan in 2022 and the board has been paying for it in pieces since. If you sell anything that touches a control system there, the master plan was the document to read, about 46 months before the post (derived).

One more thing I didn't expect. Missouri's Clean Water SRF plan for 2026 gives ten priority points for security measures, and it names SCADA in that list. SRF money is mostly pipes and plants, but control systems qualify, and the scoring rewards them.

2. Springfield: Group 8 of a program that started in 2012

DNR announced $6.77 million for Springfield: a $3.35 million loan and a $3.4 million grant to reline sewers so the system handles peak flows with fewer overflows.

Springfield's wastewater belongs to the city, through its Environmental Services department, not to City Utilities, which runs the drinking water, power and gas. Once I had the city's records, the council's bill index told the whole story in its titles.

The project is Group 8 of the city's Sanitary Sewer Overflow Control Program. The program runs under a consent judgment with the state. Council approved a long-term Overflow Control Plan in December 2014 and a supplemental plan in 2021, and the 2024 funding resolution cites a second amended consent judgment. The rate ordinance passed in March 2026 lists "continued implementation of the Supplemental Overflow Control Plan" as one of the reasons for the new rates.

Here is the order in which Group 8 became public:

  1. February 2024. Council authorized an application for an SRF loan of up to $5.7 million, plus two state grants.
  2. October 2025. The state's adopted plan for 2026 listed the project at $5.7 million.
  3. April to June 2026. The city took bids for about 99,000 feet of sewer main, 8 to 42 inches, cleaned, televised and relined with cured-in-place pipe (CIPP).
  4. July 13, 2026. Council accepted the bid of Insituform Technologies at $6,225,659.13 and appropriated $7.47 million from the sewer fund's reserves for the project.
  5. October 14, 2026. DNR announced the award.

So the contractor was chosen three months before the announcement, and the money was requested 32 months before it (derived). The budget adjustment drew on reserves, which tells me the city did not wait for the state loan before committing. That is my reading of the ordinance title, not something the city has said.

Springfield: one sewer program, fourteen contracts
Construction contracts in Springfield's Sanitary Sewer Overflow Control Program, by date of final passage.

The pattern across the program is the part I would want to know if I sold into it. The bill index lists fourteen construction contracts since 2012. Every contract with "cured-in-place pipe" in its title went to the same firm, five of five. The open-cut repair contracts went to one contractor five times in a row, until Group 9 went to a different firm in July 2026. The twelve contracts with an amount in the title add up to about $72 million (derived).

I grant that relationships and track record explain a lot of this. A contractor who has relined four groups of a city's sewers knows the city, and that counts for something on a low-bid job. But the sequence itself is public. Group 9 open cut was let the same night as Group 8 CIPP. If the pattern holds, a Group 9 CIPP bid comes next. That is my inference, and I have not seen it scheduled.

Two days before DNR's announcement, on October 12, council accepted a separate $4.26 million emerging-contaminants grant for a foam fractionation project at the Northwest treatment plant. The state plan lists it as a PFAS project.

3. Benton: a lagoon, one operator, and three years out of compliance

Benton is a small town with a city clerk, one water and sewer operator listed on its website, and a lagoon treatment plant. DNR's award was $4.38 million: a $2.88 million loan and a $1.5 million grant. That is about $5,060 per resident (derived).

The reason for the money is in EPA's discharge data. The plant has been in significant noncompliance in every quarter from July 2023 to June 2026. Ammonia was over its monthly limit in 23 of 39 months. In February 2026 the plant reported 15.7 milligrams per liter against a limit of 3.1. ECHO lists no formal enforcement action.

Benton: ammonia over the limit
Monthly average ammonia at Benton's outfall against its seasonal limit, July 2023 to September 2026.

The fix was written down long before the money. DNR's environmental review cites a preliminary engineering report dated June 30, 2022, with addenda in September 2023 and October 2024. The project was in the state's 2026 plan in October 2025, at $5.2 million. DNR issued a categorical exclusion on March 2, 2026, and a construction permit on May 20.

The permit is the most useful document of the lot. It lists the scope line by line: CIPP lining and point repairs in the collection system, manhole work, a new influent flow meter, aeration and baffles to turn Lagoon Cell 1 into a two-stage cell, new piping to the plant's moving bed biofilm reactor and UV system, and taking Lagoon Cells 2 and 3 out of the treatment train. The plans came from the city's engineering firm in February 2026. By then the equipment choices were made.

For a town this size, the engineer's plans are where the buying happens. A vendor who read the permit in May could see exactly what Benton needed. A vendor who waited for the October post was reading about a project due to finish in March 2027.

What the three have in common

Three records, read on the day of the post
Dated public documents behind the Oklahoma City, Springfield and Benton projects, set against the October 17 posts.

First, the need was public for years, and in a different place each time. Oklahoma City wrote it in a master plan presented to its board. Springfield wrote it in a consent judgment and a numbered program. Benton wrote it in an engineering report and, less willingly, in its discharge reports. If you read only one type of document, you would have found one of the three.

Second, the last decision came well before the post. The OT RFP was out a month before the post. Springfield's contract was signed three months before. Benton's scope was fixed in a permit five months before.

Third, the posts are accurate and they are late. Nothing in either post was wrong. A press release reports an award, and a bid-support firm reports an RFP after it is open. Both are doing their job.

How far ahead the record was
Months between a dated public document and the October 17 posts, for each utility (derived).

If you work at a utility

Springfield's bill index is the clearest record of the three. Each title names the program, the group, the method, the winning bidder and the amount. A reader can rebuild fourteen years of a consent-judgment program from titles alone. If your council or board writes titles like "approve contract" with the detail in an attachment, consider writing them the way Springfield does.

If you sell to utilities

  1. Find the program, not the project. Springfield's Group 8 is one entry in a numbered series. The next entry is easier to see than the last one.
  2. In small towns, read the construction permit. Benton's lists the scope line by line and names the engineering firm.
  3. For control systems, look for the master plan in the board minutes, then follow the line items that come after it.

That is why we built AquaIntel around public documents: the record before the post.

What I don't know yet

  • Which Clean Water SRF loan paid for Oklahoma City's billing, phone and SCADA firewall work. EPA's case study says "over $55 million." The two Trust loans I checked from 2023 and 2026 describe plant and sewer work instead.
  • Whether Benton has a construction contract. Its permit requires bids to be advertised for at least 30 days, and I have not found the notice or the award.
  • Whether Springfield's Group 9 CIPP bid is scheduled.
  • Whether the "air-gapped" network in the Oklahoma City RFP is the Trust's description or the bid-support firm's.

The next marker is November 18, when Oklahoma City's proposals are due.

Sources

I write about US water utility buying signals every two weeks. Subscribe free on Substack.