Case Study: East Rio Hondo Water Supply Corporation Strengthens Cyber Readiness through CRI Water Utility Program

A rural Texas water utility through practical cybersecurity training and leadership improved cyber readiness and resilience with support from a CRI-certified Cyber Coach.

Overview

The East Rio Hondo Water Supply Corporation (ERHWSC), a mid-sized rural water utility in southern Texas, completed Phase One of the Cyber Readiness Institute’s (CRI) Water Utility Pilot Project, sponsored by Microsoft. Under the leadership of Amanda Sanchez, Administrative Services Manager and appointed cyber leader, ERHWSC transformed its approach to cybersecurity—empowering staff, enhancing readiness, and cultivating a proactive cyber-aware culture.

This case study outlines ERHWSC’s journey through the pilot program, the challenges it faced, and the impact the initiative had on the organization and the broader community it serves.

About East Rio Hondo Water Supply Corporation

Established in 1974, ERHWSC provides safe and reliable drinking water to approximately 9,300 active customers across a 409-square-mile service area in Cameron County, Texas. Located roughly 15 miles north of Brownsville, ERHWSC primarily serves the rural outskirts of Texas cities including Harlingen, Brownsville, Rancho Viejo, and Combes. Although nearby municipalities have their own utilities, ERHWSC fills a critical infrastructure gap by delivering water to the surrounding unincorporated and underserved rural areas.

With a staff of 45 employees, the utility plays a vital role in the region’s public health and quality of life, maintaining a strong community-oriented approach to water service management.

The Need for Cybersecurity in the Water Sector

Like many water utilities across the U.S., ERHWSC faces the growing threat of cyberattacks targeting critical infrastructure. Amanda Sanchez noted the increasing frequency of cybersecurity incidents reported in the news and emphasized the importance of preparation, particularly for small to mid-sized organizations.

“Cyber threats can affect our SCADA systems, which would directly impact our customers,” said Sanchez. “Staff awareness and prevention are essential.”

Although ERHWSC already had basic cybersecurity protocols, including simulated phishing email tests through an IT consultant, the team lacked a unified framework for cybersecurity education and incident response planning. That changed with the Cyber Readiness Institute’s program.

Leadership Through the CRI Pilot Program

Amanda Sanchez served as the designated cyber leader for ERHWSC throughout Phase One of the pilot project. With a background in administrative services, human resources, and customer service—not cybersecurity—Sanchez was initially unsure of her qualifications to lead a cyber-focused initiative. However, the structure of the program, particularly the simplicity and accessibility of the CRI materials, proved instrumental.

“I’m not a cyber expert by any means,” Sanchez admitted. “But the booklet was easy to understand, and the support from my CRI-certified Cyber Coach made a huge difference.”

Sanchez emphasized that the ability to share cyber readiness insights with her entire staff—through presentations, free resources, and direct conversations—was the most valuable part of the experience.

Creating a Cyber-Aware Culture

Sanchez led internal training for all employees, walking them through CRI materials and emphasizing simple but effective practices: creating strong passwords, recognizing phishing emails, securing business data, and ensuring software updates are current.

The impact was immediate and noticeable. Several employees expressed surprise upon learning about common cybersecurity vulnerabilities, such as password reuse across platforms. Others were astonished by the statistics and real-world examples provided during the sessions.

“Five to ten employees came up to me afterward and told me they hadn’t realized how exposed they were,” Sanchez recalled. “They learned not only how to protect the company but also how to protect themselves at home.”

The success of these efforts became apparent through a reduction in internal reports of suspicious emails. Thanks to the CRI training, employees identified and handled phishing attempts more effectively and independently. “I was getting fewer questions because they knew what to look for,” she added.

Empowering the Cyber Leader

Throughout the program, Sanchez was supported by a CRI-certified Cyber Coach, who answered questions and guided her through the cyber readiness booklet.

“Her help was invaluable,” said Sanchez. “With her support, I better understand our vulnerabilities and how to prepare for different scenarios. I’d say I went from 30% readiness to 90%.”

That new confidence translated into better organizational preparedness. Employees began seeking Sanchez’s input on cyber concerns.

Building a Response Capability

The CRI program didn’t just help ERHWSC avoid attacks—it improved its ability to respond to them. “Before, I wasn’t entirely sure what to do if something happened,” Sanchez said. “Now, I feel confident we could respond quickly and correctly.”

This enhanced readiness aligns with one of CRI’s core goals: shifting from reactive behavior to a proactive, resilient cybersecurity culture.

Advice to Other Water Utilities

When asked what she would say to other utilities considering the CRI program, Sanchez didn’t hesitate.

“It’s absolutely worth the investment of time,” she said. “The coach was flexible and understood my schedule. The program isn’t about turning you into a cybersecurity expert. It’s about giving you and your staff the tools to recognize and prevent threats before they become incidents.”

Sanchez stressed that even mid-sized or small utilities with limited resources could benefit greatly from the program. Cybersecurity, she said, should be a priority for all critical infrastructure providers.

“You see these stories on the news all the time. Something simple—like clicking a bad link—can lead to huge consequences. If your staff can help prevent that, it’s time well spent.”

Looking Ahead

As ERHWSC continues to grow and serve more rural communities, it does so with a stronger cyber foundation thanks to its participation in the Cyber Readiness Institute’s pilot program. Amanda Sanchez’s leadership, combined with CRI’s practical approach and Microsoft’s sponsorship, has equipped the utility to face the evolving digital threat landscape with resilience and confidence.

With a proactive mindset and a cyber-aware culture in place, ERHWSC is now better prepared to continue its essential mission: delivering clean, reliable water to the people of Cameron County—securely.

CRI, Foundation for Defense of Democracies (FDD), and Microsoft launched a phased pilot to implement the Cyber Readiness Program across small and medium-sized water and wastewater utilities nationwide in 2023. The pilot provides utilities with a free CRI Certified Cyber Coach uniquely trained to guide participants through the Cyber Readiness Program and successfully foster a ‘Cyber Ready’ culture. In December of 2024, Phase 2 of the pilot program was launched.

For more information about the Cyber Readiness Program and how your organization can participate in Phase 2, visit the Cyber Readiness Institute.