RAPIDS: Resilient & Adaptive Cyber Protection of Industrial Control Devices & Systems
Securing the systems that manage the Colorado River.
The Colorado is managed by industrial control systems that were never built to withstand today’s cyber threats. RAPIDS is building the standards, the technology, and the coalition to secure them, and a repeatable model to protect critical infrastructure nationwide.
Secure the systems in place / Design the next generation securely / Operate and defend over time
.jpeg)
The Stakes.
Nearly 40 million Americans and about a quarter of the U.S. economy depend on a single river.
~40M
Americans served by the Colorado.
~25%
of U.S. economic activity enabled.
5M acres
of irrigated agriculture.
2–4M
acre-foot annual deficit.
Climate change is rapidly depleting the river’s flow, which makes precise, coordinated, data-driven management more critical than ever. Yet much of the Colorado’s infrastructure is still operated manually, because the control systems that could automate it aren’t secure. That approach is inefficient, wastes a national asset, and depends on a specialized workforce that is retiring.
The threat is not hypothetical. Stuxnet proved that industrial control systems can be sabotaged by code. The Colonial Pipeline attack showed how quickly an attack on operational infrastructure disrupts daily life. Securing water systems is named as a priority in the U.S. National Cybersecurity Strategy, and the World Economic Forum ranks cyberattacks on critical infrastructure among the top global risks.
Our adversaries already know that a quarter of our economy flows through one river. Protecting it has to start with being able to measure and manage it securely.
The Mission.
Build a rapid, repeatable model for securing the industrial control systems behind critical infrastructure, starting with the Colorado.
RAPIDS is organized around three practice areas that move the river from manual, vulnerable operation to secure, data-driven management.
Secure the systems in place.
Design the next generation securely.
Operate and defend over time.
Harden the IoT, OT, and ICS already deployed along the river so operators can bring them safely online.
Build a reference architecture and framework so future control systems are secure by design, not patched after the fact.
Stand up a cyber services center to manage and continuously secure deployed systems. It is the ongoing backbone of the program.
The Approach.
We start with Minimum Viable Measurement (MVM): the smallest set of secure, verifiable measurements stakeholders can actually trust.
You can’t protect what you can’t securely measure. MVM gives the program a concrete, auditable foundation before scaling to full automation.
Define the standard.
Develop MVM standards for secure water measurement: the cybersecurity protocols, data-integrity frameworks, and critical-infrastructure safeguards the river corridor needs.
Assess maturity.
Evaluate current systems against the MVM framework to see where measurement can and can’t be trusted today.
Identify the gaps.
Prioritize the capability gaps in secure measurement that put the most at risk.
Build the capacity.
Close those gaps through partners, technology, and a workforce trained to sustain secure measurement over time.
Why Grand Junction?
Colorado Mesa University.
Grand Junction sits at the confluence of the Colorado and the Gunnison, and roughly 68% of the river’s volume passes through here.
~11,000 students and ~1,200 graduates a year, the talent engine for a new critical-infrastructure security workforce.
Federal presence.
The region pairs that geographic position with the raw materials to act on it: a research university, a skilled-trades pipeline, and a dense cluster of federal land and water agencies. Once a hub for the nation’s nuclear programs, Grand Junction is built for exactly this kind of mission, from mineral to machine, from dirt to data.
Bureau of Reclamation, BLM Western headquarters, Department of Energy, and more: the agencies that manage the river and its lands.
A regional coalition.
Local government, economic-development organizations, industry, and subject-matter experts already aligned around the mission.
The Impact.
Securing the river creates a model, and an economy, that scales far beyond it.
More water, managed better.
Secure automation lets operators manage flow precisely, delivering more water downstream from a stressed resource.
A new secure-services economy.
Supporting the ~300 water districts along the Colorado first, with a path toward the tens of thousands of municipal districts nationwide.
Data and AI at national scale.
Large-scale, secure sensing enables real-time insight, predictive analysis, and anomaly detection across water quality and volume.
A blueprint for all critical infrastructure.
What works for water becomes a roadmap for securing energy, waste, and other ICS and SCADA systems across the country.
Closing the cyber skills gap.
University and tech-sector partnerships build and sustain the next generation of ICS security practitioners.
The Consortium.
No single institution can secure a river that crosses seven states. RAPIDS is built as a coalition.
The program brings together academia, cybersecurity expertise, technology providers, water operators, and public agencies under a shared standard and a shared goal.
HOST, COORDINATION & ADVISORY
COLORADO MESA UNIVERSITY
Host Institution & Grant Holder, CMU Water Centre
GRAND JUNCTION ECONOMIC PARTNERSHIP
Regional Coordination & Economic Development
PING THEORY LLC
Program Vision & Cybersecurity Advisory
PUBLIC & REGIONAL PARTNERS
COLORADO RIVER DISTRICT
Water Partner
CITY OF GRAND JUNCTION
City Partner
MESA COUNTY
County Partner
COLORADO OEDIT
State Partner
Join the RAPIDS
consortium
-
Technology and measurement providers in water, sensing, ICS/OT, or critical-infrastructure security.
We’re actively recruiting partners who can help define the standard, build the technology, or sustain the capability.
-
Water utilities, districts, and public agencies along the Colorado River corridor.
-
Academic and workforce-development partners.
-
Funders and sponsors backing critical-infrastructure resilience.
Kurtis Minder
Technologist, negotiator and author, now working on securing OT devices on the Colorado River.
Kurtis has worked in technology since the early ’90s, across systems administration, network design and security architecture, including time at AT&T. He co-founded and led GroupSense, a digital risk protection and cyber threat intelligence company, until a successful exit in 2025, and wrote Cyber Recon (Wiley).
Policy Alignment
RAPIDS is designed to advance national priorities for critical-infrastructure security, including the U.S. National Cybersecurity Strategy’s focus on securing critical infrastructure, the prioritization of water security in federal critical-infrastructure policy, and Executive Order 14017 on resilient supply chains.