So was it a government (state or federal) water treatment plant? If so, I can tell you how it happened. The government contracting agencies have boilerplate text they're supposed to add to contracts to make sure salient requirements get flowed. They're supposed to delete or tailor anything that doesn't make sense, but the contracts people aren't usually very technical. We had requirements flowed to us about password management and account monitoring, but no one logs into a rocket engine or a torpedo. When we'd point it out, they'd say "oops, we should have deleted that."