Dwr Cymru has been criticised for failures dating back almost a decade which led to 231 people falling ill.
70,000 homes in Gwynedd and Anglesey were hit by bug outbreak
Welsh Water has already been fined £60,000 for the outbreak of the cryptosporidium bug in November 2005.
The Drinking Water Inspectorate said the company should have acted faster when the outbreak was first detected.
Dwr Cymru has now installed extra treatment equipment at the Llyn Cwellyn reservoir at Rhyd-ddu in Snowdonia.
The outbreak focused on the reservoir which serves 70,000 homes in parts of Gwynedd and Anglesey.
However, while health officials were confident the reservoir was the most likely candidate, tests at the lake always proved negative.
The assessment letter by the Drinking Water Inspectorate (DWI), published on Tuesday, said Welsh Water did not understand advice issued in 1998 to all water utilities by an expert group on cryptosporidium in water supplies.
It also criticised the company's monitoring procedures in place at the reservoir at the time.
The report concluded that Dwr Cymru should have classified the lake as at high risk of contamination, but failed to spot the warning signs that something was wrong.
DWI Inspector Elinor Cordiner wrote in the report: "I am very critical of the company for not recognising the need for its original risk assessment to be reviewed at regular intervals in accordance with guidance."
She criticised Dwr Cymru for delaying "investigative actions" after the outbreak, but said she was satisfied that when they were carried out they were appropriate and had assisted the local health protection team.
Ms Cordiner said publicising advice to boil water to some, but not all customers, had "resulted in conflicting and confusing messages to consumers".
But Ms Cordiner commended the company for quickly installing additional water treatment at Llyn Cwellyn.
She said: "This provided a robust intervention with a far higher degree of reliability and reassurance than the short term measure of issuing boil water advice."
A spokesman for the company said: "We can confirm that we have received a letter from the Drinking Water Inspectorate and are currently considering its content.
"We will be responding to the DWI shortly."
Last month Dwr Cymru was fined £60,000 and ordered to pay £69,000 in costs after pleading guilty at Caernarfon Magistrates to supplying water unfit for human consumption.
The company accepted it should have started monitoring for the stomach bug much sooner than it did, the court was told.