OT Cybersecurity Coalition Advocates for Mandatory Regulations
The Operational Technology Cybersecurity Coalition (OTCC) has made a significant call to action, urging the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to implement mandatory security requirements for operational technology (OT) within federal civilian agencies. This request highlights growing concerns regarding the inadequacy of current cybersecurity measures, emphasizing the need for a structured and enforceable framework to bolster defenses against emerging threats.
In a report released on October 6, the OTCC proposed a binding operational directive (BOD), contending that there are currently no universal standards for federal OT practices. The coalition argues that CISA lacks sufficient visibility into the risks associated with operational technology, which is critical for various government functions. As operational technology manages systems such as HVAC, power, access control, and building automation across over 8,000 facilities operated by the General Services Administration—including laboratories, hospitals, and ports of entry—the urgency for enhanced security initiatives is palpable.
This push for stricter regulations aligns with findings from a recent Government Accountability Office (GAO) report published on September 30. The GAO disclosed that only seven out of 22 civilian agencies evaluated had complied with Office of Management and Budget (OMB) requirements regarding the inventory of their networked OT and Internet of Things devices. These inventories were mandated to be completed by September 2024, yet the OMB has not yet provided updated guidance for fiscal year 2026, further complicating compliance efforts for various agencies.
Proposed Directive
The OTCC’s proposed directive aims to set clearer expectations for improved cybersecurity protocols. It would necessitate that agencies appoint a senior official or dedicated office in charge of OT security, integrating OT risks into broader enterprise risk management strategies. Furthermore, the directive aims to establish minimum standards for key areas such as asset inventory, network segmentation, remote access management, configuration oversight, incident preparedness, and verified recovery protocols.
John Gallagher, a vice president at Viakoo, has raised crucial concerns regarding the proposal’s focus on inventory alone. He cautioned that merely cataloging devices does not equate to effective cybersecurity. "Without automated patch and configuration management, agencies will be inundated with backlogs that overwhelm operational teams,” he explained.
While the OTCC’s list of priority controls includes essential measures like changing default passwords, implementing multifactor authentication, segmenting networks, and creating backups, the report notably lacks directives for critical practices such as systematic patching or firmware updates. Gallagher emphasized the significance of these measures, noting that many cyber attackers exploit unmanaged default passwords and outdated firmware as easy entry points into organizations.
Containment Alongside Prevention
The coalition asserts that this proposed directive would complement CISA’s resilience initiative, known as CI Fortify. This initiative aims to prepare organizations to operate effectively even in the face of cyber compromises. By establishing a clear baseline, the directive would aim to prevent attacks from cascading into significant physical and operational consequences.
Louis Eichenbaum, federal CTO at ColorTokens, highlighted the importance of containment in this context. He argued that many industrial devices are not capable of being patched quickly without causing substantial disruptions to operations. "Patching remains essential, but we cannot simply patch our way out of cyber risk," Eichenbaum noted, advocating for strategic segmentation to limit an attacker’s lateral movement from a compromised system.
Although the proposed BOD would not impose requirements on private and local operators, its enactment would serve as an important indicator of best practices deemed necessary by the federal government. Eichenbaum stated, "While CISA’s binding directives apply specifically to certain Federal Civilian Executive Branch agencies, a strong federal OT baseline could forge influence that extends well beyond government."
He elaborated that such a directive would not only provide a practical model for critical infrastructure proprietors but also deliver clearer security expectations to vendors, ultimately incentivizing the procurement of secure-by-design products in government contracts. This would have widespread implications for enhancing cybersecurity measures throughout multiple sectors reliant on operational technology.
In sum, the OTCC’s recent advocacy for a binding operational directive is a crucial step forward in addressing the current shortcomings in OT cybersecurity. With operational technology playing an integral role in the daily functions of federal agencies, the establishment of mandatory security requirements is imperative for safeguarding sensitive infrastructure against ever-evolving cyber threats.