CISA Urged to Elevate Standards in Industrial Cybersecurity
A coalition encompassing operational technology (OT) equipment manufacturers, cybersecurity vendors, and other associated companies has made a resolute call for the U.S. federal government to instate mandatory security protocols for operational technology within its agencies. This collective assertion, reported this week, emphasizes a pressing need for enhanced cybersecurity measures, reflecting the urgent nature of potential threats faced in this vital sector.
Michael Garcia, the policy director for the Operational Technology Cybersecurity Coalition (OTCC), articulated that should the Cybersecurity and Infrastructure Security Agency (CISA) take such action, it would be aligning itself with precedent established by the National Security Agency (NSA) in 2024. The NSA had initiated comparable security measures aimed at safeguarding military industrial equipment. "If the NSA perceives a threat to the OT environment that they operate within, such threats certainly exist in the civilian domain as well," Garcia stated during an interview with Information Security Media Group (ISMG).
Current directives from the National Institute of Standards and Technology (NIST) and other authorities advocate for essential practices, including asset visibility and ongoing monitoring for OT devices. However, a recent audit conducted by the Government Accountability Office (GAO) revealed concerning deficiencies among federal agencies. Out of the 22 cabinet-level departments surveyed, less than half complied with requirements set by the Office of Management and Budget (OMB) for cataloging and monitoring their interconnected Internet of Things (IoT) and operational technology devices.
The GAO audit disclosed that 15 of the agencies had initiated the creation of inventories, while only 11 were diligent in updating and maintaining these records. Alarmingly, just 10 agencies contained all requisite details, such as device descriptions and software version information. Overall, only seven agencies were found to be fully compliant. Lacking proper inventories, these federal bodies struggle to identify the types and numbers of connected devices within their systems, consequently leaving them vulnerable to cyberattacks. The GAO report remarked on the potential risks posed to sensitive data and systems due to inadequate security measures.
Garcia criticized the efficacy of the OMB memo, suggesting it has been ineffective despite its renewal and enhancement overseen by the Trump administration in 2025. He strongly advocated that CISA should implement a binding operational directive (BOD), a mandatory enforcement mechanism aimed at ensuring accountability within federal departments and agencies. While acknowledging that such a directive would only apply to federal agencies, he argued that it would establish a security baseline that could influence external entities as well.
"The response from the private sector would be significant once CISA issues a BOD," he noted. "It signals to the market that the federal government recognizes these steps as crucial for improving operational technology security." This creates a ripple effect that encourages private organizations to align their security measures with federal standards.
Support for the OTCC’s initiative extends beyond Garcia, with former officials echoing the need for immediate action. They view the coalition’s call to action and its accompanying report—published recently—as a critical first step. Nicholas Leiserson, a former Capitol Hill staff member for cybersecurity, emphasized the importance of integrating IT governance concepts into the realm of cyber-physical systems (CPS), which encompass OT and IoT devices physically interacting with the real world.
Despite the foundational role OT systems play in safeguarding lives and ensuring public safety, Leiserson remarked on the woeful lack of accountability regarding their cybersecurity. He asserted that a binding operational directive could be pivotal in rectifying this inadequacy but cautioned that it must be supported by enforceable consequences.
Leiserson, who now presides over the Center for Advancing Cybersecurity at the Institute for Security and Technology, also noted the inherent complexities of applying IT security measures to CPS. The fundamental differences between these systems necessitate careful consideration and adaptation, as simplistic mappings of control sets may prove ineffective.
Garcia indicated that the OTCC had been in constructive dialogue with CISA for an extended period concerning these security matters, perceiving the agency as responsive to their recommendations. "We have previously expressed our support for this initiative," he said, reflecting hopefulness for continued collaboration. The coalition’s engagement with CISA prior to the publication of their report was met with a positive response, fostering optimism for productive future interactions.
As the push for fostering robust cybersecurity measures in operational technology environments gains momentum, both the public and private sectors stand poised to benefit from enhanced protective frameworks, safeguarding crucial services that underpin daily life and safety. The coalition’s proactive stance illustrates an urgent collective consciousness regarding the critical need for vigilant cybersecurity in an increasingly interconnected world.