Loading story…
The Operational Technology Cybersecurity Coalition urged the Cybersecurity and Infrastructure Security Agency (CISA) to issue a binding operational directive establishing minimum security requirements for operational technology (OT) owned by federal civilian agencies. The proposal addresses incomplete asset visibility, inconsistent security practices and accountability gaps between IT and facilities teams. A Government Accountability Office review found that only seven of 22 civilian agencies fully met requirements to inventory networked OT and Internet of Things devices. Recent attacks on hundreds of water systems across at least 12 U.S. states provided context, but the coalition did not claim its proposed directive would have prevented those incidents. CISA declined to comment, and the references do not report that a directive has been issued.
The recommended baseline includes asset inventories, network segmentation, stronger remote-access controls, secure configurations, incident preparedness, and verified backup and recovery. The coalition also called for a senior official or unified office accountable for OT security, integration with enterprise risk management, and alignment with existing federal guidance and CISA cybersecurity performance goals. The proposal does not explicitly require patching or firmware updates; industry commentators emphasized automated remediation and containment where patching could disrupt industrial operations. A directive could complement CISA’s CI Fortify resilience initiative and influence private critical-infrastructure security practices, but would not bind private operators.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
OTCC released a white paper urging CISA to issue an OT-specific binding operational directive for federal civilian agencies. It proposed accountable leadership and minimum controls for asset visibility, segmentation, remote access, configurations, incident preparedness, and verified backup and recovery.
GAO published a report finding that only seven of 22 reviewed civilian agencies fully met OMB requirements to inventory networked OT and IoT devices. GAO also reported that OMB had not issued updated inventory guidance for fiscal year 2026.
The incoming Trump administration renewed and refreshed the existing OMB memorandum on connected IoT and OT device requirements in 2025, according to OTCC policy director Michael Garcia.
The Office of Management and Budget issued requirements covering networked Internet of Things and operational technology devices, including agency device inventories. These requirements subsequently became the basis for GAO's review of federal agency compliance.
CISA first issued its cybersecurity performance goals in 2022. OTCC later recommended aligning a federal operational technology directive with these goals.
CISA declined to comment on the coalition's proposed federal OT cybersecurity directive.
OTCC cited attacks on hundreds of U.S. water systems as evidence of threats to operational technology. Many affected devices were unnecessarily internet-connected, used default passwords or no passwords, and lacked network segmentation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourceinfosecurity-magazine.com
Open sourcetherecord.media
Open sourcecyberscoop.com
Open sourceotcybercoalition.org
Open sourceotcybercoalition.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA, the UK **NCSC**, and multiple international partners released **Secure Connectivity Principles for Operational Technology (OT)** guidance aimed at reducing risk created by increased connectivity into industrial environments (e.g., industrial control systems, sensors, and other critical services). The guidance is positioned for operators of essential services facing business and regulatory pressure to enable remote monitoring and management, and it emphasizes that formerly *air-gapped* OT is now more exposed due to expanded remote access and IT/OT convergence. The guidance highlights that insecure or exposed OT connectivity is being targeted by a broad range of adversaries, including **ransomware groups**, **state-backed actors**, and **pro-Russia hacktivists** conducting opportunistic attacks against global critical infrastructure. Recommended defensive themes include **network segmentation**, **strong authentication**, continuous monitoring, and minimizing remote access paths to prevent disruptive incidents with potential real-world safety and service-delivery impacts; CISA also solicited stakeholder feedback via a product survey. Separate opinion pieces discussing AI in critical infrastructure and power redundancy risks in OT, and an industry roundup of Chinese cybersecurity companies, do not provide additional reporting on this specific guidance release.
Jun 29, 2026
Global cybersecurity agencies have issued a joint call for critical infrastructure operators to conduct comprehensive mapping of their operational technology (OT) environments. The guidance, supported by the United Kingdom's National Cyber Security Centre, the U.S. Cybersecurity and Infrastructure Security Agency, and other allied partners, emphasizes the urgent need for exhaustive OT inventories to combat evolving cyber-physical threats. Operators of essential services such as power grids, water systems, and manufacturing plants are being instructed to catalogue all assets by their criticality, ensuring that every component of their OT environment is accounted for. The framework outlined by these agencies includes documenting system connectivity, validating and maintaining records through structured change management, and rigorously managing third-party access and contractual risks. Security experts highlight that while creating a definitive record of OT assets is both feasible and necessary, it presents significant challenges, particularly for organizations with sprawling, decades-old networks. Legacy systems often lack the real-time visibility required for effective inventory, making the process complex and resource-intensive. Despite these obstacles, the increasing sophistication of cyber-physical threats means that organizations can no longer afford to operate with blind spots in their OT environments. The guidance stresses the importance of asset visibility as a foundational element of OT security, enabling organizations to identify vulnerabilities and respond more effectively to incidents. Agencies recommend that operators implement structured change management processes to ensure that asset records remain accurate and up to date. The guidance also calls for robust management of third-party access, recognizing that supply chain and contractor relationships can introduce additional risks. By following the principles-based framework, critical infrastructure operators can reduce the likelihood of undetected vulnerabilities and improve their overall security posture. The agencies warn that failure to maintain comprehensive OT inventories could leave organizations exposed to major cyber incidents. The call to action reflects a growing consensus among global cyber authorities that asset management is a critical defense against increasingly complex threats targeting industrial control systems. The guidance is intended to drive a cultural shift in how OT operators approach security, moving from reactive measures to proactive risk management. Experts agree that while the task is daunting, the benefits of improved visibility and control far outweigh the challenges. The initiative underscores the need for ongoing collaboration between government agencies, industry stakeholders, and security professionals to protect critical infrastructure from cyber threats. Ultimately, the guidance aims to ensure that operators are not caught off guard by attacks that exploit unknown or unmanaged assets within their OT environments.
Jun 29, 2026
U.S. **operational technology (OT)** security specialists urged **NIST** to make its forthcoming update to *Special Publication 800-82* significantly more practical and granular, arguing that OT owners and operators need actionable guidance rather than high-level frameworks. The feedback was provided as NIST begins its **fourth revision** of SP 800-82 and solicits private-sector input, reflecting growing maturity and urgency in OT cybersecurity governance. Vendors and practitioners emphasized that OT environments require different approaches than conventional IT, particularly for **vulnerability management**, where standard IT practices may be ineffective or counterproductive in industrial settings. Commenters also called for more **sector-specific guidance** for emerging OT verticals such as **smart building management** and **distributed energy systems** (including **EV charging networks**), and broadly supported NIST’s proposal to move several SP 800-82 appendices online—covering OT security organizations, tools and threats, and catalogs of vulnerabilities and incidents—to keep reference material more current.
Jun 29, 2026