OT coalition urges CISA binding federal security directive

The Operational Technology Cybersecurity Coalition asked CISA to issue a binding directive setting baseline security rules for federal civilian operational technology.

On October 6, the Operational Technology Cybersecurity Coalition published a paper urging CISA to issue a binding operational directive on how federal civilian agencies secure operational technology. It wants a named OT security owner, use of existing NSA and CISA guidance, and minimum practices aligned with CISA's 2022 cybersecurity performance goals, including asset inventory, segmentation, remote access, configuration management, incident preparedness, and verified recovery; commentators said the proposal does not require patching or firmware updates. A September 30 GAO report found only 7 of 22 civilian agencies had fully inventoried networked OT and IoT by the September 2024 deadline set under 2023 OMB requirements. The paper cites water-utility cyberattacks—The Record reported hundreds of systems in at least 12 states with internet-exposed devices, default or blank passwords, and no segmentation, while CyberScoop referred only to this summer's attacks—and says CISA lacks full visibility into federal OT. Sources differ slightly on scale: two reports say OT supports more than 8,000 GSA-managed facilities or federal buildings, while CyberScoop said about 8,000 GSA properties, including programmable logic controllers. CISA has addressed OT in earlier binding operational directives but has issued no OT-only directive.

• On October 6, the Operational Technology Cybersecurity Coalition published a paper urging CISA to issue a binding operational directive for federal civilian operational technology.
• The proposal calls for a named OT security owner, use of existing NSA and CISA guidance, and minimum practices aligned with CISA's 2022 cybersecurity performance goals.
• The suggested baseline covers asset inventory, segmentation, remote access, configuration management, incident preparedness, and verified recovery; commentators said it does not require patching or firmware updates.
• A September 30 GAO report found only 7 of 22 civilian agencies had fully inventoried networked OT and IoT by the September 2024 deadline under 2023 OMB requirements.
• The paper cites water-utility attacks; The Record said hundreds of systems in at least 12 states had internet-exposed devices, default or blank passwords, and lacked segmentation, while CyberScoop referred only to this summer's attacks.
• Federal OT supports building systems such as HVAC, power, access control, water, and automation; two reports say more than 8,000 GSA-managed facilities or federal buildings, while CyberScoop said about 8,000 GSA properties, including…
• CISA has covered OT in earlier binding operational directives but has no OT-only directive.