Cyber Experts Urge CISA to Mandate Federal OT Cybersecurity Rules

Call for Mandatory OT Cybersecurity Standards

The Operational Technology Cybersecurity Coalition (OTCC) released a white paper advocating for the Cybersecurity and Infrastructure Security Agency (CISA) to implement mandatory federal rules for operational technology (OT). These rules would establish baseline cybersecurity standards for OT systems owned by federal agencies, which are crucial for monitoring and controlling critical infrastructure.

Recent Incidents Highlight Vulnerabilities

OTCC cited recent cyberattacks on hundreds of water systems across at least 12 U.S. states as a critical warning sign. These attacks exposed vulnerabilities in OT, such as internet-connected devices with default or no passwords, and a lack of network segmentation. Such incidents demonstrate that OT has become a target for nation-states and cybercriminals.

Federal Agencies Lag in OT Inventory

A government watchdog study found that only 7 of 22 civilian agencies reviewed had fully met White House requirements to inventory their networked operational technology and Internet of Things devices. These inventories were due in September 2024. This lack of visibility into OT assets within federal agencies, which include laboratories, hospitals, and research facilities, makes securing them challenging.

Need for Enforceable Baselines

Tatyana Bolton, executive director of OTCC, stated that current guidance has not closed the gap in OT security. A binding operational directive would provide every agency with a clear, enforceable baseline and give CISA the necessary visibility to ensure compliance. CISA has previously issued binding operational directives when voluntary measures proved ineffective, suggesting a precedent for this approach to drive consistent implementation and measure compliance across government.