OT Coalition Urges CISA to Mandate Federal OT Security

The Operational Technology Cybersecurity Coalition (OTCC) has urged the Cybersecurity and Infrastructure Security Agency (CISA) to establish mandatory security requirements for operational technology across federal civilian agencies. The coalition called for a binding operational directive (BOD), asserting that existing directives do not establish minimum practices and that CISA lacks sufficient visibility into associated risks. This request stems from findings by the Government Accountability Office (GAO), which indicated that only a small fraction of civilian agencies had fully met Office of Management and Budget (OMB) requirements for inventorying networked OT and Internet of Things devices.
The proposed directive would require federal agencies to designate an official responsible for OT security and incorporate OT risk into enterprise risk management. It aims to establish a baseline covering asset inventory, network segmentation, remote access controls, configuration management, incident preparedness, and recovery verification. While the coalition prioritizes measures like changing default passwords, multifactor authentication, segmentation, and backups, they noted that remediation steps, such as automated patching or firmware updates, were not included in their immediate call for a directive.
Furthermore, the proposal seeks to complement CISA's CI Fortify resilience initiative by establishing a pre-incident baseline intended to prevent security compromises from cascading into physical consequences. Experts argue that segmentation is crucial because many industrial devices cannot be patched without operational disruption, suggesting containment measures must precede full remediation. The coalition also posits that a strong federal OT baseline would influence critical infrastructure owners, vendors, and procurement policies beyond the scope of direct federal mandates.

* The Operational Technology Cybersecurity Coalition (OTCC) urged the US Cybersecurity and Infrastructure Security Agency (CISA) to set mandatory security requirements for operational technology (OT) across federal civilian agencies.
* The coalition called for a binding operational directive (BOD), arguing that no existing directive sets minimum practices for federal OT.
* Agencies rely on OT in over 8000 General Services Administration-managed facilities, including laboratories, hospitals, and ports of entry.
* A Government Accountability Office (GAO) report found that only seven of 22 civilian agencies reviewed had fully met Office of Management and Budget (OMB) requirements to inventory their networked OT and Internet of Things devices.
* These inventories were due by September 2024, and OMB had not issued updated guidance for fiscal year 2026, according to the GAO.
* The proposed directive would require agencies to designate a senior official or office responsible for OT security and incorporate OT risk into enterprise risk management.
* Requirements would include baseline standards for asset inventory, network segmentation, remote access, configuration management, incident preparedness, and verified recovery.
* Priority controls mentioned by the coalition include changing default passwords, multifactor authentication (MFA), segmentation, and backups.
* The coalition did not call for patching or firmware updates as a primary requirement in the directive proposal.
* Containment strategies, such as segmentation, are proposed to limit attacker movement from compromised controllers.

The narrative presents a tension between regulatory oversight and operational reality within critical infrastructure. The core dynamic involves an appeal for centralized, mandatory standards (a BOD) versus the technical constraints of physical systems that prioritize availability over immediate security patching. The failure to achieve baseline inventory suggests a significant gap between mandated requirements (OMB) and practical implementation, leading to the OTCC's push for a directive that addresses oversight alongside specific controls.
The framing strategically places the need for foundational risk management (inventory, segmentation) ahead of high-friction remediation tasks (patching). This structure positions containment—segmentation—as a necessary prerequisite for addressing the downstream consequences of attacks on physical systems, which aligns with the broader theme of resilience. The suggestion that a federal baseline extends influence beyond government agencies to private operators and vendors highlights an externalizing effect, where regulatory pressure is leveraged to enforce best practices across the entire ecosystem.
The unstated pattern involves balancing speed against security depth. When mandates focus purely on control implementation (like MFA or segmentation) without addressing the operational bottleneck of remediation, the proposed solution risks being perceived as aspirational rather than actionable. The question arising is whether mandating a baseline for risk management—as opposed to mandating specific technical remediation steps—is the most effective mechanism for achieving tangible security improvements in environments where downtime is not an option. What structures exist to reconcile the need for operational continuity with the imperative for demonstrable security maturity?