Coalition Recommends CISA Issue Binding Directive for Federal OT Security
A coalition of cybersecurity firms and critical infrastructure operators has outlined its recommendations for how the Cybersecurity and Infrastructure Security Agency (CISA) should guide federal agencies in protecting operational technology (OT) systems. The Operational Technology Cybersecurity Coalition released its position paper on Tuesday, urging CISA to issue a binding operational directive (BOD) focused exclusively on OT security following a series of attacks on water utilities earlier this summer.
Clarifying Responsibility and Establishing Minimum Standards
The coalition argues that a CISA BOD for OT should clearly define who is responsible for protecting these systems within each federal agency. It should also draw upon existing federal guidelines and establish minimum cybersecurity practices that agencies must implement. According to the coalition, this approach would address three critical gaps: CISA’s limited visibility into the range of OT devices used across federal civilian executive branch agencies (FCEBs), the absence of consistent, government-wide OT security policies, and the potentially severe consequences of a successful cyberattack on federal OT infrastructure.
GAO Report Highlights Compliance Shortfalls
The coalition’s recommendation comes in the wake of a Government Accountability Office (GAO) report published last month, which found that most FCEBs have not implemented the Office of Management and Budget (OMB) requirements released in 2023 for networked Internet of Things (IoT) and OT devices. This lack of compliance underscores the need for stronger, enforceable direction from CISA, the coalition states.
Goals of the Proposed Directive
Michael Garcia, policy director of the coalition and a former CISA employee, explained that the push for a CISA directive serves two primary purposes. First, it ensures the federal government is adhering to the same standards it advocates for in the private sector — "practicing what it preaches." Second, it sends a clear message to private-sector OT owners, operators, and critical infrastructure partners about the cybersecurity expectations they should uphold and encourage in their supply chains.
Scope of Federal OT Assets
Garcia noted that the General Services Administration (GSA) owns or leases approximately 8,000 properties, many of which rely on OT systems for essential functions such as power distribution, heating, ventilation, and air conditioning (HVAC). While some of these systems may be considered "trivial" in isolation, the coalition emphasizes that CISA currently lacks a comprehensive inventory of the OT assets managed by FCEBs. This gap leaves the government exposed to risks from interconnected devices like programmable logic controllers (PLCs), which could be exploited if not properly secured.
Addressing the "Government Gray Zone"
Because OT systems often fall into a jurisdictional gray area between chief information officers (CIOs) and facilities management teams, the coalition recommends that CISA direct federal agencies to formally designate a specific officer responsible for OT cybersecurity. This clarification of accountability is seen as essential to overcoming organizational silos and ensuring consistent security oversight.
Aligning with Existing Guidance and Performance Goals
The coalition advises that the hypothetical BOD should review past OT-related guidance issued by the National Security Agency (NSA) to determine its applicability to civilian federal agencies. Additionally, any new requirements should be aligned with the cybersecurity performance goals that CISA first established in 2022, ensuring coherence with broader federal cybersecurity strategy.
Context and Limitations
The coalition is careful to note that it does not claim a BOD would have prevented the summer water sector attacks, as its focus is specifically on federal OT systems — an area where CISA has already begun some work. The paper acknowledges that CISA has previously integrated OT security requirements into directives such as BODs 23-01, 23-02, and 26-04, alongside issuing related technical guidance. However, given the increasing use of artificial intelligence by adversaries to reduce technical barriers, accelerate reconnaissance, and move laterally through poorly segmented OT environments, the coalition argues that a dedicated, comprehensive BOD is now necessary.
CISA’s Response and Ongoing Dialogue
CISA did not respond to a request for comment ahead of the coalition’s paper release. Nevertheless, Garcia said that in ongoing discussions with CISA officials, there is growing recognition that an OT-focused BOD may be warranted. "Increasingly, I think they understand that there might be a need" for such a directive, he stated.
Source: CyberScoop