A coalition of cybersecurity experts is urging the Cybersecurity and Infrastructure Security Agency (CISA) to establish mandatory federal cybersecurity standards for operational technology (OT) systems used across government facilities. The Operational Technology Cybersecurity Coalition (OTCC) released an eight-page white paper on Tuesday arguing that voluntary guidance has failed to close critical security gaps in OT environments, particularly after a series of cyberattacks targeted water systems in at least 12 U.S. states.
Federal OT Systems Expose Critical Visibility Gaps
The OTCC cited a recent Government Accountability Office (GAO) study that revealed only seven of 22 civilian federal agencies had fully met White House requirements to inventory their networked operational technology and Internet of Things (IoT) devices. Those inventories were due in September 2024, meaning most agencies still lack basic visibility into their OT assets.
[The Government Accountability Office] just confirmed what OT practitioners have been warning about for years: you can't secure what you can't see, and most federal agencies still can't see their OT.
Bolton emphasized that while CISA has issued multiple binding operational directives (BODs) in the past when voluntary measures proved insufficient, no such directive currently exists for OT security. A federal OT BOD would establish a uniform baseline across the Federal Civilian Executive Branch (FCEB), enabling CISA to measure compliance and manage cyber risk consistently.
Proposed Baseline Focuses on Asset Visibility and Access Controls
The OTCC report outlines a prevention and containment framework built on six core elements: visibility into OT assets, network segmentation, enforceable remote access controls, configuration baselines, incident preparedness, and verified backup and recovery. The coalition recommends that agencies designate a senior official or unified office to oversee OT asset inventory, baseline configuration, and incident readiness.
According to Michael Garcia, policy director of OTCC, the recommendations are intentionally practical, building on existing requirements rather than creating new bureaucratic burdens. "Our recommendations are practical by design. Name an accountable official, build on requirements agencies already have, and prioritize the basics that matter most in the incidents we've seen, like changing default passwords and segmenting networks," Garcia said.
Ownership Identified as Critical Missing Element
Several OT security experts highlighted ownership as the central challenge in securing federal OT systems. Dave Williams, OT security leader at cybersecurity firm Elisity, explained that in most facilities, OT equipment such as chillers, badge readers, and power systems are managed by facilities teams, while network infrastructure falls under the Chief Information Officer’s (CIO) office.
In most facilities, the chillers, badge readers, and power systems belong to a facilities team, and the network belongs to the CIO. Every other recommendation on the list, from asset inventory to segmentation to remote access, assumes someone is accountable to act on it.
Williams argued that clear ownership resolves prioritization and resource allocation conflicts before they arise. A binding directive could force agencies to assign explicit responsibility for OT cybersecurity, which he believes would be more effective than additional guidance.
CISA Has Not Yet Responded to Proposal
CISA declined to comment on the OTCC white paper. However, Garcia confirmed that the coalition engaged with CISA during the paper’s development and shared a final copy before publication. The OTCC maintains that a BOD would not only improve federal OT security but also serve as a strong demand signal for cybersecurity best practices across state, local, and private sectors, even though such entities are not required to comply with federal directives.
The white paper underscores that many of the OT devices compromised in recent water system attacks were exposed due to basic security failures: direct internet connectivity, default or missing passwords, and lack of network segmentation. By addressing these fundamentals through enforceable standards, the OTCC aims to reduce the attack surface in environments where cyber threats are increasingly leveraging artificial intelligence to lower the barrier to sophisticated intrusions.
Source: The Record