Coalition Urges CISA to Require Federal Agencies to Strengthen OT Security
Summary
A coalition of cyber firms and critical infrastructure operators wants CISA to issue a binding directive assigning federal agencies responsibility for OT security and requiring minimum protections, citing gaps in asset visibility and policy enforcement.
Key points
- The coalition calls for a CISA binding operational directive focused specifically on federal operational technology security.
- It recommends that each agency formally designate an officer responsible for OT cybersecurity.
- The proposed directive would set minimum security practices, draw on existing federal guidance, and align with CISA cybersecurity performance goals.
- The coalition says CISA lacks a holistic view of federal agencies’ OT assets and associated risks.
- A recent GAO report found that most federal civilian agencies had not implemented 2023 OMB requirements for networked IoT and OT devices.
- The proposal follows attacks on water utilities, but the coalition does not claim that its proposed directive would have prevented them.
Article Details
- Event Type
- A coalition of cyber firms and critical infrastructure operators urged CISA to issue a binding operational directive focused on federal operational technology security.
- Impact
- The proposed directive would assign OT cybersecurity responsibility within each federal agency, establish minimum security practices, and align with existing federal guidance. The article describes gaps in agencies’ OT asset visibility and security policies, and cites concern about potential consequences of attacks; it does not report a new attack or confirmed impact from one.