The Operational Technology Cybersecurity Coalition (OTCC) has issued a formal call to action for the U.S. Cybersecurity and Infrastructure Security Agency (CISA), urging the agency to implement mandatory, binding security requirements for operational technology (OT) across federal civilian agencies. This push for stronger regulatory oversight comes amid growing concerns that the digital infrastructure governing the nation’s physical assets—ranging from power grids to building climate control systems—remains dangerously exposed to cyber threats due to a lack of visibility and standardized security protocols.
In a report released on October 6, the OTCC argued that the current federal cybersecurity landscape is deficient, noting that no existing directive establishes the minimum practices required to protect OT in federal settings. According to the coalition, the lack of a cohesive policy has left CISA without the necessary visibility into the risks that these systems face, creating a blind spot that could have cascading consequences for national security and public safety.
The scale of the issue is significant. Federal civilian agencies rely on an expansive network of OT across more than 8,000 facilities managed by the General Services Administration (GSA). These environments are not merely office spaces; they house critical laboratories, hospitals, and ports of entry where OT is responsible for the seamless operation of life-safety and infrastructure systems. These include building automation, HVAC units, power distribution, water management, and electronic access control systems. When these systems are compromised, the resulting impact can transition rapidly from a digital disruption to a physical emergency.
GAO Findings Highlight Widespread Non-Compliance
The urgency of the OTCC’s proposal is underscored by a recent assessment from the Government Accountability Office (GAO). In a report published on September 30, the GAO examined the readiness of 22 civilian agencies and discovered a troubling trend of non-compliance. The study revealed that only seven of the 22 agencies reviewed had fully met the Office of Management and Budget (OMB) requirements to maintain a comprehensive inventory of their networked OT and Internet of Things (IoT) devices.
The deadline for these essential inventories was September 2024, yet the majority of agencies have failed to achieve full compliance. Furthermore, the GAO report noted that the OMB has yet to issue updated guidance for the 2026 fiscal year, leaving agencies without a clear roadmap for addressing these gaps. The combination of missing deadlines and a lack of clear federal direction has led industry observers to conclude that the status quo is insufficient to manage the evolving threat landscape facing government infrastructure.
The Proposed Framework for Security
The directive proposed by the OTCC, titled "Know It. Control It. Contain It," aims to rectify these systemic issues by creating a formal, binding operational directive (BOD). Under this framework, federal agencies would be required to designate a senior official or a dedicated office with explicit responsibility for OT security. By elevating OT risk to the level of enterprise risk management, the proposal seeks to ensure that the security of physical systems is no longer treated as an afterthought, but as a core component of agency governance.
The proposed baseline for security includes several fundamental pillars: establishing a comprehensive asset inventory, implementing network segmentation, securing remote access, formalizing configuration management, ensuring incident preparedness, and developing verified recovery processes. The goal is to move beyond passive observation and toward a proactive security posture that can withstand sophisticated cyber attacks.
However, the proposal has drawn nuanced feedback from industry experts who argue that a checklist approach may not be enough to stop modern adversaries. John Gallagher, vice president at Viakoo, acknowledged the importance of the OTCC’s goals but cautioned that an inventory is only the first step in a much longer process. "Missing from the OTCC’s goals is remediation," Gallagher said, emphasizing that simply knowing what devices are on the network does not neutralize the threats inherent in those devices. He warned that without robust, automated patch and configuration management, agencies risk creating a backlog of security issues that would quickly overwhelm existing operational teams, leaving critical systems vulnerable for extended periods.
While the OTCC’s priority controls do include essential measures such as changing default passwords, mandating multifactor authentication (MFA), enforcing network segmentation, and maintaining secure backups, the report stops short of calling for mandatory firmware updates or comprehensive patching schedules. Gallagher pointed out that this is a critical omission, as threat actors frequently exploit unmanaged default passwords and obsolete firmware to gain unauthorized access to industrial systems.
Prioritizing Containment and Resilience
A central tenet of the coalition’s argument is that the proposed directive would work in tandem with CISA’s "CI Fortify" resilience initiative. This initiative focuses on the reality that a total prevention strategy is impossible, and therefore, systems must be built to continue operating through a compromise. By setting a pre-incident security baseline, the OTCC argues that agencies can effectively stop cyber incidents from escalating into physical catastrophes.
Louis Eichenbaum, the federal chief technology officer at ColorTokens, emphasized that the focus on containment is a pragmatic response to the unique nature of OT environments. "Patching remains essential, but we cannot patch our way out of cyber risk," Eichenbaum explained. Many industrial devices, he noted, are mission-critical and cannot be taken offline for patching without causing significant operational disruption. Because of this, network segmentation—the practice of isolating parts of the network to prevent the lateral movement of an attacker—becomes a primary defense strategy. If a single controller is compromised, effective segmentation ensures that the threat is contained, preventing the attacker from gaining control over the entire facility.
The influence of such a mandate could extend far beyond the federal government. While binding operational directives apply only to Federal Civilian Executive Branch agencies, the OTCC believes that a strong federal OT baseline would serve as a powerful signal to the private sector, which operates the vast majority of the nation’s critical infrastructure.
Eichenbaum suggested that a federal mandate would create a "practical model" for critical infrastructure owners, providing them with a blueprint for security that has been vetted by government experts. Furthermore, it would establish clearer security expectations for vendors, allowing the federal government to use its immense procurement power to incentivize the development of "secure-by-design" products. By forcing the market to adhere to higher standards, the federal government could help shift the entire ecosystem toward a more secure and resilient future.
As CISA considers the coalition’s recommendations, the debate highlights a fundamental challenge in modern cybersecurity: how to bridge the gap between legacy industrial processes and the modern, interconnected world. Whether through a new binding directive or updated OMB guidance, the pressure on agencies to gain control over their OT environments is mounting. The goal remains clear: to ensure that the digital foundation of the nation’s public infrastructure is secure enough to withstand the threats of today and the unknown risks of tomorrow.
