OT coalition urges CISA to make every federal agency name an owner for OT security
OT Cybersecurity Coalition urges CISA to issue a binding directive requiring each federal agency to name an OT security owner and meet minimum practices. The push follows GAO's finding that most civilian agencies have not enacted OMB's 2023 IoT and OT requirements.
The Watch · Security desk
What happened
- The coalition grounds its case in CISA's limited visibility into federal OT devices, inconsistent OT security policy across agencies, and the severity of an attack on federal OT.
- Federal OT spans 8,000 GSA-owned and -leased properties, many with systems for power supply and for heating, ventilation and air conditioning.
- Under the proposal, CISA would check whether past NSA OT guidelines should apply to civilian agencies and align requirements with its 2022 cybersecurity performance goals.
- CISA did not respond to a request for comment on Monday, before the coalition published its paper.
Why it matters
- Who's exposed exposure Until each agency formally names an OT security officer, building controllers stay in what the coalition calls a government gray zone between CIOs and facilities managers.
- What it limits constraint Water utilities hit this summer gain nothing directly from a federal directive; the coalition itself does not claim one would have stopped those attacks.
- What it sets up precedent A federal OT baseline would give private owners and operators a list to demand from their own providers, the second goal Garcia set for the directive.
- Who has to decide decision CISA has to decide whether an OT-only directive adds enough beyond the OT requirements already written into BODs 23-01, 23-02 and 26-04.
Next story · Security · Oct 5
ClingSTUN backdoor turns vulnerable Linux devices into proxies that check in through public STUN serversConfirmed3 publishers
The Operational Technology Cybersecurity Coalition starts from inventory. Its paper says CISA "does not currently have a holistic view of the assets managed by the FCEB and the potential risks, such as connected programmable logic controllers, to which the government may be exposed." [10] Garcia acknowledged that some federal OT systems might be "trivial." [9]
The threat case is about speed. The paper argues that "as AI reduces the technical barriers to sophisticated cyber operations, enabling adversaries to identify weaknesses, accelerate reconnaissance, and move laterally through poorly segmented operational environments with greater speed and scale, it is time for an encompassing BOD solely focused on OT security." [15] The coalition offers that as a forecast. Its members are cyber firms and critical infrastructure operators. [1]
The firmer evidence is GAO's. Last month the watchdog concluded that most federal civilian executive branch agencies have not enacted the requirements OMB released in 2023 for networked IoT and OT devices. [4] A directive would go to the same agencies. [2] CyberScoop's account of the recommendations does not include deadlines or reporting milestones. [2] [12]
Michael Garcia, the coalition's policy director, until recently worked at CISA, and he gave two goals for the recommendations. [5] "One, it does make sure that the government is taking its own medicine," Garcia said. "You should practice what you preach." [6]
He has also been talking to the agency. In those discussions, Garcia said, "increasingly, I think they understand that there might be a need" for an OT directive. [17]
What to watch
- A CISA statement on whether it will draft a directive focused solely on OT security.
- Agency responses to GAO on enacting OMB's 2023 requirements for networked IoT and OT devices.
- Whether any draft directive extends NSA's OT guidance to civilian agencies or stays aligned with CISA's 2022 performance goals.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption10
- Hype gap+5
- Incentives60
- Confidence68
Perspective Coverage
3 publishers- Builder
- Builder 22%
- Operator
- Operator 62%
- Investor
- Investor 16%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A coalition of cyber firms and critical infrastructure operators on Tuesday spelled out its views on the tasks CISA should assign federal agencies to protect operational technology systems, after this summer's attacks on water utilities.
- [2]
The Operational Technology Cybersecurity Coalition said a CISA binding operational directive for OT should specify who is responsible for protecting these systems at each agency, draw on existing federal guidelines and set minimum cybersecurity practices.
- [3]
The coalition said the BOD would address CISA's lack of visibility into the spectrum of OT devices in federal agencies, a lack of consistent across-the-board OT security policies, and the severity of the consequences an attack on federal OT could produce.
- [4]
Last month the Government Accountability Office published a report concluding that most federal civilian executive branch agencies have not enacted Office of Management and Budget requirements released in 2023 for networked Internet of Things and OT devices.
- [5]
Michael Garcia, policy director of the coalition, who until recently worked at CISA, said putting forward recommendations for a CISA directive has two goals.
- [6]
"One, it does make sure that the government is taking its own medicine," ... "You should practice what you preach."
- [7]
"Second, it sends a very strong signal to the private sector that, 'This is what we think is important: As an OT partner, owner or operator or critical infrastructure owner or operator, [this is what] you should ask other providers to do.'"
- [8]
There are 8,000 General Services Administration-owned and -leased properties, many of which would have OT involved in everything from power supply to heating, ventilation and air conditioning systems.
- [9]
Garcia acknowledged some of those OT systems might be "trivial."
- [10]
The coalition paper says CISA "does not currently have a holistic view of the assets managed by the FCEB and the potential risks, such as connected programmable logic controllers, to which the government may be exposed."
- [11]
With OT falling into a "government gray zone" between chief information officers and facilities managers, the coalition recommends CISA tell agencies to formally designate an officer in charge of cybersecurity for OT.
- [12]
The coalition says the directive should examine past OT guidelines issued by the National Security Agency to see if they should apply to federal civilian agencies, and align requirements with cybersecurity performance goals CISA first issued in 2022.
- [13]
The coalition does not assert that such a BOD would have headed off this summer's attacks on the water sector, and is focused on federal OT.
- [14]
"To be fair, CISA has incorporated OT security requirements into prior directives (such as BODs 23-01, 23-02, and 26-04) alongside a host of technical guidance," the paper reads.
- [15]
"as AI reduces the technical barriers to sophisticated cyber operations, enabling adversaries to identify weaknesses, accelerate reconnaissance, and move laterally through poorly segmented operational environments with greater speed and scale, it is time for an encompassing BOD solely focused on OT security."
- [16]
CISA did not respond to a request for comment Monday in advance of the coalition publishing its paper.
- [17]
Garcia said that in discussions with CISA, "increasingly, I think they understand that there might be a need" for an OT BOD.
Sources
3 independent publishers whose own reporting we read for this story.
- cyberscoop.comHere’s how experts think CISA should tell agencies to protect OT
1 article · October 6, 2026
- infosecurity-magazine.comOT Coalition Urges CISA to Mandate Federal OT Security
1 article · October 7, 2026
- therecord.mediaCyber experts call on CISA to create mandatory federal OT rules
1 article · October 7, 2026
Topics and entities
Topics
- Operational technology security
- Binding operational directives
- US Federal Cybersecurity Policy
Entities
- Office of Management and Budget
- Operational Technology Cybersecurity Coalition
- General Services Administration
- Government Accountability Office
- CISA