What happened
The Operational Technology Cybersecurity Coalition has asked the US Cybersecurity and Infrastructure Security Agency to set mandatory security requirements for operational technology across federal civilian agencies. In a report published on October 6, the coalition called for a binding operational directive, arguing that no directive currently sets minimum practices for federal OT and that CISA lacks visibility into the risks.
The coalition points to scale. Agencies rely on OT in more than 8,000 General Services Administration managed facilities, including laboratories, hospitals and ports of entry running HVAC, power, access control, water and building automation systems. The request follows a Government Accountability Office report published on September 30, which found that only seven of 22 civilian agencies reviewed had fully met Office of Management and Budget requirements to inventory networked OT and Internet of Things devices. Those inventories were due by September 2024, and the GAO said OMB had not issued updated fiscal year 2026 guidance.
As proposed, the directive would require agencies to name a senior official or office responsible for OT security and to bring OT risk into enterprise risk management. It would set a baseline for asset inventory, network segmentation, remote access, configuration management, incident preparedness and verified recovery. The coalition's priority controls include changing default passwords, multi-factor authentication, segmentation and backups, but the report does not call for patching or firmware updates. John Gallagher of Viakoo flagged that gap, noting that remediation is missing. Louis Eichenbaum, federal chief technology officer at ColorTokens, said containment matters alongside prevention and that "we cannot patch our way out of cyber risk." The coalition framed the directive as complementary to CISA's CI Fortify resilience initiative.
Why this is a GRC story
Inventory is the precondition for every other control. The GAO finding is the important part of this story. A year past the deadline, most reviewed agencies still cannot fully account for their networked OT and IoT devices. You cannot assess, segment or recover what you have not counted, and the same holds where OT inventory sits with facilities rather than security.
Ownership has to be named, not assumed. The proposed directive's first requirement is a designated senior official for OT security. That is governance language, and it exists because industrial control systems and cyber risk usually sit in different parts of an organization. A named owner with a seat in risk discussions is how those two worlds start talking.
Containment is a risk acceptance decision. Many industrial devices cannot be patched quickly without disrupting operations. Segmentation, offline recovery and tested restoration buy time when patching is slow. Treating them as substitutes for patching is a risk decision that should be documented.
What to watch
Watch whether CISA acts on the request and, if it does, whether patching and firmware updates make it into the final text. Watch also for the OMB guidance the GAO said was missing for fiscal year 2026, which would tell agencies what a complete inventory looks like.
For anyone running OT outside government, the direction of travel still matters. Federal baselines tend to become procurement expectations. Know what is on the network, name an owner, and prove you can recover a segment without patching your way out of the problem.
Attribution: Analysis based on Infosecurity Magazine and related public reporting. This article is original commentary, not a repost of the source material.