Cyber experts call on CISA to create mandatory federal OT rules

1. Executive summary

The Operational Technology Cybersecurity Coalition (OTCC) published an 8-page white paper on 2026-10-07 urging CISA to issue a binding operational directive (BOD) setting a mandatory baseline for operational technology across federal civilian agencies. The paper points to recent intrusions against hundreds of water systems in at least 12 U.S. states, where affected devices were internet-exposed, ran default or blank passwords, and were not segmented from IT networks. No CVE, no exploited product and no named threat actor is identified in the source material, and no verified reference data resolved for this item, so there is no vulnerability to patch and no attribution to act on. The direct risk to EMEA financial services is low and indirect: this is a U.S. federal policy item, but the failure modes it describes (internet-reachable OT, default credentials, flat networks) are the same ones present in branch building-management, physical access control and data-centre plant environments that European banks and insurers operate. Treat this as a control-design prompt, not an incident.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The item is a policy advocacy paper about U.S. federal agency governance; it reports no incident at any EMEA entity, no third-party service affecting EMEA clients, and no threat to a specific system in scope. Mapping DORA Art. 17 or NIS2 Art. 23 here would be compliance-checkbox padding, because the trigger would be "a security topic was discussed", which is true of every advisory.

The one fact with a forward-looking regulatory hook is the OTCC recommendation that agencies name an accountable official for OT asset inventory and configuration baselines. EMEA firms with OT-adjacent estates (building automation, HVAC, physical access control) should read that against their existing DORA Art. 28 third-party and NIS2 Art. 21(2)(d) supply chain obligations for the vendors that run those systems, but the item itself does not trigger a reporting or testing duty.

3. Technical analysis & attack chain

This is a strategic item. There is no attack chain to reconstruct: the source describes a policy proposal and the conditions that motivated it, not a specific intrusion with a timeline, tooling or victim set. What follows is how the described failures actually work, from source facts only.

The OTCC paper cites recent cyberattacks on hundreds of water systems across at least 12 U.S. states. The source does not name the actor, the intrusion vector, the affected vendors, or a date range for those attacks, and it does not attribute them to nation states or cybercriminals beyond saying OT has become a target for both. That attribution is asserted, not evidenced, and should be treated as unconfirmed.

The three conditions the source identifies in the affected water systems are the mechanism, and they are worth stating precisely because they recur in every OT exposure:

1. Devices that should not have been connected to the internet were reachable from it. This is the exposure that turns a control device into an attack surface.
2. Those devices had default passwords or no password at all. Default and blank credentials remove the only barrier between an internet-reachable device and an operator-level session.
3. The OT devices were not segmented from other, non-operational parts of the network. A flat network means a compromise of a business system and a compromise of a control system are the same event.

The paper's proposed baseline is built on six elements: visibility into OT assets, network segmentation, enforceable remote access controls, configuration baselines, incident preparedness, and verified backup and recovery. It recommends that CISA require agencies to designate a senior official or a unified office to own OT asset inventory, configure baselines, and prepare for incidents, with backup and recovery plans created alongside risk reports.

The governance gap the paper describes is organisational, not technical. OT "too often falls into a gray zone between the Chief Information Officer's office and facilities management", per OTCC policy director Michael Garcia, and when no function owns the asset inventory, no function secures it. The supporting evidence is a government watchdog study cited by OTCC: of 22 civilian agencies reviewed, only 7 had fully met White House requirements to inventory their networked OT and IoT devices, with those inventories due in September 2024. Federal civilian agencies operate more than 8,000 owned or leased buildings including laboratories, hospitals, research facilities and ports of entry, each with HVAC, power, access control, water and building automation systems.

Two claims in the source are single-sourced and should be weighted accordingly. The assertion that artificial intelligence "has rapidly lowered the barrier for sophisticated attacks" against OT is OTCC's characterisation, offered without a cited incident or measurement. The claim that CISA engaged with OTCC during drafting and received a final copy before publication comes from Garcia; CISA declined to comment on the paper. Neither claim changes any defensive action.

4. Mitigation & containment

There is no exploited component in this item, so there is nothing to patch on a CVE timeline. The actions below address the three failure conditions the source names, applied to any EMEA financial services estate that runs OT or OT-adjacent systems (building management, HVAC, physical access control, data-centre plant, branch environmental monitoring).

P1 (within 24 hours)

• Enumerate every OT and OT-adjacent device that is reachable from the internet or from a general-purpose corporate network segment. The source's central finding is that agencies could not see their own OT estate; the same blind spot is the precondition for the water-system failures. If you cannot produce the list today, that is the finding.
• For any such device found, remove internet reachability at the perimeter and confirm the change from outside your network, not from the configuration console.
• Rotate or remove default and blank credentials on every OT device identified. Where a device cannot accept a changed credential, isolate it and raise it as a remediation exception with a named owner.

P2 (within 72 hours)

• Segment OT networks from IT networks where they are not already separated, and enforce the boundary with rules that deny by default rather than permit by exception. The source names lack of segmentation as a contributing condition in the water-system incidents.
• Restrict remote access to OT to an enforceable path (brokered access with authentication and logging) rather than vendor or operator direct connections. The paper lists enforceable remote access controls as a baseline element.
• Confirm that backup and recovery for OT systems is verified, meaning a restore has been tested, not merely that a backup job reports success. The paper pairs verified backup and recovery with incident preparedness.

P3 (within 7 days)

• Assign a single accountable owner for OT asset inventory, configuration baselines and incident preparation. The source's governance finding is that OT falls between the CIO's office and facilities management; the fix is a named owner, not a committee.
• Establish configuration baselines for OT devices and record deviations, so that a changed default or an added service is visible.
• Review contracts with the third parties that operate or maintain these systems against your DORA Art. 28 and NIS2 Art. 21(2)(d) supply chain requirements, specifically for asset inventory disclosure, remote access controls and incident notification.

5. Indicators of compromise

No indicators of compromise available in the source material. The source names no hashes, domains, IP addresses, file paths, registry keys, process names or command lines.

The source does describe observable conditions rather than atomic indicators. Those are recorded below as behavioural indicators for control-assurance purposes; they are not machine-pivotable and do not belong in a copyable block.

6. Detection

Insufficient indicators to author detection rules. The source contains no threat artefacts: no file names, command-line flags, mutexes, scheduled-task or service names, registry keys, ransom-note text or hard-coded values. Any rule built from this item would match reporting about the policy paper rather than malicious activity, so none is emitted.

The behavioural indicators in §5 are better served by control testing than by detection content: an external scan for exposed OT management interfaces, an authentication audit for default credentials on OT devices, and a flow review for OT-to-IT traffic crossing a segment boundary.

7. Sources

• The Record, "Cyber experts call on CISA to create mandatory federal OT rules", https://therecord.media/cyber-experts-call-on-cisa-require-ot-security, published 2026-10-07.

8. Adverse Trace position

Adverse Trace assesses this as a policy item with no direct technical exposure for EMEA financial services clients: no CVE, no exploited product, no named actor and no indicators, so there is no severity to assign and no patch or block to issue. The client impact is indirect and control-shaped. The three conditions the source identifies in the affected U.S. water systems (internet-reachable OT, default or absent credentials, no segmentation from the general network) are the same conditions we find in branch building-management, physical access control and data-centre plant environments across the region, and the governance gap the paper describes, OT sitting between the CIO's office and facilities management with no accountable owner, is common in European firms as well. We will track whether CISA issues a binding operational directive on OT and, if it does, extract the baseline requirements as a reference control set for client OT-adjacent estates, since a U.S. federal baseline is a useful proxy for what regulators elsewhere will expect. Clients who want to act now should run the P1 enumeration in §4 and report whether they can produce a complete OT asset inventory; that answer is the exposure.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.