WASHINGTON — In a major push to secure the nation’s critical federal infrastructure, the Operational Technology Cybersecurity Coalition (OTCC) has formally petitioned the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to establish stringent, mandatory security requirements for operational technology (OT) across all federal civilian agencies.

The appeal, detailed in a comprehensive report published on October 6, calls for the immediate issuance of a Binding Operational Directive (BOD). According to the coalition, a severe regulatory gap currently exists: no existing federal directive mandates minimum cybersecurity practices for civilian agency OT environments, leaving CISA with dangerous blind spots regarding vulnerabilities in critical physical systems.

The push for immediate regulatory action underscores a growing anxiety among cybersecurity professionals regarding the convergence of IT and OT. As federal facilities increasingly digitize physical infrastructure, the attack surface expands, inviting sophisticated threat actors capable of bridging the digital-to-physical divide.

Main Facts

The core of the OTCC’s proposal centers on transforming how federal civilian agencies manage and protect their operational technology. Unlike traditional enterprise IT—which deals primarily with data, storage, and communication networks—OT governs the physical world, running machinery, environmental controls, and life-safety systems.

The proposed Binding Operational Directive would establish mandatory baselines across several critical domains:

• Governance: Agencies would be required to designate a senior official or dedicated office explicitly responsible for OT security, integrating OT risk directly into enterprise-wide risk management frameworks.
• Asset Discovery and Inventory: Establishing a comprehensive, verified accounting of all connected OT and Internet of Things (IoT) devices.
• Network Segmentation: Enforcing strict boundaries between enterprise IT networks and operational environments to prevent lateral movement by malicious actors.
• Access Control: Implementing rigorous secure remote access protocols and eliminating unmanaged default passwords.
• Resilience and Recovery: Mandating standardized configuration management, proactive incident preparedness, and verified backup and recovery procedures.

While the OTCC’s framework emphasizes foundational hygiene—such as multi-factor authentication (MFA) and default credential elimination—industry experts note that the proposal navigates a delicate balance between rigorous security enforcement and the operational realities of keeping physical systems online.

Chronology of Events

The public campaign for a federal OT directive follows a rapid succession of government findings and institutional warnings highlighting widespread non-compliance and systemic vulnerabilities within civilian agencies.

• September 30: The Government Accountability Office (GAO) published a critical report (GAO-26-108937) revealing that out of 22 civilian agencies reviewed, a mere seven had fully met Office of Management and Budget (OMB) requirements to inventory their networked OT and IoT devices. The mandatory deadline for these inventories had passed in September 2024, yet compliance remained troublingly low. Furthermore, the GAO noted that the OMB had failed to issue updated guidance for fiscal year 2026, creating a regulatory vacuum.
• October 6: Capitalizing on the momentum of the GAO findings, the OTCC published its landmark report titled "Know It. Control It. Contain It: A Binding Operational Directive for OT Security." The report formally urged CISA to step in where OMB guidelines had stalled, arguing that voluntary compliance has failed to secure federal facilities.
• Prior Context: Throughout 2024, CISA and various international partners rolled out targeted initiatives—such as zero-trust guidance for operational technology and the broader "CI Fortify" resilience framework—laying the conceptual groundwork for the stringent containment and isolation strategies now advocated by the OTCC.

Supporting Data and Facility Vulnerabilities

The urgency behind the OTCC’s petition is magnified by the sheer scale and footprint of operational technology across the federal government. According to the coalition, federal agencies rely heavily on OT in more than 8,000 General Services Administration (GSA)-managed facilities nationwide.

These facilities are not obscure backroom offices; they include vital public-facing and sensitive infrastructure such as:

• Government-operated laboratories handling hazardous materials and sensitive research.
• Federal hospitals and healthcare facilities providing patient care.
• Land, air, and sea ports of entry critical to national security and trade.

Within these 8,000+ buildings, OT systems silently manage life-safety and operational continuity, controlling Heating, Ventilation, and Air Conditioning (HVAC) units, electrical power distribution, physical access control systems, municipal-grade water management, and complex building automation systems. A successful cyberattack targeting these systems could disrupt critical government functions, compromise sensitive biomedical research, or physically endanger personnel inside federal facilities.

Compounding this physical exposure is the alarming lack of visibility highlighted by the GAO. With nearly 70% of audited civilian agencies failing to complete basic asset inventories by the mandated September 2024 deadline, the federal government currently lacks a reliable accounting of what devices are plugged into its networks, let alone whether those devices are running patched, secure firmware.

Official Responses and Industry Perspectives

The OTCC’s proposal has ignited a vibrant debate across the cybersecurity sector, drawing praise for its ambition while generating constructive critiques regarding its technical execution—particularly concerning vulnerability remediation and patching.

The Patching Dilemma and Remediation Backlogs

While the coalition’s proposed framework prioritizes fundamental controls such as default password modification, MFA, network segmentation, and system backups, some industry veterans point out a glaring omission: a mandate for active patching and firmware updates.

John Gallagher, Vice President at Viakoo, acknowledged the value of the OTCC’s proposed controls but warned that inventory and basic hardening alone will not solve the underlying crisis.

"Missing from the OTCC’s goals is remediation," Gallagher stated. "Without automated patch and configuration management, agencies will face backlogs that completely overwhelm operational teams."

Gallagher emphasized that threat actors routinely exploit low-hanging fruit—specifically unmanaged default passwords and obsolete, unpatched firmware. Leaving proactive remediation out of a binding directive, he argues, risks creating a false sense of security while known vulnerabilities linger indefinitely on aging industrial controllers.

Containment Over Endless Patching

Conversely, supporters of the coalition’s framework argue that the unique nature of operational technology makes traditional IT-style patching impractical or even dangerous. Louis Eichenbaum, Federal Chief Technology Officer at ColorTokens, stressed that containment must be prioritized alongside prevention, especially since many industrial control systems (ICS) cannot be taken offline for routine updates without causing catastrophic operational disruptions.

"Patching remains essential, but we cannot patch our way out of cyber risk," Eichenbaum explained.

He championed network segmentation as an indispensable safeguard, arguing that if an attacker breaches a perimeter controller, robust internal boundaries can successfully limit how far lateral movement can occur, stopping an IT intrusion from cascading into physical destruction.

Implications of a Federal OT Directive

Although CISA’s Binding Operational Directives legally apply only to Federal Civilian Executive Branch (FCEB) agencies rather than privately operated critical infrastructure, industry leaders emphasize that a federal mandate of this magnitude would carry profound ripple effects across the entire American economy.

Setting the National Standard

By establishing a rigorous, enforceable security baseline for federal buildings, laboratories, and ports of entry, the federal government would effectively signal what constitutes acceptable, due-care risk management for industrial control systems nationwide.

"Although CISA’s binding directives apply to certain Federal Civilian Executive Branch agencies, not privately operated critical infrastructure, a strong federal OT baseline would have influence far beyond government," Eichenbaum noted.

This ripple effect could manifest in three significant ways:

1. Models for Private Operators: Critical infrastructure owners in the energy, water, and transportation sectors—many of whom operate under voluntary guidelines—would gain a practical, government-vetted model for securing their own complex OT environments.
2. Vendor Accountability: Clear, mandatory federal security expectations would pressure industrial hardware and software vendors to overhaul their development lifecycles, favoring "secure-by-design" engineering over legacy convenience.
3. Federal Procurement Power: By embedding these requirements into federal purchasing contracts, the government can leverage its immense buying power to force the broader industrial technology market to elevate its baseline security standards.

Complementing Existing Resilience Initiatives

Furthermore, the proposed directive is designed to integrate seamlessly with CISA’s existing resilience efforts, such as the CI Fortify initiative. While CI Fortify focuses heavily on maintaining operations through a compromise—ensuring that critical functions can endure even if an adversary gains initial access—the OTCC’s proposed BOD provides the necessary pre-incident baseline. Together, these measures aim to create a defense-in-depth posture that bridges the gap between digital prevention and physical resilience.

Conclusion

As CISA weighs the OTCC’s petition, the pressure on federal civilian leadership is at an all-time high. With GAO audits revealing widespread non-compliance with basic asset discovery mandates, and threat actors increasingly targeting critical infrastructure components, the status quo is no longer viable.

Whether CISA ultimately issues a Binding Operational Directive for operational technology remains to be seen. However, the coalition’s report has successfully elevated the conversation from passive tracking to active enforcement. For federal agencies managing everything from research labs to water systems, the message is clear: securing the digital backbone of America’s physical infrastructure is an urgent national security imperative that can no longer be deferred.