[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjkOA6kAVL3cVWLwIv8JSDqIQpoVfpOO81Nc8O2Bqe6g":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"30d6bf0b-57a9-4ffa-b2a7-256f676bfee9","Here’s how experts think CISA should tell agencies to protect OT","here-s-how-experts-think-cisa-should-tell-agencies-to-protect-ot-1fccf2","Government auditors say federal agencies haven’t met mandated security steps for operational technology, which hackers targeted in water sector attacks this summer. The post Here’s how experts think CISA should tell agencies to protect OT appeared first on CyberScoop.","A coalition of cyber firms and critical infrastructure operators has recommended that CISA issue a binding operational directive (BOD) to federal agencies for protecting operational technology (OT) systems. This comes after recent attacks on water utilities highlighted significant gaps in agency compliance with existing OT security requirements. The proposed directive aims to clarify responsibilities, establish minimum cybersecurity practices, and provide CISA with better visibility into federal OT assets.","Experts urge CISA to issue a binding directive for federal agencies to protect operational technology systems.","https:\u002F\u002Fcyberscoop.com\u002Fcisa-ot-cybersecurity-directive\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F10\u002FGettyImages-527656990.jpg","2026-10-06T11:30:00+00:00","2026-10-06T12:00:19.625299+00:00",7,[17,20,23,25,28,30],{"name":18,"type":19},"programmable logic controllers","product",{"name":21,"type":22},"operational technology","technology",{"name":24,"type":22},"Internet of Things",{"name":26,"type":27},"CISA","vendor",{"name":29,"type":27},"NSA",{"name":31,"type":27},"GSA","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":32,"icon":34,"name":35,"slug":36},null,"Policy","policy",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"malware","AI","Mentioned as reducing technical barriers for adversaries in cyber operations.",[26,29,31],{"controls":62,"vendors":149},[63,92,120],{"slug":64,"name":65,"problem":66,"products":67},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":93,"name":94,"problem":95,"products":96},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[97,105,112],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":107,"url":110,"description":111},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":121,"name":122,"problem":123,"products":124},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":164},"federal-ot-systems-lack-baseline-security-standards-and-visibility","Federal OT Systems Lack Baseline Security Standards and Visibility","Recent attacks on water utilities and other critical infrastructure have exposed a critical gap: federal agencies operating OT systems lack clear, enforceable cybersecurity baselines. Without a binding directive, compliance with existing OT security guidance remains inconsistent and unverifiable. CISA currently has limited visibility into what OT assets federal agencies are running, making risk assessment and incident response nearly impossible. This matters because OT systems control physical processes — compromises can have life-safety consequences far beyond typical IT breaches.",[155,156,157,158,159,160,161,162,163],"NIST SP 800-82 Rev. 3 (Guide to OT Security)","NIST CSF 2.0 — GV.OC, ID.AM, PR.IR","CIS Control 1 (Inventory and Control of Enterprise Assets)","CIS Control 12 (Network Infrastructure Management)","CIS Control 13 (Network Monitoring and Defense)","CISA Binding Operational Directive (BOD) framework","ICS-CERT Advisory Program","NERC CIP-002 through CIP-014 (for energy sector reference)","FISMA 2022 — Federal OT compliance reporting requirements",{}]