CISA's Installed Base Program to help OEMs identify and secure internet

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced launch of an Installed Base Program that partners with original equipment manufacturers (OEMs) to help critical infrastructure owners and operators identify and secure vulnerable, internet-exposed operational technology (OT) assets before attackers can exploit them. This comes as the agency recognizes that OEMs are foundational to U.S. critical infrastructure because of their significant footprint in industrial control systems (ICS) and products deployed across sectors. Combined efforts and resources of CISA and OEM partners allow for device identification, vulnerability prioritization, cyber threat information sharing, and targeted mitigation guidance for identified asset owners.

The program targets a persistent gap. Publicly available data often identifies only the internet service provider (ISP) tied to a vulnerable asset, not its owner. CISA uses open-source scanning tools and its Cyber Hygiene Vulnerability Scanning Service to identify the owners or operators of exposed assets. When those tools and public data cannot establish ownership, the agency may use its administrative subpoena authority to obtain information from service providers and reach the organizations responsible for the devices. Working with OEMs whose equipment is deployed across the sector, CISA can then notify owners so they can act quickly to reduce the risk of exploitation.

Through these notifications, CISA has helped critical infrastructure organizations remove thousands of vulnerable assets from internet exposure. OEMs participating in the program have also reported significant reductions in internet-exposed assets across their customers’ environments, supported by information sharing among participants.

The program focuses on four outcomes, including building strategic partnerships that foster collaborative defense; sharing actionable information, such as validated internet protocol (IP) data for vulnerable assets; increasing visibility into internet-exposed OT assets to identify potential attack vectors and notify the right owners and operators; and providing mitigation and hardening guidance to reduce risk.

CISA establishes strategic partnerships with OEMs through regular, structured engagements to foster collaborative defense. These engagements help align objectives, insights and coordinate joint actions to address common cybersecurity challenges. The agency also facilitates regular exchanges of vulnerability and cyber threat information with OEM partners, including sharing validated vulnerable Internet Protocol (IP) data with manufacturers and sending direct notifications to identified critical infrastructure organizations. These exchanges support proactive security improvements and risk mitigation across the ecosystem.

CISA also uses technical tools and OEM data to improve visibility into internet-exposed OT assets and identify vulnerabilities and potential attack vectors affecting critical systems. The program draws on open-source and internal tools and, when necessary, the agency’s administrative subpoena authority to identify and notify organizations operating vulnerable, internet-exposed systems.

To reduce the attack surface of U.S. critical infrastructure, CISA provides actionable mitigation recommendations and hardening guidance. In collaboration with OEM partners, the agency develops and shares tailored mitigation guides and draws on existing resources to help organizations address vulnerabilities in critical products. Among notified organizations, CISA has observed a decline in internet-exposed vulnerabilities and increased adoption of hardening recommendations.

Through these efforts, the Installed Base Program seeks to move beyond reactive threat notifications toward a proactive partnership model for securing critical infrastructure technologies while building and strengthening trusted relationships between CISA and participating OEMs.

The Installed Base Program helps OEMs reduce their customers’ exploitation risks and promote asset security through a five-stage process.

In the first stage, data gathering and asset discovery, CISA and its OEM partners exchange exposure data. The OEMs review vulnerable IP data, sourced internally, through third-party partnerships or from CISA, to validate ownership and identify assets requiring notification. They also triage and prioritize which internet-exposed equipment in their installed base CISA should analyze, based on vulnerabilities and criticality. Validated data is then sent back to CISA.

In the second stage, CISA analyzes data using open-source and internal tools to confirm the device’s existence, exposure and vulnerability, and to identify and confirm the asset’s owner or operator. Where open-source data identifies an owner, CISA shares that information with the OEM, which decides what notification action to take. Where ownership is unclear, CISA determines whether the IP address is eligible for the administrative subpoena process.

In the third stage, CISA uses its administrative subpoena authority to obtain system owner or operator information from the relevant service provider, typically the asset owner’s ISP. In the fourth stage, notification, CISA provides asset owners identified through an administrative subpoena with a CISA-developed mitigation guide. The guide summarizes the vulnerability and recommends steps to secure the OT asset, including removing it from internet exposure, and it incorporates recommendations from the OEM.

In the fifth stage, feedback, CISA provides its analysis results, along with the status of the subpoena, notification and mitigation, to the OEM. It also shares aggregated data on critical infrastructure sectors, notification status and IP exposure status with OEMs and other Sector Risk Management Agencies (SRMAs) that have a vested interest in protecting critical infrastructure organizations.

Beyond immediate vulnerability notifications, the Installed Base Program is built on ongoing strategic collaboration between CISA and its partners. Strategic meetings focus on brainstorming and planning tactical and long-term actions to proactively reduce internet exposure across the critical infrastructure ecosystem, aligning program efforts with the broader mission of securing U.S. critical infrastructure. They also facilitate the exchange of insights and best practices between CISA and its partners to advance critical infrastructure security and resilience.

These engagements also support developing and implementing joint strategies to mitigate vulnerabilities and strengthen the collective security posture of critical infrastructure. Through sustained, high-level collaboration, the program aims to remain a dynamic and responsive mechanism for reducing risk on a national scale, moving beyond transactional interactions toward a long-term strategic partnership.

CISA invites OEMs to establish partnerships aimed at proactively identifying and addressing vulnerabilities, thereby enhancing the security and resilience of their products. Participation in the Installed Base Program is voluntary and enables OEMs to provide continued support for the secure operation of their products, reinforcing their commitment to customer security.

Participation also positions OEMs as trusted cybersecurity leaders by demonstrating their commitment to protecting communities and advancing secure digital transformation. The program provides opportunities to collaborate with other partners, exchange insights on vulnerabilities and mitigation strategies, and jointly develop strategic solutions to address broader cybersecurity challenges.

CISA protects data shared by Installed Base Program partners through data classification markings using Traffic Light Protocol (TLP) Amber+STRICT. These markings ensure that OEM-specific data remains within CISA and the respective company and is not shared with other Installed Base partners.

Installed Base partners typically meet with CISA monthly to exchange information. OEMs interested in participating can CISA. Participation typically involves an agreement outlining roles, responsibilities and data-sharing protocols. Participating OEMs are asked to provide relevant information, including product-specific details, vulnerabilities, commonly known misconfigurations and known alignment with critical infrastructure. They are also expected to collaborate with CISA on notification and mitigation efforts.

CISA identifies vulnerabilities affecting U.S. critical infrastructure through open-source tools, commercial data sources and its own services. Recurring scans and established communication channels further support vulnerability identification and notification for organizations enrolled in CISA’s Cyber Hygiene Vulnerability Scanning Service.