Guidance for Asset Owners and Operators

Asset owners and operators of operational technology (OT) can improve the security of their existing systems by applying CISA guidance services and designing secure greenfield systems. OT includes items such as programmable logic controllers (PLCs), human-machine interfaces (HMIs), supervisory control and data acquisition (SCADA), and distributed control systems (DCS) that control critical infrastructure.

Why Focus on OT Security

Nation-state threat actors, cyber criminals, and hacktivists are increasingly targeting critical infrastructure, including OT systems. This activity has caused service disruptions and safety incidents and has irreparably damaged equipment. OT cybersecurity aims to reduce both the likelihood and impact of a successful cyberattack.

An OT Cybersecurity Starting Point

CISA’s CI Fortify initiative explains the nation-state threat and how operators can prepare for a crisis or conflict scenario. Operators beginning their CI Fortify journey should start with Secure Connectivity Principles for OT , which outlines eight principles for achieving a target state of secure, connected OT systems.­

Establishing a target state helps operators strategically apply CISA guidance and services, as the cost of security varies significantly depending on the capabilities of legacy equipment and where a system is in the organization’s capital expenditures (CapEx) cycle. Follow the guidance below to learn how to prioritize and apply key CISA resources in support of your CI Fortify journey.

How to Prioritize CISA Updates

1) Follow CISA guidance on patching Known Exploited Vulnerabilities (KEV) in products you own that appear in CISA KEV Catalog Alerts . CISA includes vulnerabilities in the KEV Catalog only after verifying that threat actors have exploited them to compromise one or more victims.

2) Review alerts and advisories covering topics such as:

Industrial Control System Advisories

Specific threats affecting your industry (e.g., ransomware campaigns)

Vendor-provided remediation guidance for vulnerabilities

3) Review cybersecurity advisories providing OT cybersecurity guidance.

Using CISA Guidance, Services, and Tools to Protect OT

Apply CISA guidance, services, and tools throughout the system lifecycle as applicable.

Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products lays out component-level security considerations when buying new OT products. This guidance helps operators avoid perpetuating legacy design patterns.

Secure Connectivity Principles for OT describes system-level considerations for creating a connected OT system with reduced complexity and more control in the hands of the operator. Organizations can modify existing systems, but it is easier to standardize and set secure connection methods during the initial deployment.

See CISA’s Integrators and Engineering Firms role-specific guidance for detailed instructions and best practices on deployments.

Operations & Maintenance

Principles of Operational Technology Cybersecurity provides baseline principles for senior leaders when making OT security decisions.

Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators provides owners and operators guidance on understanding their current assets, enabling informed risk management and prioritization of security investments.

Internal Monitoring: Malcolm is an open source security information and event management (SIEM) tool with parsers for industrial protocols. This tool is useful for establishing a monitoring program.

Attack Surface Monitoring: CISA’s Cyber Hygiene service provides regular free scans of an organization’s external attack surface, notifying operators of any known exploited vulnerabilities and internet-exposed assets.

Incident Response and Proactive Assessments: CISA's regional advisors offer free assessments to examine physical security, infrastructure resilience, and cyber readiness.

Training: CISA provides no-cost, on-demand, training on ICS cybersecurity.

Using CISA Services, Tools, and Guidance to Protect the IT Network

Apply the following CISA guidance to protect your IT network’s email system, Active Directory, and cloud applications as needed.

Email: CISA Insights - Cyber: Enhance Email & Web Security

Active Directory: Detecting and Mitigating Active Directory Compromises

Cloud [SCuBA]: Secure Cloud Business Applications (SCuBA) Project

Role-Specific Guidance

See the below guidance to explore and implement best practices for roles in the OT security ecosystem.

Integrators, Engineering Firms

OT Vendors, Suppliers, Producers

Can't find what you're looking for?

Email [email protected] for more information.