Installed Base Program

Operational technology (OT) systems are increasingly connected to enterprise networks and the internet, despite many legacy devices not being designed to withstand modern cyber threats. When vulnerabilities are discovered, original equipment manufacturers (OEMs) often struggle to identify and reach customers, leaving critical systems at risk of exploitation.

CISA’s Installed Base Program provides a mechanism for OEMs to work with CISA to address these vulnerabilities before they can be exploited. These partnerships help critical infrastructure owners secure vulnerable, internet-exposed operational technology and reduce cyber risk. OEMs can join this voluntary effort by contacting [email protected] .

Introducing the Installed Base Program

Currently, publicly available data sources often only identify the associated internet service provider (ISP) for vulnerable internet-exposed assets, making it difficult to determine the actual owner. CISA’s Installed Base Program helps close this gap by capitalizing on our authorities and partnerships with original equipment manufacturers (OEMs) whose devices are used by U.S. critical infrastructure.

Specifically, through the use of CISA’s administrative subpoena authority and partnerships with OEMs, the program helps identify and notify organizations operating vulnerable internet-exposed OT assets so the vulnerable organizations can take timely action to reduce the risk of exploitation.

CISA leverages open source scanning tools and our Cyber Hygiene Vulnerability Scanning Service to identify the owner or operator of internet-exposed vulnerable OT assets. When the owner or operator of an internet-exposed, vulnerable asset cannot be identified using these tools or through publicly available data sources, CISA may leverage its administrative subpoena authority.

CISA uses its administrative subpoena authority to obtain information from service providers for the owners or operators of vulnerable devices. This authority supports the Installed Base Program enabling CISA to identify and owners or operators of internet-exposed OT assets. These notifications have prompted critical infrastructure organizations to remove thousands of vulnerable assets from the internet.

OEMs that participate in CISA’s Installed Base Program see significant reductions in internet-exposed assets across their customer environments due to the information sharing and collaboration from program participants.

Who Does CISA Notify Under the Installed Base Program?

If you receive a notification, you can verify the identity of the CISA personnel through CISA Central by emailing [email protected] or calling 1-844-Say-CISA (1-844-729-2472).

What is the Installed Base Program?

The Installed Base Program is a partnership between CISA and leading OEMs to proactively reduce cyber risk across critical OT environments. Its mission is to work directly with leading OEMs to promote the safe and resilient use of OT products across U.S. critical infrastructure. In the context of the Installed Base Program, the term “installed base” refers to the products OEMs manufacture that customers deploy and operate.

The program focuses on four key outcomes:

Partnership and Relationship Building: CISA establishes strategic partnerships with OEMs to foster a culture of collaborative defense, achieved via regular, structured engagements to align goals, insights, and strategize joint actions to address common challenges.

Actionable Cyber Information Sharing: CISA facilitates a regular exchange of vulnerability and cyber threat information between CISA and OEM partners. This process involves sharing validated vulnerable Internet Protocol (IP) data with the OEMs and sending direct notifications to identified critical infrastructure entities. This exchange accelerates proactive security enhancements and risk mitigation efforts across the ecosystem.

Asset Visibility: CISA leverages technical tools and OEM data to increase visibility into internet-exposed OT assets, identifying vulnerabilities and potential attack vectors within critical systems. The program uses open source and internal tools and, when necessary, leverages CISA’s administrative subpoena authority to identify and notify owners or operators of vulnerable, internet-exposed systems.

OT Exposure Risk Reduction: CISA reduces the attack surface of U.S. critical infrastructure by providing actionable mitigation recommendations and hardening guidance. Through close collaboration with OEM partners, CISA develops and shares tailored mitigation guides and leverages existing resources to help entities address vulnerabilities in their critical products. Among notified organizations, CISA has observed a decrease in internet-exposed vulnerabilities and an increase in the adoption of hardening recommendations, demonstrating the value of this collaboration.

Through these concentrated efforts, the Installed Base Program moves beyond reactive threat notifications to a strategic partnership model that proactively secures the nation's most vital technologies. The program also helps build and strengthen trusted partnerships between CISA and our OEM partners.

The Installed Base Program helps OEMs to reduce their customers’ exploitation risks and promote asset security through the following process:

Data Gathering & Asset Discovery: OEM partners review vulnerable IP data (sourced internally, through third-party partnership, or from CISA) to validate ownership and identify assets requiring notification. The validated data is sent back to CISA.

CISA Analysis: CISA uses open source and internal tools to identify exposed assets and confirm asset ownership. CISA shares asset owner information identified via open source data back to the OEMs for their discretion on notification actions. If ownership is unclear, CISA leverages its administrative subpoena authority to obtain asset owner information.

Administrative Subpoena Authority: CISA leverages its administrative subpoena authority to obtain system owner or operator information from the relevant service provider (typically the asset owner’s ISP).

Notification: CISA provides asset owners identified from an administrative subpoena a CISA-developed mitigation guide containing a summary of the vulnerability and mitigation recommendations to secure the OT asset, including guidance for internet-exposure removal.

Feedback: CISA shares aggregated data regarding critical infrastructure sectors, notification status, and IP exposure status with OEMs and other Sector Risk Management Agencies (SRMAs) who have a vested interest in the protection of critical infrastructure organizations.

Figure 1: Installed Base Program Process

The combined efforts and resources of CISA and OEM partners allow for device identification, vulnerability prioritization, cyber threat information sharing, and targeted mitigation guidance for identified asset owners.

Strategic Partnership Engagement

Beyond immediate vulnerability notifications, the Installed Base Program is built on a foundation of ongoing strategic collaboration. The purpose of these strategic meetings is to:

Strategize : Brainstorm and plan tactical and strategic actions to proactively reduce internet exposure across the entire critical infrastructure ecosystem.

Align Goals: Align program efforts with the overarching mission of securing U.S. critical infrastructure.

Insights: Facilitate the exchange of insights and best practices between CISA and its partners, leveraging these insights to further critical infrastructure security and resilience.

Reduce Risk: Develop and implement joint strategies to mitigate vulnerabilities and strengthen the collective security posture of critical infrastructure.

This ongoing, high-level engagement ensures that the program remains a dynamic and responsive mechanism for reducing risk on a national scale, moving beyond a transactional approach to a true strategic partnership.

CISA invites partnerships from OEMs. This collaboration is essential for proactively identifying and addressing vulnerabilities, thereby enhancing the security and resilience of their offerings.

Participating in the Installed Base Program is voluntary.

OEMs interested in joining the Installed Base Program can [email protected] . After expressing interest, they will sign an agreement, which outlines roles, responsibilities, and data-sharing practices.

Frequently Asked Questions

Why does the Installed Base Program matter? Legacy OT systems and protocols were not designed with security in mind. Advancements in technology and use of internet connectivity for operations, such as remote access, created inherent vulnerabilities with these assets and protocols. Lack of authentication and encryption mechanisms alongside internet connectivity provides a pathway for threat actors to target and exploit these OT assets. The Installed Base Program matters because, through a collaborative approach with our OEM partners, it proactively identifies and addresses critical risks, helping to prevent disruptions that could impact essential services, including energy, water, healthcare, manufacturing, and other critical functions.

Why does the Installed Base Program matter?

Legacy OT systems and protocols were not designed with security in mind. Advancements in technology and use of internet connectivity for operations, such as remote access, created inherent vulnerabilities with these assets and protocols. Lack of authentication and encryption mechanisms alongside internet connectivity provides a pathway for threat actors to target and exploit these OT assets. The Installed Base Program matters because, through a collaborative approach with our OEM partners, it proactively identifies and addresses critical risks, helping to prevent disruptions that could impact essential services, including energy, water, healthcare, manufacturing, and other critical functions.

Why should an OEM join the program? By participating, the OEM is able to better serve its customers, showing that the organization continues to support the secure operation of its products on an ongoing basis. An OEM’s involvement in the Installed Base Program also positions the OEM as a trusted cybersecurity leader, showcasing a commitment to protecting communities and advancing secure digital transformation. Additionally, participation provides the OEM opportunities to collaborate with other partners, insights on vulnerabilities and mitigation strategies, and work together to develop strategic solutions for widespread security challenges.

Why should an OEM join the program?

Are there data protections in place for OEMs sharing data as part of the Installed Base Program? CISA protects Installed Base partner data through data marking classifications using traffic light protocol (TLP) markings of Amber+STRICT to ensure OEM data remains within CISA and the company directly. OEM-specific data is not shared with other Installed Base partners.

Are there data protections in place for OEMs sharing data as part of the Installed Base Program?

CISA protects Installed Base partner data through data marking classifications using traffic light protocol (TLP) markings of Amber+STRICT to ensure OEM data remains within CISA and the company directly. OEM-specific data is not shared with other Installed Base partners.

How often are Installed Base Program meetings held? Installed Base partners typically meet with CISA on a monthly basis for information sharing.

How often are Installed Base Program meetings held?

Installed Base partners typically meet with CISA on a monthly basis for information sharing.

How can an OEM enroll or get involved with the Installed Base Program? OEMs interested in participating can CISA at [email protected] . Participation typically involves an agreement outlining roles, responsibilities, and data sharing protocols. The program asks participating OEMs to provide relevant data, such as product specific details, vulnerabilities, commonly known misconfigurations, and known critical infrastructure alignment, and to collaborate with CISA on notification and mitigation efforts.

How can an OEM enroll or get involved with the Installed Base Program?

OEMs interested in participating can CISA at [email protected] . Participation typically involves an agreement outlining roles, responsibilities, and data sharing protocols. The program asks participating OEMs to provide relevant data, such as product specific details, vulnerabilities, commonly known misconfigurations, and known critical infrastructure alignment, and to collaborate with CISA on notification and mitigation efforts.

How does CISA identify vulnerabilities within systems? CISA uses open source tools, commercial data sources, and CISA services to identify vulnerabilities within U.S. critical infrastructure. Recurring scans and established communication channels further facilitate the identification and notification process for organizations enrolled in CISA’s Cyber Hygiene Vulnerability Scanning Service . .

How does CISA identify vulnerabilities within systems?

CISA uses open source tools, commercial data sources, and CISA services to identify vulnerabilities within U.S. critical infrastructure. Recurring scans and established communication channels further facilitate the identification and notification process for organizations enrolled in CISA’s Cyber Hygiene Vulnerability Scanning Service . .

What other cybersecurity services does CISA offer? CISA provides various no-cost cybersecurity services and resources. These include the Cyber Hygiene Vulnerability Scanning Service and the Cybersecurity Performance Goals (CPGs). CISA encourages organizations to explore these resources to further enhance their cybersecurity posture.

What other cybersecurity services does CISA offer?

CISA provides various no-cost cybersecurity services and resources. These include the Cyber Hygiene Vulnerability Scanning Service and the Cybersecurity Performance Goals (CPGs). CISA encourages organizations to explore these resources to further enhance their cybersecurity posture.

How can organizations verify CISA communications? To verify the authenticity of a CISA employee, CISA Central at [email protected] or call 1-844-Say-CISA (1-844-729-2472).

How can organizations verify CISA communications?

To verify the authenticity of a CISA employee, CISA Central at [email protected] or call 1-844-Say-CISA (1-844-729-2472).

To ask any questions or to enroll in the Installed Base Program, please us at [email protected] .