CISA Urged to Implement OT Cybersecurity Directive Following Water Utility Attacks

• •CISA is urged to issue a Binding Operational Directive for OT cybersecurity.
• •Most federal agencies have not met OMB's requirements for networked device inventories.
• •The coalition emphasizes the need for clear governance and accountability for OT security.

A coalition of cyber firms and critical infrastructure operators has recommended that the Cybersecurity and Infrastructure Security Agency (CISA) issue a Binding Operational Directive (BOD) to enhance cybersecurity for operational technology (OT) systems in federal agencies. This follows attacks on water utilities earlier in the summer of 2026, which highlighted vulnerabilities in OT systems. The coalition's recommendations include establishing clear governance and accountability for OT security, incorporating OT into existing cybersecurity guidance, and aligning requirements with CISA's performance goals. The Government Accountability Office (GAO) reported that most federal agencies have not complied with Office of Management and Budget (OMB) requirements for managing networked devices, with only seven out of 22 agencies fully addressing these requirements as of September 2026. The lack of a cohesive approach to OT cybersecurity poses significant risks to federal infrastructure, which relies on OT in over 8,000 facilities managed by the General Services Administration (GSA).