Know It. Control It. Contain It.: A Binding Operational Directive for OT Cybersecurity

Federal civilian agencies rely on operational technology in more than 8,000 GSA-managed facilities, from laboratories and hospitals to ports of entry. Yet no binding directive sets consistent minimum security practices for OT, and CISA lacks a clear view of the risks these systems carry. This paper calls on CISA to issue a Binding Operational Directive that sets a mandatory prevention and containment baseline for federal OT. It positions the directive as a complement to CISA's CI Fortify resilience efforts.

The paper outlines three recommendations for a federal OT BOD:

• Establish Clear OT Governance and Accountability

• Incorporate OT More Broadly across Existing Guidance

• Align CPGs to OT Needs and Prioritize Implementation