OTCC co-hosts critical infrastructure roundtable at Singapore International Cyber Week
Singapore International Cyber Week draws government leaders, regulators, and industry from around the world each year. On October 15, OTCC and the U.S. Chamber of Commerce used that moment to host a roundtable on one of the most pressing issues on the global cyber agenda: securing critical infrastructure.
Held at the Mandarin Oriental in Marina Bay, the session brought national cyber officials from allied governments together with more than 25 companies and organizations spanning OT security, cloud, software, and policy. Officials opened with an overview of their national priorities before handing the floor to industry participants for an open discussion.
A challenge that crosses borders
The threats facing operational technology (OT) don't respect national borders. A water utility in the United States, a power provider in Asia, and a manufacturer in Europe are often running similar equipment, facing similar adversaries, and working with similar resource gaps. When an attack technique works in one country, it rarely stays there for long.
That makes international forums like Singapore International Cyber Week an important place for the OT community to show up. Putting allied officials and industry in the same room makes space for a more honest conversation about where defenses are falling short and what each side needs from the other.
The questions driving the discussion
The agenda was built around five questions OT owners and operators are grappling with right now:
Where is the gap between threat and defense widest? State-sponsored actors are pre-positioning inside critical infrastructure, and criminal groups are increasingly targeting OT environments. Some sectors are far less prepared than others, held back by tight budgets, legacy equipment, workforce shortages, or limited visibility into their own systems.
What does "assume compromise" look like in practice? If national resilience planning starts from the assumption that OT environments will be breached, operators need threat hunting, manual fallback operations, tested recovery plans, and cross-sector exercises. Deciding how to prioritize and fund those capabilities is the harder part.
How should we manage IT/OT convergence and AI? As IT and OT systems become more connected, the attack surface grows with them. AI is reshaping the threat picture as well, and defenders need to understand how to use it to their advantage.
What makes public-private collaboration work? Government needs timely information from industry to act on threats, and operators need usable intelligence in return. Classification, liability, trust, and capacity can all slow that exchange down.
Which policy levers matter most? Good policy can raise the floor for OT security across entire sectors. Poorly coordinated policy can add compliance burden without improving outcomes.
"The problems OT operators face don't change much from one country to the next: legacy systems, stretched security teams, and adversaries who are willing to wait," said Tatyana Bolton, Executive Director of OTCC. "Getting government officials and industry around the same table is how we start closing those gaps, and Singapore was a great place to do it."
Building on the conversation
Many of the issues on the agenda in Singapore point back to a theme OTCC has been raising for some time: the growing patchwork of OT security requirements across sectors and countries. In our position paper, A Unified Approach to OT Cybersecurity, we called on policymakers to recognize ISA/IEC 62443 as the global standard for OT cybersecurity. A shared baseline would make it easier for operators to meet expectations across jurisdictions and for allied governments to work from the same playbook.
Conversations like this one are an important part of getting there. Thank you to the U.S. Chamber of Commerce for partnering with us, and to every official and participant who joined us in Singapore.
This roundtable was held under the Chatham House Rule.
Comments