| The Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre, in collaboration with other federal and international partners, have released Secure Connectivity Principles for Operational Technology guidance to help asset owners address increasing business and regulatory pressures for connectivity into operational technology networks. |
| Operational technology (OT) environments – which have long been centered on safety, uptime, and operational continuity – are now more interconnected than ever. Driven by the need for increased efficiency, agility, and integration, these advancements offer significant operational benefits (such as real-time analytics, predictive maintenance and remote monitoring & administration), but they also introduce risks. |
| Organizations deploying or operating OT systems often face challenges in prioritizing cyber security due to operational constraints, such as dependence on legacy technologies that were never designed for modern connectivity or security requirements. These challenges are compounded by the increasing use of third-party vendors, remote access solutions and supply chain integrations, all of which expand the potential attack surface. In an OT environment, risks are elevated since a cyber intrusion can lead to physical harm, environmental impact, or potentially the disruption of an operator of essential service (OES). |
| Exposed and insecure OT connectivity is known to be targeted by both opportunistic and highly capable threat actors. This activity includes state-sponsored actors actively targeting critical national infrastructure (CNI) networks. The threat is not just limited to state-sponsored actors with recent incidents showing how exposed OT infrastructure is opportunistically targeted by hacktivists. Strengthening the cyber security of CNI, including securing OT connections, can challenge attackers’ efforts and raise the threshold necessary to cause physical harm, environmental impact, and disruption. |
| System owners should use the listed principles as a framework to design, implement, and manage secure OT connectivity, for both new and existing OT systems. These principles are particularly critical for operators of essential services. |