Would an OT Directive Make CISA an OT Regulator?
By Patrick Miller
A new coalition paper asks the Cybersecurity and Infrastructure Security Agency (CISA) to issue a Binding Operational Directive (BOD) for operational technology (OT). It would bind federal civilian agencies only, and an Inspector General audit found CISA can't enforce BODs even there. Here's what a directive can reach, how one travels anyway, and what utilities should watch.
Overview
On October 6, the Operational Technology Cybersecurity Coalition (OTCC) published a short paper asking the Cybersecurity and Infrastructure Security Agency (CISA) to issue a Binding Operational Directive (BOD) dedicated to operational technology (OT). Since then I've been getting some version of the same question, mostly from utilities. Does this mean CISA is about to start regulating OT? The short answer is no, at least not directly, and probably not anytime soon. The longer answer has a few more turns in it, and I think it's the one most people asking actually need.
The paper asks CISA to require Federal Civilian Executive Branch (FCEB) agencies to name a senior official or office accountable for OT, bring OT risk into their enterprise risk management, enforce earlier directives that already touch OT, and prioritize a set of CISA's Cross-Sector Cybersecurity Performance Goals (CPGs) such as changing default passwords, multifactor authentication, segmentation, and system backups. The CPGs trace back to the 2021 national security memorandum on control systems, and we looked at the 2.0 revision when it came out in December 2025. The paper positions the directive as the preventive half, coupled with CISA's CI Fortify resilience initiative as the other half. I don't think many OT people would argue with the controls on that list. The questions I'm getting are about reach, so I figured it was worth digging into and explaining.
What a Binding Operational Directive Can Reach
BOD authority comes from the Federal Information Security Modernization Act (FISMA), which lets the Secretary of Homeland Security develop and oversee binding operational directives "to agencies" under 44 U.S.C. § 3553(b)(2). The same section carves out national security systems and certain Department of Defense and intelligence community systems, and CISA's directives page says the same thing in plainer language. CISA also publishes the list of agencies that fall under its authorities, and the Department of Homeland Security (DHS) Office of Inspector General (OIG) counted 102 of them in its most recent audit. Investor-owned utilities, municipals, and cooperatives aren't on it, and neither is any water system, pipeline, or chemical plant. A BOD can't reach them directly. Their cyber obligations come from the same places they came from before, which for the bulk electric system means North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards under section 215 of the Federal Power Act, and for a lot of other OT sectors means whatever their sector regulator requires, which in some cases isn't much (or anything at all). Water is the clearest example, and Congress is currently looking at two bills that would answer that in opposite ways. The paper acknowledges all this itself, noting that private and local entities aren't required to implement BODs.
None of this means the federal problem the paper describes isn't real. The Government Accountability Office (GAO) found in GAO-26-108937, published September 30, that only 7 of the 22 civilian agencies it reviewed had fully addressed the Office of Management and Budget (OMB) requirements for networked device inventories, which cover Internet of Things (IoT) and OT devices in buildings, labs, and similar facilities. Those requirements were set in December 2023 and updated in January 2025. One detail I noticed is that GAO directed its recommendation to OMB, to issue updated guidance and oversee implementation. The coalition is asking CISA to take that job on through a directive.
What "Binding" Means in Practice
Even inside the federal government, a BOD has less force than the name suggests. On September 21, the DHS OIG published OIG-26-30, an audit of BOD 25-01, the December 2024 directive on secure configurations for cloud services. By the June 20, 2025 deadline, 88 of the 102 agencies hadn't implemented all of the mandatory policies, and as of February 12, 2026, 78 still hadn't. OIG notes that noncompliance can be escalated to OMB and reported through the annual FISMA metrics, but the report's background section is direct about the limits.
The report goes on to say FISMA doesn't give CISA the authority to enforce FCEB compliance, and that CISA's role is limited to developing policies, helping agencies implement them, and reporting on how well they follow them. OIG made no recommendations because of that limitation, and CISA declined to comment. I don't really read that as a criticism of CISA. It's how the statute was written.
The gap has been noticed before, and the first time it was about control systems. OIG-26-30 cites two earlier reports on DHS's lack of enforcement authority. The first, OIG-09-95 from August 2009, looked at DHS's control systems security work, then run by the National Cyber Security Division. It found that the division's vulnerability assessment program for control systems owners was voluntary, and that the division "does not have the authority to require assessments or the implementation of recommendations." That finding was about private owners, not federal agencies, so it's a different gap from the one in the cloud audit. Seventeen years later, CISA's main OT initiative of 2026, CI Fortify, is still guidance it urges operators to adopt. CISA's mandatory reach into private OT has always been narrow. The Chemical Facility Anti-Terrorism Standards (CFATS) program did require high-risk chemical facilities to meet security standards that included cyber, and Congress let it lapse in July 2023. Incident reporting under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) is the other one, and it governs what you report and when, not how your OT is secured. We covered where that rule stands on October 1. So CISA can't compel the agencies it covers to finish a directive that's called binding, and outside those two programs it hasn't had authority to require much of private OT owners at all. That's more or less the first half of the answer to the question I keep getting.
The Evidence Points Outside the Scope
The paper opens with the July and August attacks on water systems, and I understand why. When it updated its exposure-reduction guidance in August, CISA said it observed malicious activity targeting more than 100 internet-exposed water and wastewater systems in July 2026, commonly through programmable logic controllers (PLCs) connected directly to cellular modems. That's a count of systems targeted, not utilities compromised. A cellular path into OT is something we've seen before, in a different form, in the second Polish plant attack. ABC News, citing multiple sources, reported incidents in at least a dozen states. These were community and municipal systems, though, not federal ones. CI Fortify, which the paper pairs its directive with, was released on May 5 as guidance for critical infrastructure entities across all sectors. So the justification is drawn almost entirely from outside the FCEB, but what’s being recommended would only apply inside it.
I think the paper is fairly open about why. It describes a BOD as "a strong demand signal" to private, state, and local infrastructure about what the government considers good practice. That's the coalition's expectation, and I wouldn't read anything more into it than that. It's also the thing people are asking me about, so the next question is how a directive actually travels.
How Federal Directives Travel Anyway
The best recent example is BOD 26-04, Prioritizing Security Updates Based on Risk, issued June 10. It replaced the older patching directives with a risk-based model whose shortest remediation window is three days. The directive says it doesn't apply to contractors unless the governing procurement contract says so, but that agencies "must review all contracts to determine what modifications are necessary" to comply. That one sentence is how a federal-only directive ends up in a vendor's statement of work. In CISA's announcement, the acting director also encouraged all partners, not just agencies, to adopt similar actions in their own vulnerability management. I've seen a lot of programs outside the federal government start prioritizing off the Known Exploited Vulnerabilities (KEV) catalog, which CISA set up in 2021 under BOD 22-01, without anyone requiring them to. The usual rule is that if something is reachable from any external network and it's on the KEV, it gets patched as soon as possible. That's probably the clearest case I know of a directive traveling with no contract involved at all.
The other route is softer and probably slower. A federal baseline no one is required to follow still tends to be part of the question set after an incident. When an operator gets asked why something wasn’t done, “it was only guidance” doesn’t usually carry much weight, and I’d expect a federal OT directive to get used the same way on everyone else.
The three-day window is where I'd expect the most friction if any of this reaches OT through a contract. For the electric sector, CIP-007-6 has it's 35-day eval and patch application windows, but a lot of that time goes to testing on systems that can't simply be rebooted.
A Note on Federal Power
The one place in the electric sector where an OT directive would apply directly is the federal power fleet. The Tennessee Valley Authority (TVA) is on CISA's agency list, and so are the Department of Energy, which includes the power marketing administrations such as the Bonneville Power Administration (BPA) and the Western Area Power Administration (WAPA), and the Department of the Interior, which includes the Bureau of Reclamation. These are NERC-registered entities already. The Federal Energy Regulatory Commission (FERC) held in 2009 that federal entities that use, own, or operate the bulk-power system must comply with Reliability Standards, and in 2014 the D.C. Circuit held in Southwestern Power Administration v. FERC that they can't be fined for violations, in a case that started with a CIP penalty. You can see what that looks like in enforcement. In one TVA notice of penalty, SERC Reliability Corporation said it would have assessed $852,000 but proposed no monetary penalty because it's bound by that ruling. An OT directive would add a second mandatory program on the same assets, with its own scoping and its own reporting, and as OIG-26-30 shows, no penalty behind that one either. The Army Corps of Engineers isn't on CISA's list. The Corps runs its control systems, hydropower first among them, under Department of Defense and Army requirements through a dedicated center established by ER 25-1-113, which also tasks that center with coordinating the defense Risk Management Framework with NERC CIP compliance. So the federal hydro fleet would split under a directive like this one, with some plants covered and some not, and NERC CIP over all of them.
What Non-Federal Utilities Should Watch
For investor-owned utilities, municipals, and cooperatives, I'd watch contracts before regulations. If you operate or support OT on behalf of a federal agency, or your vendors and integrators do, the governing contract is where a directive's requirements would arrive, and BOD 26-04 already shows the mechanism. It's also probably a good use of an afternoon to compare the CPGs the paper prioritizes against your existing CIP program and your non-CIP OT. Most CIP entities will find a lot of overlap, and the gaps will mostly sit in the assets CIP never reached, which is where an OT risk management program you can defend does most of its work. If you're outside the electric sector, in water or elsewhere, there's less between you and the recommendations, so a federal baseline like this one is more likely to become the reference point someone holds you to after an incident.
So does an OT directive make CISA an OT regulator? No, not by itself, and not for anyone outside the federal government, as far as I can tell. The more likely effect is that its baseline shows up in contracts and in post-incident reviews over the next few years, which is roughly how earlier directives have spread, more or less.
