Ampyx Cyber Blog
The Intersection of Resilience & Regulation
AI-Built Exploits Are Probing Siemens S7 PLCs
Joint advisory AA26-231A warns that threat actors are using artificial intelligence (AI) to build tools that probe Siemens S7 programmable logic controllers (PLCs) across U.S. critical infrastructure. This post walks through the techniques the agencies describe and the hardening steps they recommend.
Would an OT Directive Make CISA an OT Regulator?
A new coalition paper asks the Cybersecurity and Infrastructure Security Agency (CISA) to issue a Binding Operational Directive (BOD) for operational technology (OT). It would bind federal civilian agencies only, and an Inspector General audit found CISA can't enforce BODs even there. Here's what a directive can reach, how one travels anyway, and what utilities should watch.
One Incident, Several Reports: What GAO's Panel & CISA's Town Halls Say About Harmonization [Updated]
A single cyber incident at a utility can owe reports to several federal agencies, each with its own clock and definition. The Government Accountability Office's latest panel heard that again, and electric, gas, oil, and water groups told the Cybersecurity and Infrastructure Security Agency the same thing in June. This post looks at where the overlap sits and where the reporting rule stands.
An ERO for Water: What H.R. 2594 Borrows From NERC, and What It Leaves Behind [Updated]
Water utilities in at least seven states reported cyber incidents this summer, and Congress now has two answers that point in opposite directions. One bill gives EPA direct authority. The other certifies a sector-led body to write and enforce the requirements, modeled on the electric sector. A close read of what H.R. 2594 borrows from the Federal Power Act, where it departs, and what twenty years inside that model cost.
Cyber on Tap, Part Two: New York's Water Cybersecurity Regulation Is Now in Force
New York's Appendix 5-E cybersecurity regulation for public water systems took effect March 11, 2026, making it the first mandatory, enforceable water cybersecurity framework in the country. This post covers who is in scope, what is required, when it is due, and what resources are available to help. It also examines what New York's action means in the context of a federal policy environment that is actively stepping back from sector-specific cybersecurity regulation.
Cyber on Tap: NY's Water Utilities Face New Cyber Rulebook
New York has proposed the first mandatory cybersecurity regulation for water and wastewater systems, targeting utilities serving over 3,300 people. With requirements for vulnerability assessments, incident reporting, and executive oversight, this rule signals a shift toward enforceable cyber resilience and other states may soon follow.
There is a better way to do this: why critical infrastructure cybersecurity regulations are heading in the wrong direction
I helped write and establish the NERC CIP regulations. But now I want change. There is a way to save time, money and headaches while actually improving security for critical infrastructure.
Should the water sector follow the cybersecurity path of NERC CIP?
Water is essential for life – in so many ways. It’s so essential, we should do whatever is necessary to have a safe, reliable, and secure water/wastewater system, right? But from what I have seen both personally and in many public reports, we’re far from it. So, what is necessary to secure the water sector in the US?
What's next for industrial supply chain security?
Critical infrastructure needs to focus on supply chain security. Watch this interview with Ampere's Patrick C. Miller about what is next and how to prepare.
The new National Security Memorandum on industrial security: What does it mean for me?
What do you need to know now that the White House has issued its National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems? Watch this interview with Ampere Industrial Security's Patrick Miller.