The conventional wisdom
When nation-state actors target critical infrastructure, the immediate response from industry coalitions is predictable: call for federal mandates. The Operational Technology Cybersecurity Coalition's recent push for CISA to issue binding operational directives follows this pattern. After Iran-linked attacks hit water utilities in Minnesota and at least seven states, OTCC Executive Director Tatyana Bolton argued for mandatory controls across thousands of federally owned facilities, stating "there are baseline controls that are not optional."
This isn't wrong. It's just insufficient.
The standard playbook assumes regulatory pressure creates security. Issue a directive, define minimum controls, enforce compliance. Asset inventory, network visibility, microsegmentation, secure remote access. Check the boxes, file the attestation, move on.
Why it's incomplete
Here's what the "mandate baseline controls" approach misses: your OT environment was already supposed to be secure under existing frameworks. NIST SP 800-82 has covered industrial control systems since 2011. ANSI/ISA-62443 provides sector-agnostic OT security standards. NIST Cybersecurity Framework (CSF) 2.0 explicitly addresses OT environments. The North American Electric Reliability Corporation Critical Infrastructure Protection standards have been mandatory for electric utilities for years.
Minnesota has more than 1,000 water systems. How many do you think were waiting for CISA to tell them that internet-exposed programmable logic controllers with default credentials are a bad idea?
The problem isn't lack of regulatory clarity. It's that organizations treat OT security as a compliance exercise rather than an operational imperative. A binding directive from CISA won't change that mindset. It'll just create another checklist to satisfy during the next audit while the PLCs remain accessible from the public internet.
The evidence
The FBI and EPA joint statement described the attack pattern: actors remotely accessed internet-facing devices, changed IP addresses and passwords, and caused loss of monitoring and control functionality. Their recommendation? Remove PLCs from direct internet exposure and access them via secure gateways and firewalls.
This isn't novel guidance. It's Network Segmentation 101. If you're running critical infrastructure and your control systems are directly internet-accessible, you don't need a federal directive. You need to ask why your organization ignored every OT security framework published in the last decade.
Consider what "asset inventory and persistent visibility" actually means in practice. You can't protect what you don't know exists. But here's the uncomfortable truth: most organizations with OT environments don't maintain accurate inventories because doing so requires operational discipline, not regulatory pressure. You need someone who understands both the industrial process and the network architecture. You need configuration management that survives shift changes and contractor rotations. You need documentation that reflects reality, not what was true when the system was commissioned.
A CISA directive can mandate that you document your assets. It can't make you care enough to keep that documentation current.
What to do instead
Stop waiting for regulators to force you to do what you already know you should do.
Start with the threat model, not the compliance requirement. Nation-state actors targeting water utilities aren't looking for sophisticated zero-days. They're exploiting internet-exposed PLCs with weak authentication. The attack surface is embarrassingly basic.
Your first action isn't implementing microsegmentation. It's answering this question: which of our OT assets are directly accessible from the internet right now? Not according to the network diagram from 2019. Right now. Use Shodan, use your own scanning tools, but get the actual answer.
Second, implement network segmentation that reflects operational boundaries. Your SCADA network shouldn't share infrastructure with your corporate IT environment. Remote access to control systems should route through jump servers with multifactor authentication and session logging. If you're using VPNs, they should terminate in a DMZ, not directly on the control network.
Third, treat secure remote access as an operational control, not an IT service. When field technicians or vendors need access to PLCs, they shouldn't be punching holes in your firewall. Implement Just-in-Time Access with time-limited credentials. Every session should be logged and reviewable.
Fourth, build asset inventory as a continuous process, not a compliance deliverable. Your OT environment changes when someone swaps a failed controller or adds a sensor. If your inventory process can't capture those changes within 24 hours, it's not an inventory system. It's historical fiction.
Finally, recognize that OT security requires different skills than IT security. You need people who understand industrial protocols, operational requirements, and the physical processes being controlled. Hire them. Train them. Give them authority to say no when someone wants to connect a new device to the control network.
When the conventional wisdom is right
Bolton's call for mandatory directives isn't entirely misguided. Federal mandates do establish a floor. They create budget justification for security investments that might otherwise lose out to operational priorities. When CISA issues a binding operational directive, it gives you leverage to tell leadership: "This isn't optional anymore."
The reauthorization of the Cybersecurity Information-Sharing Act of 2015 matters. Legal protections for sharing threat intelligence help organizations learn from each other's incidents without fear of regulatory exposure. When one water utility gets compromised, others need to know the tactics, techniques, and indicators of compromise.
Regulatory pressure also helps with the fragmentation problem. Minnesota's more than 1,000 water systems represent 1,000 different security postures, 1,000 different budget constraints, 1,000 different risk tolerances. A federal baseline creates consistency that makes the entire sector more defensible.
But here's the distinction: regulation establishes minimum expectations. It doesn't create security culture. It doesn't build operational discipline. It doesn't make your team care about keeping the asset inventory current or reviewing remote access logs.
If you're waiting for CISA to mandate what NIST SP 800-82 and ANSI/ISA-62443 already recommend, you're not managing risk. You're managing compliance theater. And the next time nation-state actors scan for internet-exposed PLCs, your compliance attestation won't stop them from finding yours.
