Last month, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”), in partnership with the Federal Bureau of Investigation (“FBI”), National Security Agency, Environmental Protection Agency, and cybersecurity authorities in Australia, Canada, Germany, Netherlands, and New Zealand, published new cybersecurity guidance (the “Guidance”) related to operational technology (“OT”), i.e., systems and devices that interact with a physical environment that are commonly used in manufacturing, utilities, oil and gas production, transportation, and other industrial operations.  The Guidance, which will be of interest to any organizations that have an OT environment, is intended to help critical infrastructure entities develop and implement an OT asset inventory and taxonomy to protect their critical assets and improve incident response preparedness.  It comes in advance of upcoming cyber incident reporting requirements for critical infrastructure in the U.S. under the Cyber Incident Reporting for Critical Infrastructure Act (“CIRCIA”) and in the EU under the revised Network and Information Systems Directive (“NIS2 Directive”).  The Guidance is the latest in a series of joint releases from CISA, FBI and other U.S. and international partners on various security-related topics largely intended for critical infrastructure, including AI data security, product security bad practices, quantum computing cyber threats, and secure software development.

Overview

The Guidance builds upon previous CISA guidance that promulgated a set of 38 voluntary Cybersecurity Performance Goals (“CPGs”), which are intended to establish a set of fundamental cybersecurity practices for critical infrastructure owners and operators.  In particular, the first CPG (“1.A”) recommends that organizations maintain a regularly updated inventory of all IT and OT assets.  The Guidance notes that these OT assets – such as industrial control systems, process automation equipment, and other cyber-physical systems – are vital to critical infrastructure services and frequently targeted by malicious threat actors seeking to destroy, disrupt, or otherwise exploit them.  Common examples include the exploitation of:

• Vulnerabilities in flawed or outdated software/firmware to gain access to OT systems;
• Weak authentication mechanisms to gain unauthorized access to OT systems;
• Insufficient network segmentation to move laterally from IT to OT environments and between OT systems;
• Insecure OT protocols to intercept communications, inject malicious commands, and disrupt or manipulate industrial processes; and
• Insecure remote access points to gain access to OT systems, allowing for lateral movement or for command and control.

Accordingly, the Guidance provides practical steps to implement CPG 1.A and develop an accompanying OT taxonomy that organizes and prioritizes OT assets to enhance organizations’ risk identification, vulnerability management, and incident response.  The Guidance also includes three “conceptual taxonomies” for the Oil and Gas, Electricity, and Water and Wastewater sectors to help organizations conceive and develop their own taxonomies.  Critical infrastructure owners and operators are also invited to provide feedback on the Guidance and recommendations for future guidance via CISA’s anonymous product survey.

Steps to Develop an OT Asset Inventory and Taxonomy

The Guidance highlights the inherent challenges in maintaining an updated OT asset inventory, since OT environments often contain diverse systems, such as specialized devices, sensors, and instrumentation, as well as legacy systems, which often use unique and proprietary communication protocols.  The Guidance helps owners and operators address this complexity by providing a step-by-step process to create an OT asset inventory and taxonomy.

1. Define Scope and Objectives
   • Define governance over asset management, including offices/positions responsible for establishing and maintaining the inventory.
   • Assign roles and responsibilities for collection and validation of data necessary for inventory development and maintenance.
   • Define the scope of the program (e.g., specific zones, facilities, systems), a development timeline, and what constitutes an OT asset.
2. Identify Assets and Collect Attributes
   • Gather detailed digital- and network-based information about system components—including by conducting a physical inspection where necessary for certain OT assets—and compile a comprehensive list of all OT assets and network infrastructure dependencies.
   • Collect asset attributes to describe each asset and prioritize the collection of high-priority attributes.  Recommendations for attributes are provided in Appendix A of the Guidance.
3. Create a Taxonomy to Categorize Assets
   • Classify assets based on their criticality (i.e., importance to the organization’s operations, safety, and mission) or function (i.e., roles or exposure within the OT environment).
   • Categorize and organize assets and their communications pathways, for example, into “zones” that group assets with similar security requirements and “conduits” consisting of communications assets that ensure only authorized data can pass between zones.
   • Organize the overall structure of the environment and relationships between assets.
   • Validate and visualize your inventory, such as with tables and diagrams, to show asset categories (e.g., zones and conduits), relationships, and dependencies.
   • Periodically review and update the taxonomy to reflect changes and gather feedback from stakeholders
4. Manage and Collect Data
   • Identify additional sources of data for each asset that may enhance the inventory and consider whether to include them.
   • Establish and secure a centralized asset management database/system to store and manage additional asset data.
5. Implement Life Cycle Management
   • Define the stages of each asset’s life cycle (e.g., acquisition, deployment, commissioning, maintenance, and decommissioning).
   • Develop policies for managing asset life cycles (e.g., maintenance schedules, replacement plans, and backup strategies) in accordance with change management processes.

The Guidance also provides recommendations for owners and operators to leverage their OT asset inventory and taxonomy after following these steps, including for risk and vulnerability management, system maintenance, performance monitoring, training, and continuous improvement.

Looking Ahead

The Guidance is beneficial for any organizations that maintain OT, but it is particularly important for covered entities required to report cyber incidents under CIRCIA in the U.S. and NIS2 Directive in the EU.  Both laws require a wide range of critical infrastructure entities (or “essential” and “important” entities under the NIS2 Directive) to report “significant” cyber incidents, which can include both IT and OT incidents, even without any impact to data.  Accordingly, covered entities, even those that are already required to report data breaches, will need to prepare for new, far-reaching notification obligations that will require them to not only have visibility over their OT assets, but also the capability to determine whether a cyber incident that impacts those assets is “significant” for purposes of CIRCIA and the NIS2 Directive.  The Guidance also reinforces the importance that CISA and other cyber regulators have placed on OT and signals an emphasis on overall cybersecurity governance, including involvement from senior leaders and legal and improving overall visibility, including by eliminating information silos between IT and OT system owners.