According to the Operational Technology Cybersecurity Coalition (OTCC), OTCC brings together critical infrastructure experts and stakeholders from industry and government. On Oct. 6, 2026, OTCC published a whitepaper entitled “Know It. Control It. Contain It. A Binding Operational Directive for OT Cybersecurity.” The whitepaper states that blatant adversary pre-positioning in our critical networks has opened a rare, urgent window of opportunity and calls on CISA to establish cybersecurity requirements for OT. That’s good, as far as it goes, but it’s important to remember that securing critical infrastructure means more than merely securing OT networks.

Critical infrastructure experts should be expected to know that critical infrastructure consists of more than OT networks. Critical infrastructures include pumps, valves, motors, turbines, condensers, protective relays, transformers, process sensors, actuators and other engineering devices and systems.

Yet OTCC's recommendations reflect a network security-centric approach that fails to adequately address what makes control systems unique: the physical equipment and processes. Despite their direct impact on the safety, reliability and operation of critical infrastructure, control system field devices and equipment are not addressed in the OTCC whitepaper. How can a report calling for cybersecurity requirements for critical infrastructure be credible if it fails to address the security and integrity of the equipment that makes infrastructure work?

Many control system field devices lack such cybersecurity capabilities as authentication, measurement integrity validation, security logging and cyber forensics. Consequently, conventional network security requirements alone cannot adequately protect them. Failures or compromises involving these devices can directly cause equipment damage, unsafe operating conditions and deaths.

Process sensors are a particularly critical concern. Controllers and operators trust process sensor measurements, without independently validating their accuracy or integrity. The sensor integrity problem extends well beyond digital communications. Sensors can provide incorrect measurements because of equipment failures, calibration problems, physical manipulation or compromised configurations. Without independent validation, controllers and operators may act on incorrect process information, potentially causing unsafe conditions or physical damage.

Get your subscription to Control's tri-weekly newsletter.

A compromised OT network does not necessarily mean that the control system or physical equipment have been compromised. Conversely, control systems and physical equipment can be compromised or damaged without the OT network itself being compromised. Protecting OT network communications alone therefore cannot ensure the integrity, safety, or reliability of physical processes.

Failing to address the control system device security gap risks creating a false sense of security. CISA's binding operational directives must address both OT network security and the integrity and security of control system equipment and field devices. This requires engineering measures that validate process measurements and control actions, identify discrepancies between reported values and actual physical conditions, and provide independent situational awareness when conventional control system information cannot be trusted.

I recommend explicitly distinguishing among three requirements in any proposed CISA directive:

1. OT network security: Protect communications, connections, access and network infrastructure (included in the current OTCC document).
2. Control system device security: Address the security limitations of process sensors, actuators, controllers, protective relays and other engineering equipment (not addressed in the OTCC document).
3. Independent process-integrity validation: Establish whether reported measurements and control system indications accurately represent actual physical conditions (not addressed in the OTCC document).

The third requirement is especially important. A process sensor can report an incorrect value over a perfectly secure network, and a network-monitoring tool has no capability to identify that the reported value is wrong. CISA's directives must address all three requirements. Otherwise, critical infrastructure could satisfy network security requirements while remaining vulnerable to the physical consequences that OT cybersecurity is supposed to prevent.