What Can Be Done Immediately to Improve Your OT Security Posture

This advisory recommends practical near-term and six-month actions to strengthen ICS/OT cybersecurity amid concerns about state-sponsored cyber activity. It stresses that OT incident response must pair security teams with local engineering, calls for focused monitoring of OT and corporate-OT communications (including remote access and native Windows protocols), and urges accurate asset inventories, Purdue/ISA-based segmentation, an ICS/OT DMZ with a deny-all/allow-by-exception policy, safety system segmentation, east/west traffic monitoring, and logging/monitoring mapped to MITRE ATT&CK for ICS.