There are systems behind our regular schedules that make it possible for power to run, water to flow, and traffic to keep moving. These are called operational technology (OT). They are computers that operate machines in the physical world. In February 2026, CISA issued guidance for securing decades-old systems. The problem is, how do you protect a machine that was made before the Internet? Let’s find out.
Why OT communication needs a security upgrade
Each day, billions of messages move throughout OT networks. These are the unseen discussions that occur amongst sensors, control systems, and operators that enable essential services to function effectively. However, the issue at hand is that the majority of these systems were designed and implemented when cyber threats were seen as mythological, and trust was taken for granted.
Suppose an impersonated communication signal sent an order for a power system shutdown, not as a result of full hacking, but rather because there was no check or verification of the communication’s origin.
This is exactly what CISA’s recent guidance aims to mitigate. Many of the older industrial protocols still use legacy protocols, which do not have basic features such as authentication or message integrity, which means that an attacker can masquerade as other devices or possibly change messages without being noticed.
Where old technology meets new challenges head-on
Most OT networks are comprised of older protocols that were created for speed and reliability rather than security as their primary objective. OT network systems were primarily developed to allow similar machines to operate in a rapid manner, rather than providing an effective means to mitigate a cyberattack.
Although secure protocol versions have existed for many years, they are frequently not implemented due to high prices, lack of ease of use, or additional delay introduced into OT systems.
Understanding what CISA’s new guidance really means for cybersecurity
CISA’s guide, “Barriers to Secure OT Communication: Why Johnny Can’t Authenticate,” attempts to understand what has led to a slow adoption of secure communications in OT environments. This guide not only provides a list of issues but also draws on actual operator experiences across the water, transportation, energy, and agriculture sectors, as CISA sunsets 10 emergency cyber directives.
The document’s main focus is on describing some of the difficulties organizations face when adopting secure industrial protocols. This includes how difficult it can be for an organization to determine whether they are signing data or encrypting data; the amount of time and money allocated to updating old legacy hardware, etc.
CISA provides practical recommendations instead of simply saying to “secure everything.” Practical steps are provided for both owners/operators and manufacturers who manufacture secure equipment, for example, purchasing secure communications features on newly purchased equipment or developing products that are less costly and easier to secure.
The end goal of the document is to provide ways for operators to start implementing secure OT communication in less overwhelming, more actionable terms, and in a manner that will have minimal effects on their normal day-to-day operations, just as the cybersecurity agency accelerates post-quantum encryption adoption.
Why is this now more than ever relevant to you and everyone else?
OT security may not be at the forefront of your mind every minute of every day, but there will be times throughout each year when you will feel the repercussions of an incident and disruption, e.g., transportation, hospitals, food chain, etc., that occurs as a result of a power failure from an OT breach.
CISA’s guidance represents a meaningful advance in creating a safer and more resilient planet, a place that does not allow critical infrastructure to be subject to obsolete forms of trust or unintentional exposure to weaknesses.
CISA’s guidance on securing OT communication can be seen as a technology-oriented policy, although, from an overall perspective, it is very much about ensuring the safety of the systems that support our everyday lives, leading to new security standards that are mandatory for all devices.
Through addressing several of the real-world obstacles facing operators today, such as cost, complexity, and aging infrastructure, CISA’s new guide provides the operators of industrial networks with a means to improve the safety, reliability, and preparedness of their facilities for the future.
