CISA Releases Secure Connectivity Principles Checklist for OT Network Connections

The US Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with international cybersecurity partners, has released a comprehensive guide outlining eight critical principles for securing Operational Technology (OT) network connections.

The guidance, developed jointly with the UK’s National Cyber Security Centre (NCSC), Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security, FBI, Germany’s BSI, Netherlands’ NCSC-NL, and New Zealand’s NCSC-NZ, addresses the growing cybersecurity risks facing industrial control systems and critical infrastructure.​

As OT environments become increasingly interconnected to enable real-time analytics, predictive maintenance, and remote monitoring, they face heightened exposure to both opportunistic cybercriminals and sophisticated state-sponsored threat actors targeting critical national infrastructure.

CISA guidance emphasizes that cyber intrusions in OT environments can lead to physical harm, environmental damage, or disruption of essential services.​

The framework provides principles-based goals for operators of essential services, system owners, and device manufacturers to design, implement, and manage secure OT connectivity for both new and existing systems.

These principles are intended as desirable end-states rather than minimum requirements, allowing organizations to adapt controls based on their operational constraints and threat context.​

Organizations are advised to prioritize implementation based on several factors, including the role and impact of devices on operations, the presence of fail-safe systems, implementation complexity and cost, and active threat activity, taking into account geopolitical events.

The guidance explicitly addresses challenges posed by legacy technologies that were never designed for modern connectivity requirements, as well as the expanding attack surface created by third-party vendors and supply chain integrations.​

Principle	Key Requirements
1. Balance the Risks and Opportunities	Document formal business case for all OT connectivity; assess requirement, business benefit, risk tolerance, potential impacts, introduced dependencies, and senior accountability​
2. Limit the Exposure of Your Connectivity	Adopt exposure management approach to identify and mitigate risks; limit admin interfaces to privileged access workstations (PAWs); use just-in-time access where possible​
3. Centralise and Standardise Network Connections	Consolidate access points and enforce uniform security controls; ensure connectivity is flexible, repeatable, and categorized​
4. Use Standardised and Secure Protocols	Default to latest secure versions of industrial protocols (DNP3-SAv5, CIP Security, Modbus Security, OPC UA); enable schema-based protocol validation at trust boundaries​
5. Harden Your OT Boundary	Deploy modern, modular boundary assets with Layer 7 inspection; implement defense-in-depth approach; ensure boundary devices are not obsolete and routinely updated​
6. Limit the Impact of Compromise	Implement zoned/segmented network architecture with micro-segmentation; separate duties across systems and users; apply browse down principle for administration​
7. Ensure All Connectivity is Logged and Monitored	Implement comprehensive logging and monitoring throughout OT environment; establish baseline of normal activity for anomaly detection​
8. Establish an Isolation Plan	Develop site-specific and large-scale isolation plans linked to business continuity; regularly test isolation procedures; identify critical data flows requiring exemptions​

The guidance specifically warns that obsolete products compound security problems by no longer receiving security updates, lacking latest security mitigations, and requiring unmanageable compensating controls.

Organizations are advised to treat obsolete products as untrusted and establish timelines for asset replacement, viewing segmentation as only a temporary measure.​

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.