NIST's draft revision 4 of the Guide to Operational Technology Security updates and expands the original guidance to include sectors such as building automation, water and wastewater, food and agriculture, freight rail, maritime vessels, and the convergence of industrial IoT and cloud. The guide is reorganized around the NIST Cybersecurity Framework 2.0 and includes enhanced recommendations on asset management, network monitoring, security architecture, and zero trust principles. Separately, CISA and FBI released a fact sheet advising critical infrastructure owners and operators to exercise caution when granting access to third-party ICS integrators, recommending strict application of least privilege and contractual cybersecurity requirements. The agencies cited a 2025 intrusion at a US industrial automation solutions company where foreign actors accessed sensitive SCADA and customer data, potentially enabling future disruptive attacks. Recommendations include minimizing remote access exposure, logging access, and ensuring supply chain security controls.

The potential impact includes unauthorized access to sensitive industrial control system data and configurations, which could enable malicious actors to conduct disruptive attacks on critical infrastructure sectors such as power utilities and transportation. The cited intrusion demonstrates that third-party ICS integrators with excessive access can be a vector for compromise, posing risks to operational reliability and safety. The expanded NIST guidance aims to improve OT security posture across multiple sectors by providing updated best practices and aligning with modern cybersecurity frameworks.

The NIST draft guide provides updated security controls and architectural recommendations for OT environments, including zero trust principles and enhanced asset and network monitoring. CISA and FBI recommend applying the principle of least privilege to ICS integrators, granting only the minimum necessary access. Operators should include cybersecurity and supply chain requirements in contracts and service agreements, monitor and log remote access, use on-demand remote access where possible, and reduce exposure by disconnecting devices from public-facing internet connections. These measures help mitigate risks from third-party access and potential supply chain compromises. Since this is guidance and advisory content, no patches are applicable.