Blog
Insights & Resources
Guidance on CMMC compliance, industrial cybersecurity, and OT network protection.
195 articles
CMMCAsset Management
CMMC Requirements for OT and IoT Specialized Assets
CMMC treats OT and IoT as specialized assets. At Level 2 you list them in the asset inventory, the SSP and the network diagram, and show they are managed under your risk-based policies. At Level 3 they are assessed, and an intermediary device can supply the controls they lack.
UtilitiesWater
EPA Cybersecurity Requirements for Water and Wastewater Systems
There is no standalone federal cybersecurity rule for water utilities, but there is an enforceable federal requirement. It lives in the Safe Drinking Water Act, and EPA is enforcing it. Here is exactly what the law asks for and what it does not.
UtilitiesWater
New York DOH Part 5: The Water Cybersecurity Requirements, Explained
New York added cybersecurity requirements to 10 NYCRR Part 5, its drinking water regulation. If your system serves more than 3,300 people, Appendix 5-E applies, and the main operational technology requirements take effect January 1, 2027.
NIS2Compliance
NIS2 Directive Explained: Requirements, Scope, and Who Must Comply in 2026
NIS2 is the EU's cybersecurity law for essential and important entities in 18 sectors. Who must comply, the ten Article 21 security measures, the 24-hour reporting rule, and what it all means for industrial and OT networks.
CMMC
OT vs IT CMMC Controls: Where the 110 Controls Diverge
CMMC applies the same NIST 800-171 controls to IT and OT, but the way you meet them differs. IT enforces controls on the endpoint; OT usually enforces them on the network around the machine.
ICS AdvisoriesOT Security
Protect a SCADAPack x70 RTU With No Patch (ICSA-26-258-04)
CISA's ICSA-26-258-04 covers CVE-2026-81861 in Schneider Electric SCADAPack x70 RTUs: the legacy Secure Lock feature protects passwords with keys built into every device, so anyone who captures an unlock or password change can recover the password. All versions are affected and there is no firmware fix. The fix is configuration, and here is the order to do it in.
ICS AdvisoriesPower Grid
Siemens Reyrolle 7SR5 Relays: What to Do Before You Patch
CISA's ICSA-26-258-05 covers 14 CVEs in Siemens Reyrolle 7SR5 protection relays before V2.70. The most severe, CVSS 9.8, lets an attacker calculate web session IDs and skip the login. Relay firmware takes time to test and roll out, so the first job is to control who can reach the relay's web interface.
Zero TrustCISA
What the New CISA Zero Trust OT Guide Means for On-Premise Deployments
CISA, the Department of War, DOE, FBI, and Department of State published joint Zero Trust OT guidance on April 29, 2026. Three findings matter most for on-premise deployments: agentless network-layer enforcement is endorsed for legacy OT, microsegmentation must operate without redesign, and air-gap alone is called out as a false sense of security.
OT SecurityBuyer's Guide
How to Evaluate OT Security Vendors: A Buyer's Checklist for 2026
Not all OT security products are the same. Some monitor. Some enforce. Some require cloud. Here's a structured framework for evaluating vendors.
Zero TrustNetwork Segmentation
How to Segment a Flat OT Network Without VLANs or Downtime
Your OT network is flat. Everything can reach everything. VLANs require switch reconfiguration, recabling, and downtime. Overlay networking segments the network in software without touching the physical layer.
Network DesignSegmentation
Overlay Networking vs VLANs: A Practical Comparison for OT Segmentation
VLANs require switch reconfiguration, re-cabling, and downtime. Overlay networks deploy on top of your existing infrastructure in a day. Same segmentation result, different effort.
Zero TrustOT Security
Zero Trust for Legacy PLCs: The Lollipop Architecture Explained
Legacy PLCs cannot authenticate users, log sessions, or encrypt traffic. The lollipop architecture puts a proxy in front of each asset, enforcing Zero Trust at the network layer without modifying the device.
›Browse all posts (195)
- CMMC Requirements for OT and IoT Specialized Assets
- EPA Cybersecurity Requirements for Water and Wastewater Systems
- New York DOH Part 5: The Water Cybersecurity Requirements, Explained
- NIS2 Directive Explained: Requirements, Scope, and Who Must Comply in 2026
- OT vs IT CMMC Controls: Where the 110 Controls Diverge
- Protect a SCADAPack x70 RTU With No Patch (ICSA-26-258-04)
- Siemens Reyrolle 7SR5 Relays: What to Do Before You Patch
- What the New CISA Zero Trust OT Guide Means for On-Premise Deployments
- How to Evaluate OT Security Vendors: A Buyer's Checklist for 2026
- How to Segment a Flat OT Network Without VLANs or Downtime
- Overlay Networking vs VLANs: A Practical Comparison for OT Segmentation
- Zero Trust for Legacy PLCs: The Lollipop Architecture Explained
- Agent-Free Zero Trust: Why OT Environments Can't Use Endpoint Software
- Air-Gapped But Not Safe: Misconceptions in Legacy Security
- Air-Gapped vs Layered Security Architectures
- Automating Compliance Monitoring in ICS
- The SCADA You Cannot Patch on Tuesday: AVEVA Enterprise SCADA (ICSA-26-225-01)
- A Key You Cannot Rotate: AVEVA Pipeline Integrity Monitor (ICSA-26-253-01)
- Badge vs Password Why Physical Identity Matters for OT Cybersecurity
- Best Tools for Monitoring Industrial Protocol Security
- Beyond the Acronym How PLCs Became the Backbone of Modern Industrial Automation
- Building a SOC for OT: Tools and Tips
- Building Fault-Tolerant Network Paths in OT
- Building for Scalability in Industrial Networks
- The C3PAO Bottleneck: How to Prepare When There Aren't Enough Assessors
- Centralized Audit Logging for Multi-Site Operations
- Change Management in ICS Environments
- Choosing Between Star and Ring Topologies in ICS
- What the CISA and FBI Fact Sheet on Third-Party ICS Integrators Recommends
- Common Attack Vectors in Legacy ICS
- Common MFA Mistakes and How to Avoid Them
- Common Root Causes of OT Downtime
- How to Connect CNC Machines to Monitoring Software Without Exposing Them
- Creating Standard Operating Procedures for OT Security
- Cybersecurity for Naval Shipboard Systems
- Deep Packet Inspection vs Flow-Based Monitoring What's Best for OT
- Defense Contractor Facility Security: Beyond the Perimeter
- Deploying Firewalls Without Breaking ICS Traffic
- Designing Redundant Communication Paths in OT
- Detecting and Responding to ICS Attacks in Real Time
- Detecting Anomalies in Industrial Protocols
- Dragos 2026 Report: What the 3 New OT Threat Groups Mean for Your Factory
- Cybersecurity in the EPA Sanitary Survey: What to Expect
- Failure Modes in SCADA Networks
- Firewall Placement Strategies for Industrial Networks
- Flat Network vs Segmented Network in Industrial Environments
- From Door to Data How Badge Access Enhances Cybersecurity in Industrial Environments
- HMI Network Isolation Strategies
- How Compliance Can Drive Better OT Security
- How Ewon Remote Access and Talk2M Work
- How Network Changes Affect PLC Performance
- How to Audit Industrial Protocol Traffic Effectively
- How to Benchmark ICS Network Performance
- How to Build a Resilient OT Backbone
- How to Build an Incident Response Plan for ICS
- How to Build an OT Cybersecurity Roadmap for Your Factory
- How to Conduct a Post-Incident Analysis in OT
- How to Configure YubiKey with Trout Access Gate
- How to Correlate Network Traffic and Device Behavior in OT
- How to Detect Anomalies in Modbus and DNP3 Traffic
- How to Enforce East-West Traffic Isolation in OT
- How to Manage Passwords on Hundreds of ICS Devices
- How to Monitor SCADA Network Traffic Without Disrupting Operations
- How to Perform a Risk Assessment on Your OT Environment
- How to Spot Malicious Lateral Movement in OT Environments
- How to Use MITRE ATT&CK for ICS Threat Detection
- ICS vs SCADA Security What You Need to Know
- Implementing Network Traffic Analysis Without Slowing Down Production
- Industrial Malware: Network-Based Detection Strategies
- Industrial Network Topology Discovery and Mapping
- Insider Threat Detection in Manufacturing Environments
- Integrating Sysmon and OT Logging: A Unified View
- Latency Requirements in Industrial Control Systems
- Lateral Movement Detection in Industrial Networks
- Lateral Movement in OT Networks: What It Is and How to Stop It
- What to Do About the lwIP Vulnerabilities in ICSA-26-265-01 and -02
- Maintenance Window Planning for Security Updates
- Mapping OT Controls to NIST SP 800-53
- MFA for Remote Access: VPNs, RDP, and Cloud Portals
- MFA for Service Accounts and Industrial Devices Is It Possible
- Multi-Site OT Security: How to Scale Zero Trust Across 50+ Locations
- Network Security Impact on Real-Time Control Loops
- Network Traffic Baselines Why They're Critical in Industrial Security
- NIS2 Operational Technology: What Manufacturers Need to Know
- NIST Cybersecurity Framework for Manufacturing Systems
- Nozomi Networks vs Access Gate: When Visibility Alone Isn't Enough
- SCADA Security for Oil and Gas Pipelines: Distributed Sites, One Control per Site
- OT-Specific IDS: What to Look For
- Patch Management in Operational Environments
- PLC Explained What Every Manufacturing Professional Should Know About Programmable Logic Controllers
- PLC vs SCADA vs DCS Understanding Industrial Control System Hierarchies
- Port & Maritime OT Security: Protecting Crane Control and Terminal Systems
- Power Grid Substation Security: Zero Trust for Distributed Energy OT
- Protocol Gateways: The Good, the Bad, and the Ugly
- Protocol Whitelisting: How to Reduce Attack Surface in OT
- Proxy-Based Security for OT: Why Proxies Succeed Where Agents Fail
- Rail Signaling Cybersecurity: Protecting Safety-Certified Infrastructure
- Ransomware Targeting Manufacturing in 2026: A 49% Increase and What to Do About It
- Real-Time PLC Data Streaming OPC-UA Modbus and Modern Integration Patterns
- Red Team vs Blue Team Exercises for Industrial Networks
- Redundant Link Design for OT Systems
- Remote Site Deployment Best Practices
- Retrofitting Security Controls in Brownfield Installations
- Routed vs Switched Networks
- Scheduling Maintenance Windows in 24/7 Plants
- Secomea Alternatives: When Remote Access Is Not the Whole Problem
- Secure Commissioning of New ICS Equipment
- How to Secure Remote Access to an HMI
- How to Give Secure Remote Access to a PLC
- How to Secure Remote Access to a SCADA System
- Securing Airport Baggage Handling Systems Without Requalification
- Securing Industrial Ethernet/IP: A Practical Guide
- Securing Legacy Manufacturing Equipment for CMMC
- Securing the IT/OT Boundary: Technical Architecture Patterns
- Security Implications of Using PROFINET in Manufacturing
- Siemens Industrial Edge Management Password Reset Flaw (ICSA-26-265-06)
- Siemens SINEMA and Scalance: What Sits Between Remote Access and Segmentation
- Simulating Cyberattacks on PLCs: Safe Testing Techniques
- Strategies for Enabling Logging in Old ICS Devices
- Talk2M Alternatives: Industrial Remote Access Without a Vendor Cloud
- The Case for Out-of-Band Management in OT
- The Difference Between IT and OT Cybersecurity Explained
- The Difference Between Technical and Administrative Controls in OT
- The Role of Multi-Factor Authentication in OT
- The Role of SIEMs in OT/IT Environments
- Tips for Upgrading Factory Network Infrastructure
- Top 10 Audit-Ready Controls for OT Networks
- Top 5 Benefits of Using Badge Access for ICS and SCADA Terminals
- Top 5 Metrics to Monitor in Industrial Network Traffic
- Top 5 MFA Methods Compared: SMS, TOTP, Biometrics, Hardware Keys & Push Notifications
- Top Frameworks for OT Cybersecurity IEC 62443 NIST and More
- Top OT Cyber Threats in 2026: What to Watch
- Understanding the Costs of MFA in OT and On-Premise Environments
- User Identity and Access in Air-Gapped Environments
- Using NetFlow and Logs for ICS Threat Hunting
- Using SNMP Effectively in OT Environments
- Using Software-Defined Networking (SDN) in OT
- Vendor Access Risks in OT and How to Control Them
- SCADA Security for Water Systems: What a Small Utility Can Do This Year
- What Is Badge Access for Digital Systems A Beginner's Guide for IT and OT Teams
- What Is Network Traffic Analysis A Guide for OT Engineers
- Why Early Detection is Key in OT Security
- Why IT/OT Convergence Fails Without Governance
- Why Jitter Matters in Real Time OT Traffic
- Why Legacy Protocols Pose a Risk in Modern OT Networks
- Windows XP in Industrial Networks: Containment Strategies
- Zero Trust Principles Applied to PLC Communications
- Zero Trust Readiness Checklist for Industrial Environments
- Zero Trust vs Traditional Firewalling: What's More Effective in OT?
- Zone and Conduit Architecture with Modern NAC Solutions
- Zone-Based Firewalling for ICS: Best Practices
- A 9.9 in the Grid's Power-Flow Controllers: Hitachi Energy FACTS (ICSA-26-260-03)
- One FTP Packet Stops the PLC: Schneider Modicon M340 (ICSA-26-260-04)
- The Difference Between Secure Modbus and Modbus TCP
- Why On-Premise OT Security Beats Cloud-Routed Solutions
- A Water Utility Caught CISA's Red Team in Two Minutes. The OT Jump Server Still Fell.
- CMMC vs NIS2: One Compliance Architecture for Both Frameworks
- The True Cost of OT Security: TCO Comparison of Appliance vs Cloud Solutions
- The Last Hop: Carrying CUI From a Cloud Enclave to the Machine That Uses It
- CMMC 2.0: What Manufacturers Need to Know
- CMMC Readiness for Manufacturers After the Suspension
- Introducing Open-CMMC: An Open-Source CUI Enclave for CMMC Level 2
- Preparing for the CMMC 2.0 Compliance Deadline
- IXON VPN Client RCE: When the Remote Access Client Is the Attack Surface
- The ASE2000 Test Set: When IEC 60870-5-104 TLS Does Not Check the Certificate
- Serial-to-IP Device Servers: Four CISA Advisories in Three Days
- Credentials Sitting in Memory: Johnson Controls Simplex Incident Manager (ICSA-26-232-01)
- A CVSS 10 on the Box That Faces the Internet: Haiwell IoT Cloud HMI Gateway (ICSA-26-225-02)
- The Firewall in the OT Rack Is Also Just Software: Siemens RUGGEDCOM APE1808 (ICSA-26-225-06)
- The Access-Control System That Needs Access Control: Johnson Controls C-CURE 9000 (ICSA-26-204-01)
- ABB Ability Zenon's Bundled MongoDB Flaws: What ICSA-26-218-01 Teaches OT Teams
- US Water Utility Cyberattacks in 2026: What Happened and How to Secure OT
- The Affirming Official's False Claims Act Risk in CMMC
- AWIA Risk and Resilience Certification: The Cybersecurity Part
- MFA for PLCs: Meeting CMMC 3.5.3 with a Compensating Control
- CMMC Phase II Suspended: What Actually Changes for Defense Manufacturers
- What's New in Access Gate v26.6
- CMMC Level 2 for Manufacturers: Why VLANs Are Not Enough for Shop Floor OT
- How to Write an SSP Section for a Network with Legacy PLCs
- What a C3PAO Looks for in an OT Environment
- Zero Trust for Air-Gapped OT Networks: What Works and What Doesn't
- Cybersecurity for Police Evidence Systems: Sovereign, Auditable, On-Premise
- AI-Powered Attacks on Industrial Networks: What OT Teams Should Prepare For
- NIS2 Management Liability: Why Executives Are Personally on the Hook
- NIS2 Enforcement Is Live: What Changed and What to Do First
- Securing UAV Ground Stations: MAVLink Vulnerabilities
- GDPR and OT: What Data Privacy Means for Industrial Control Systems
- How Network Traffic Logs Help You Comply with CMMC and IEC 62443
- ICS Honeypots: Revealing Real-World Attacks on Industrial Protocols
- ICS Protocol Deep Packet Inspection: Tools and Techniques
- Layer 2 vs Layer 3 Why Your Network's Broadcast Domains Are Killing Performance
- Lessons Learned from the TRITON Malware Attack
- NIS2 Asset Inventory Requirements What You Need to Track and How to Do IT on Premise
- The Role of Syslog in Meeting CMMC Logging Requirements
- Zero Downtime Deployment Techniques for Industrial Networks