Presidential Policy Directive 21 named 16 critical infrastructure sectors as the backbone of American life — energy, water, healthcare, transportation, and more. FEMA calls the most essential of these “community lifelines,” because when they fail, everything downstream fails with them. Increasingly, what stands between a functioning lifeline and a public health emergency is a small industrial computer most people have never heard of.
That’s operational technology, or OT — the systems that physically run our infrastructure. Where information technology (IT) manages data, OT manages the physical world: a pump station’s flow rate, a substation’s breaker, a treatment plant’s chlorine dose. For decades, these systems sat on proprietary protocols in air-gapped networks, cut off from the internet and largely safe from it. That world is gone. Modern OT increasingly runs on the same networking as everything else due to convenience and standardization under IT departments; thus making every connected component is a potential doorway.
OT IS EVERYWHERE, AND MOST OF IT IS OLDER THAN YOU THINK
OT isn’t just water. SCADA systems run electric substations and gas pipelines. PLCs open floodgates, mix chemicals, and run assembly lines. Distributed control systems manage refineries. Building automation runs HVAC and access control at hospitals and airports. Traffic signal controllers and rail signaling move millions of people a day. Energy, water, oil and gas, manufacturing, healthcare, transportation — every one of these sectors runs control hardware that was built to operate offline and isolated, and is now, often reluctantly, connected to a network anyway.
That hardware doesn’t get replaced on an IT refresh cycle. A laptop turns over every three to five years; OT components routinely run 15 to 30 years, some longer. One recent industry survey found one in five organizations now runs more than three-quarters of its infrastructure on legacy platforms. Translate that into plain terms: the PLC dosing chlorine at your local water plant may predate the smartphone, running an operating system nobody has patched in a decade because replacing it means shutting down a system the community depends on every hour of every day.
That’s not a maintenance backlog. That’s the attack surface.
Regulators have caught up, at least on paper. NIST SP 800-82 now guides OT security using the same Cybersecurity Framework built for IT, tuned to OT’s real priorities: safety and uptime, not just confidentiality. Sector rules follow the same logic — NERC CIP for the grid, TSA’s pipeline directives after Colonial Pipeline, and Texas’s own Lone Star Infrastructure Protection Act, restricting grid equipment from hostile nations since 2021.
THE THREAT IS ALREADY INSIDE THE PERIMETER
They’re right to assume it. This year alone, federal agencies have published a stream of advisories that read less like theoretical warnings and more like after-action reports.
In July 2026, CISA, the FBI, and the EPA updated a joint advisory on Iranian-affiliated actors actively exploiting programmable logic controllers — the small devices that physically operate valves, pumps, and switches — across Rockwell Automation, Schneider Electric, and Siemens equipment. CISA’s own threat page on Iran is blunt about the pattern: IRGC-affiliated actors routinely go after poorly secured, internet-connected control systems, favoring default passwords and known misconfigurations over sophisticated exploits, because those simple techniques still work.
Russia is running a campaign. A joint warning from CISA, the NSA, the FBI and international allies in July explained that Russian FSB-connected attackers were secretly collecting configuration data from network routers that were not properly secured. These routers are in the communications, energy and government industries. A second warning talks about ‘Sector16’, a hacktivist group that started in 2025. This group has said it broke into U.S. Energy systems. Officials think this group might have some support, from the government. This gives Moscow a way to avoid blame while still getting what it wants.
A WAKE-UP CALL IN THE WATER SECTOR
In July 2026 a cyberattack that looks like it might come from Iranian hackers though the FBI and CISA have not officially blamed anyone hit water and wastewater utilities in at least twelve states. Those states include Minnesota, Michigan, Georgia, New Jersey and South Dakota. The attackers logged into PLCs that were open to the internet changed passwords and locked operators out of their monitoring and control systems. In Minnesota more than thirty community water systems were affected. Many of those utilities had to issue boil‑water notices and fall back to operations while the investigators tried to sort out the problem.
No one poisoned the water. No valve failed. The attackers didn’t need either. It was as easy as cutting off an operator’s visibility into their own system was disruption enough to force a public health response. That distinction should worry emergency managers more than the headline does.
THE BASICS STILL WORK — IF ANYONE’S CHECKING
None of this makes operators helpless but small and rural systems can’t assume they’re too small to be a target; the water sector campaign above hit systems serving a few hundred customers as often as larger utilities. CISA’s own OT mitigation guidance, built with the FBI, EPA, and DOE, is blunt: get OT off the public internet, segment IT and OT behind a demilitarized zone, and keep the ability to run everything manually when the network goes dark.
For remote vendor support, which most small operators depend on, that means routing every session through a single hardened jump box or secure gateway. Never use an outdated laptop using remote desktop bridging the connection between the Internet and the OT network. It’s likely the one control that would have stopped last summer’s campaign cold.
It’s also worth saying plainly: traditional IT security doesn’t map cleanly onto a control room. Multi-factor authentication on every login looks great on a compliance checklist, but an operator responding to a pressure spike in real time can’t wait on a push notification. Immediate availability and safety come first in OT, by design. That’s exactly why sealing the network boundary matters more than layering logins inside it.
And because most small and rural operators don’t have an in-house OT security team, a third-party assessment from a trusted, qualified source isn’t optional. It’s the only realistic way to know what’s exposed before someone else finds out first.
THE REAL GAP ISN’T TECHNOLOGY — IT’S THE ORG CHART
States and the federal government are investing real money in the response. Texas stood up the Texas Cyber Command in 2025 with $345 million in funding and a mandate to train Texans and build a statewide incident response capability. The White House followed with a National Cyber Strategy and a pair of executive orders directing agencies to harden critical infrastructure and expand access to AI-enabled defensive tools for the local governments and utilities that need them most.
None of that, by itself, puts a cyber professional in the room for local command decisions. That’s the real lesson: cybersecurity expertise needs a seat at the table in planning and continuity discussions, not just a line to the IT help desk. This isn’t a problem unique to large cities or state agencies. It’s an immediate need for every organization and government entity, from a three-person rural water district to a metro area’s energy production system. Incident response teams are now standard in corporate security programs, but they’re rarely represented in EOCs, incident command, or continuity planning anywhere in the public sector. The water sector incidents above didn’t need a dropped valve or contaminated water to justify activation — losing visibility into the PLCs alone was enough to trigger boil-water notices and manual operations across several states. That’s as much a command problem as an IT one.
Three questions test whether an organization is actually prepared:
• Is there a designated cyber contact built into the plan and not just a number to call during a crisis?
• Is that relationship written into a cyber incident annex to the Emergency Operations Plan, with defined roles, activation triggers, and information-sharing protocols?
• Has the annex ever been exercised and revised? An untested plan is just an assumption on paper.
Tabletop and functional exercises that pair cyber responders with EOC and command staff build the trust and shared vocabulary a real incident will demand, when there’s no time left for introductions. No one must start from scratch, either: FEMA and CISA’s Planning Considerations for Cyber Incidents guide walks through building an annex, and Texas already has working examples to build from. The Texas School Safety Center publishes a ready-to-use Cybersecurity Annex Template that school districts are now required to complete, and the state’s own emergency management plan treats cybersecurity as its own Emergency Support Function, ESF 20, rather than folding it into communications like most states do.
None of this works without current training.
THE TIME IS NOW
The time is now to close the cyber incident response gap. Build relationships with trusted cybersecurity professionals before an incident forces the introduction. Create mutual aid and regional agreements the way the fire service and law enforcement have for decades. And put a cybersecurity professional at the decision table — for planning, for response, and for mitigation — before the next PLC gets a new password that isn’t yours.
