The combination of operational technology (OT) and information technology (IT) systems is changing industries forever: it’s enabling smarter power grids, more advanced manufacturing, and more responsive operations in nearly every industry. This convergence does come with a price: increased cybersecurity-related risks that threaten not just data integrity but also human safety and national security when physical operations become jeopardized.
Consider how smart controllers, a significant part of the IT/OT convergence trend, increase the risks within traditional OT environments. These intelligent embedded devices designed to manage, monitor, and control industrial processes and systems now incorporate capabilities traditionally associated with IT devices, such as advanced processing power, integrated communication features, and edge computing capabilities-features. This enables smart controllers to not only execute control logic but also perform data processing and analytics at the edge, communicate with other devices or systems, and support remote management.
Their power — the handling of complex computations locally, reduced dependence on central systems, and support of multiple communication protocols such as ethernet, Wi-Fi, and Zigbee to connect with other OT and IT devices and seamless data exchange — all increase security risks. These controllers can analyze data and make decisions in real time at the edge, enabling faster and more autonomous operations. Given their critical role and exposure to cyber threats, these smart controllers require robust security controls, including encryption, authentication, vetted manufacturing supply chain and secure communications.
Virginia Wright, cyber-informed engineering program manager at Idaho National Laboratory, said during the presentation at RSAC Conference 2025, Application of Cyber-Informed Engineering to Municipal Utility Security, that cybersecurity threats are targeting critical infrastructure with increasing success at disrupting the safety of operations and operations and she stressed the importance of device engineers using device design and physical controls to mitigate these risks to operations.
Increasingly, Cyber-Informed Engineering (CIE) and more broadly “secure-by-design,” which embeds cybersecurity into the DNA of system design, is now driving federal mandates to harden OT environments. "We’ve seen a lot of work toward secure-by-design, with a lot of emphasis on encouraging organizations to get rid of legacy debt and get rid of their most insecure products,” said Tatyana Bolton, executive director at the Operational Technology Cybersecurity Coalition, during the FBI, CISA, and OT — Prepare and Respond to Critical Infrastructure Incidents panel at RSAC Conference 2025.
The National Security Agency’s (NSA) recent Cybersecurity Technical Report on securing smart controllers in national security systems (NSS) moves those efforts forward. Released last month, the report outlines 74 existing ISA-62443-4-2 requirements, and six new safeguards all designed to better protect OT devices. Beyond checklists, the report reflects the broader CIE and secure-by-design philosophy: engineer out risks before adversaries can exploit them.
“This is a really good move, albeit sorely overdue,” said Michael Farnum, advisory CISO at technology services provider Trace3. “But older OT devices probably weren't capable of what smart controllers can do today with the additional compute power,” he says.
CIE, championed by the Department of Energy’s Idaho National Laboratory, moves cybersecurity from a design afterthought to a core engineering discipline. Traditional OT security often relied on air-gapping or retrofitting defenses, but CIE mandates designing systems that inherently resist attacks. As the DOE’s National CIE Strategy notes, this method prioritizes “engineering controls to mitigate the worst consequences of cyberattacks”-like physical damage or loss of life.
The NSA’s cybersecurity technical report aligns with this vision. By targeting smart controller—intelligent devices managing industrial processes—the agency addresses high-value targets where a breach could cripple power plants, water systems, or military operations.
The newly released NSA safeguards for smart controllers, under the Operational Technology Assurance Partnership (OTAP), incorporates the principles of cyber-informed engineering with controls that design and engineering teams should put into place. Examples include reducing the attack surface through the physical disabling of wireless interfaces through hardware switches, SSID broadcast suppression.
Additional principles include restricting removable media, enhancing supply chain integrity through proper supplier vetting and using secure boot processes, as well as requiring strong encryption be embedded within system architecture and stopping the use of depreciated protocols such as SSL and triple-DES. “For the most part, the effort to find the gaps and fix them at the NSS level should help,” says Farnum.
Critical infrastructure operators should take these requirements and re-evaluate legacy systems using CIE principles and upgrade appropriately, adopt NSA’s smart controller safeguards as a baseline, and engage with OTAP and ISA to stay ahead of standards as they evolve. Adversaries aren’t waiting, and if resilience isn’t engineered within systems now, the individual operators, as well as the nation, are gambling on the wrong side of the risk.
George V. Hulme is an award-winning journalist and internationally recognized information security and business technology writer. He has covered business, technology, and IT security topics for more than 20 years. His work has appeared in CSOOnline, ComputerWorld, InformationWeek, Security Boulevard, and dozens of other technology publications. He is also a founding editor at DevOps.com.
