Key Takeaways
- NIST’s National Cybersecurity Center of Excellence (NCCoE) is launching a new Operational Technology (OT) cybersecurity project focused specifically on improving asset visibility and management for critical infrastructure organizations, identified as the top cross-sector challenge.
- The project addresses significant hurdles in OT environments, including legacy systems and distributed architectures, by demonstrating practical methods to leverage existing standards, frameworks, and commercially available off-the-shelf technologies.
- This initiative responds to urgent calls from agencies like CISA for critical infrastructure entities to inventory OT assets, particularly to defend smaller, resource-constrained organizations (like water utilities) against increasing cyber threats, including potential AI-enabled attacks.
- NIST is pursuing this OT visibility work through a collaborative consortium model involving industry and government partners, while simultaneously advancing parallel efforts in AI security, including developing a Cybersecurity Framework Profile for AI and securing AI agent identities.
- The overarching goal is to provide foundational, actionable guidance that enables organizations to buildresilient OT environments by starting with a clear understanding of what assets they need to protect.
NIST Launches OT Asset Visibility Project to Address Critical Infrastructure Gap
The National Institute of Standards and Technology’s (NIST) National Cybersecurity Center of Excellence (NCCoE) is embarking on a new project designed to tackle a fundamental weakness plaguing critical infrastructure sectors: poor visibility into Operational Technology (OT) environments. Cherilyn Pascoe, the director of NCCoE, announced the initiative during her April 16th remarks at GovCIO’s “CyberScape” conference in Arlington, Virginia. She explained that the project emerged directly from extensive consultations with various critical infrastructure industries, where a consistent and overwhelming challenge surfaced – the lack of effective asset management and asset visibility. Pascoe emphasized that while the topic is foundational, it is far from simple, particularly given the complexities inherent in OT and Industrial Control System (ICS) settings characterized by legacy equipment and geographically dispersed systems. The core objective of this new NIST effort is to demonstrate practical, actionable methods for achieving robust asset visibility specifically within these challenging OT contexts.
The Urgent Need for OT Asset Management in Critical Infrastructure
The motivation behind NIST’s focus on OT asset visibility stems from longstanding and escalating concerns about cyber threats targeting the physical systems that underpin essential services. Pascoe highlighted that the NCCoE’s decision to prioritize this issue followed years of sector-specific work, including projects on water and wastewater cybersecurity and recent guidance for transit agencies implementing the NIST Cybersecurity Framework. Across these engagements, the recurring pain point was clear: organizations simply do not know what OT assets they possess. This lack of basic inventory creates significant vulnerability, as defenders cannot protect what they cannot see or identify. The urgency is amplified by recent actions from the Cybersecurity and Infrastructure Security Agency (CISA), which, alongside other U.S. and international cyber agencies, has actively urged critical infrastructure organizations to inventory their OT assets. Experts like Tatyana Bolton, Executive Director of the Operational Technology Cyber Coalition, have starkly warned that many sectors, especially smaller entities such as rural water utilities with limited budgets and staff, have not even begun this fundamental step, leaving them dangerously exposed to sophisticated threats, including potential nation-state attacks aiming to cause physical disruption.
Project Scope: Leveraging Standards and Commercial Tech for Visibility
NIST’s approach to solving the OT visibility challenge is deliberately pragmatic and focused on applicability. Pascoe articulated that the project will serve as a “foundational topic” by demonstrating how organizations can effectively achieve asset visibility in OT environments using tools and methods already within reach. Rather than advocating for entirely new, bespoke solutions, the NCCoE aims to show how existing cybersecurity standards, frameworks (like the NIST CSF itself), and risk management practices can be adapted and applied specifically to the OT asset discovery and tracking problem. Crucially, the project will explore how to construct effective visibility architectures using commercially available, off-the-shelf technologies – solutions that organizations can procure and implement without requiring extensive custom development or prohibitive costs. Pascoe also indicated that the project remains open to incorporating emerging technologies based on community interest, specifically mentioning the potential role of Artificial Intelligence (AI) in enhancing visibility efforts, such as using AI to correlate data from disparate sources or automate asset identification processes within complex OT networks.
NIST’s Broader AI Security Initiatives Running Parallel to OT Work
While the OT visibility project represents a significant new focus, Pascoe used her conference appearance to underscore that NCCoE’s work spans multiple critical cybersecurity fronts, notably including advancing efforts around Artificial Intelligence (AI) security. The center is actively reviewing public comments on plans to develop a “Cybersecurity Framework Profile for AI,” which Pascoe described as the process of taking the core NIST Cybersecurity Framework and the Enterprise Risk Management Framework and tailoring them to address the unique risks and challenges introduced by AI systems. She outlined three key pillars guiding this AI security work: first, securing AI systems themselves against compromise; second, exploring how AI can be used defensively to strengthen cybersecurity operations (like threat detection or response); and third, developing guidance on how organizations can defend against threats enabled by AI, such as more sophisticated phishing or vulnerability exploitation. Parallel to this, NIST’s Secure Software Development Consortium is examining how AI is increasingly integrated into the software development lifecycle – both for creating code and for automated code review – to ensure security practices keep pace. Furthermore, the NCCoE is gathering feedback on a concept paper titled “Accelerating the Adoption of Software and AI Agent Identity and Authorization,” aiming to help organizations securely manage the growing deployment of AI agents within enterprises. This feed is directly informing the work of NIST’s new Center for AI Standards and Innovation (CAISI), which launched its “AI Agent Standards Initiative” in February to establish foundational guidelines for governing these autonomous software entities.
Conclusion: Building Foundational Cyber Resilience
The NIST NCCoE’s new OT asset visibility project represents a strategic response to the most basic yet critical gap identified across critical infrastructure: the absence of a clear picture of what needs protection. By focusing on demonstrable, standards-based, and commercially feasible solutions for asset discovery and management in challenging OT environments – potentially enhanced by AI – the initiative seeks to move organizations beyond awareness toward actionable capability. This effort does not exist in isolation; it sits alongside NIST’s parallel and equally important work in securing AI systems, leveraging AI for defense, and guarding against AI-powered threats, reflecting a holistic approach to modern cyber risk. Ultimately, by helping critical infrastructure entities – particularly those with fewer resources – gain the foundational knowledge of their OT assets through practical guidance, NIST aims to strengthen the baseline resilience essential for defending against both current cyber threats and emerging risks posed by evolving technologies like offensive AI. The consortium-driven model underscores the belief that solving this pervasive challenge requires collaboration between government, industry, and the asset owners themselves striving to secure the systems that supply power, water, transportation, and other vital services.