The Cybersecurity and Infrastructure Security Agency has released a new guide aimed at helping critical infrastructure operators adopt more secure operational technology, or OT, communications and reduce barriers to implementation.

As agencies like CISA advance cybersecurity initiatives, Potomac Officers Club’s 2026 Cyber Summit on May 21 will bring together government and industry leaders to assess progress and chart the path forward. Secure your seat today.

What Is the Focus of CISA’s New Guide?

The agency said Wednesday the guide, titled Barriers to Secure OT Communications: Why Johnny Can’t Authenticate, outlines challenges preventing widespread adoption of secure industrial protocols. Developed through interviews with stakeholders across water, transportation, chemical, energy and food sectors, the document examines why many operators continue using legacy protocols that lack authentication and message integrity protections.

What Actions Does CISA Recommend?

The guidance outlines practical steps to overcome procurement, deployment and sustainment challenges, as well as latency and bandwidth constraints, inspection limitations caused by encryption and interoperability issues with legacy systems. It encourages prioritizing secure communication features when acquiring new equipment and calls on manufacturers to reduce usability friction in product design. The document builds on CISA’s prior “Secure by Demand” guidance and aims to support long-term enhancements in OT cybersecurity practices.

According to CISA Acting Director Madhu Gottumukkala, adopting secure communications in OT environments is a long-term effort that involves complexity, cost and risk.

“Over the past year, CISA conducted customer-led research to create this secure communication guide. CISA encourages asset owners and operators, system integrators, service providers, and OT manufacturers to review this guide and collaborate together to implement secure communication,” said Gottumukkala, who spoke at Potomac Officers Club’s 2025 Homeland Security Summit in the fall.

Why Is Secure OT Communication a Priority?

Insecure communication allows threat actors to impersonate devices or alter messages in transit to OT devices. Adoption of secure versions of industrial protocols, which have been available for more than 20 years, has been limited due to technical, operational and cost-related barriers within the control systems community.

Related Federal OT Cybersecurity Efforts

CISA’s guidance follows a series of recent OT security initiatives, including joint Secure Connectivity Principles issued with the UK’s National Cyber Security Centre, the National Institute of Standards and Technology’s draft update to Guide to Operational Technology (OT) Security and the Department of War’s new Zero Trust for Operational Technology guidance.

The Federal Trade Commission has reported that ransomware and other malware-based attacks represent only 2.23 percent of all fraud complaints submitted to the agency.

In the 2025 Ransomware Report published Friday, the FTC shared that, between July 2023 and June 2025, tech support scams were among the most reported fraud types.

About 1 percent of the 42,972 reports the FTC received that allegedly originate from China are ransomware. The majority of the complaints are related to online shopping fraud.

Complaints tied to Russia, Iran and North Korea are relatively rare, with the three countries accounting for only 0.05 percent of all fraud reports the FTC received from 2023 to 2025.

Malicious actors targeting American businesses and systems is one of the top concerns of Potomac Officers Club’s 2026 Cyber Summit on May 21. Gain insights directly from cyber officials from across the public and private sectors at the GovCon event. Get your tickets today.

What Is FTC Doing to Counter Ransomware, Other Cyber-Related Fraud?

According to the FTC, it has made over 90 enforcement actions related to data security, including in cases that involve malicious actors located in China or Russia. For instance, in 2024, the agency brought action against Marriott International and its subsidiary Starwood Hotels & Resorts Worldwide for data breaches tied to malicious actors with links to the Chinese government.

To safeguard American consumers against cyber fraud, the FTC has collaborated with foreign counterparts to end scams from abroad. The agency sued Restoro Cyprus Limited and Reimage Cyprus Limited for allegedly duping consumers into purchasing computer repair services they do not need.

Additionally, the FTC runs education campaigns to warn the public about ransomware, tech support scams and other cyberattacks.

Why Did the FTC Publish the Report?

The FTC’s Ransomware Report is mandated under the Reporting Attacks from Nations Selected for Oversight and Monitoring Web Attacks and Ransomware from Enemies Act, or RANSOMWARE Act.

The Ransomware Report provides Congress with information on agency actions to fight against ransomware and other cyberattacks.