CISA issues real-time water OT guidance as Iran-linked attacks spread
The operational shift from advisory to prescriptive isolation requirements marks CISA's most direct intervention yet during an active campaign.
TL;DR
CISA released urgent guidance Thursday telling water and wastewater operators to validate and isolate external OT connections after threat actors targeting exposed PLCs triggered boil water notices and operational disruptions across multiple states. The advisory, which does not attribute the activity but lands amid reports of Iran-linked attacks on water systems in at least seven states, warns that even mature organizations should scan for undocumented cellular modems installed by vendors or integrators. The guidance supplements CISA's new CI Fortify isolation framework, released jointly with the Australian Signals Directorate and other international partners, and arrives alongside a federal-agency open-source software security guide, updated SBOM minimum elements, and refreshed SCuBA cloud configuration baselines.
CISA's Thursday advisory on water-sector OT security doesn't name the threat actor, but it doesn't need to. The operational details tell the story: attackers are targeting programmable logic controllers, changing passwords to lock operators out, and altering IP addresses to sever the PLCs from the network entirely. The result (boil water notices and sustained manual operations) is the kind of kinetic consequence that shifts an agency's posture from guidance-publisher to incident responder.
The advisory's most telling instruction isn't technical. It's procedural: "Even water organizations with mature cybersecurity processes should validate their external connections." CISA is flagging cellular modems installed by operators, vendors, or system integrators that may not appear in routine attack-surface scans, a gap that reads like an after-action finding, not a theoretical concern. The agency is, in effect, telling utilities that their own asset inventories are incomplete and that the incomplete parts are what adversaries are hitting.
The isolation framework arrives mid-campaign
The water advisory dropped the same week CISA and international partners published "Advice for Isolating Vital Systems" under the CI Fortify Initiative. That guidance tells critical infrastructure operators how to maintain essential services under degraded conditions, including manual or alternative SCADA paths. It's the planning document you publish before an attack, but its release alongside an active campaign makes it something closer to a checklist for organizations that are already inside the response window.
Saying so aloud puts CISA in an unusual position. The agency typically issues advisories with a backward-looking posture, here's what happened, here's what to patch. This week's pair of documents together amount to: here's what's happening now, here's how to survive it, and here's what you missed that let them in. That's a meaningful escalation in CISA's operational tempo.
The rest of the package: OSS, SBOM, SCuBA
Alongside the water guidance, CISA published three other items that will land on different desks. A federal-agency guide to open-source software security applies Executive Orders 14144 and 14306, urging agencies to establish formal review-and-approval processes for OSS and (notably) to demand transparency into training data and components before treating an open-source AI model as acceptable risk. The guide doesn't engage the policy fight over whether foreign open-source AI models should be banned, but it hands agencies a framework for evaluating them regardless.
The updated SBOM minimum elements are the first revision since 2021 and now explicitly cover open-source software, AI software, and SaaS. That broadening matters because SBOM requirements have languished in federal procurement; agencies still have discretion rather than mandates. The updated minimum elements give those who want to act something current to point at.
Finally, SCuBA (the Secure Cloud Business Applications project) released updated Google Workspace configuration baselines and a major revision to the ScubaGoggles assessment tool. The program is nearly four years old and addresses the cloud misconfigurations that remain the most reliable path to federal data exposure. It's less dramatic than water-system attacks but arguably affects more federal users.
What the practitioner does Monday
For water-sector OT operators: validate every external connection, including cellular modems you didn't install. Document them. Isolate PLCs that don't need external reachability and ensure backup configurations are recoverable. The advisory implies a timeline measured in days, not weeks.
For federal security teams: the OSS guide gives you a review process template. Use it to inventory what open-source dependencies your agency actually runs (including in AI pipelines) before the next log4shell moment arrives.
Published ·Updated ·Deep Fathom