How the 2022 National Defense Authorization Act (NDAA) Impacts ICS/OT Cybersecurity
Summary: The FY22 National Defense Authorization Act carried roughly 37 cybersecurity amendments, with provisions aimed at ICS/OT and critical infrastructure across ransomware, incident response, procurement, public-private partnerships, and critical infrastructure. The law tasks DoD with assessing its ability to disrupt and defend against ransomware, requires CISA to update the National Cyber Incident Response Plan (unchanged since 2016) every two years and build a National Cyber Exercise Program, and directs DoD to map Defense Critical Assets and Task Critical Assets across IT and OT systems.
What you should know: Dragos reported that 86% of its services customers had limited to no visibility into their ICS environment - the same visibility gap the NDAA now orders DoD to close across its own critical assets, and the standard regulators and partners will increasingly expect of operators.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026