OT DEFENSEREVIEW

Intelligence for systems that move the physical world.

Coverage desk

Transportation regulation

Source-backed reporting and analysis connected to the companies, capabilities, authorities, and operating domains it affects.

TSA surface cyber proposal needs scope-and-status lineage

TSA's November 2024 record is a proposed rule for selected pipeline, rail, and over-the-road bus operators. A control register should preserve the proposal's status, covered population, requirement set, docket, and later authority instead of presenting proposed text as one current mandate.

NIST CSF 2.0 organizes outcomes—not OT control instructions

NIST Cybersecurity Framework 2.0 provides a taxonomy of cybersecurity outcomes across six functions, including the added Govern function. The framework can structure an OT program and its evidence, but it does not prescribe a safe control design, determine site-specific risk, or prove that an industrial system is secure or compliant.

NIS2 incident reporting starts with entity scope—not a universal timer

Directive (EU) 2022/2555 establishes staged reporting duties for significant incidents, but the operating clock depends on entity scope, national transposition, competent authority, awareness, significance, and the facts of the incident.