Operational Technology

French authorities attribute destructive attacks on refrigeration controllers at more than 700 supermarket locations to an Iranian cyber unit; U.S. authorities also suspect Iran. The incident highlights potential demand for OT security assessments, incident response, and resilient control systems, but no solicitation or contract has been identified.

Nozomi Networks announced that its cloud-based Vantage for Government OT/IoT security platform achieved FedRAMP Moderate certification, making it available for federal agencies to consider. The announcement signals market availability—not a solicitation or contract award—and provides no pricing or procurement terms.

Indiana’s 2025 Senate Enrolled Act 459 expands cybersecurity evaluation, incident-reporting, and state-contact requirements for many water and wastewater utilities. The law may create demand for assessments, managed security, and operational-technology protection, but no open solicitation or committed state funding is identified.

A joint federal warning says internet-exposed and unpatched industrial refrigeration controls face ongoing cyber threats that could disrupt food, healthcare, transportation, and military cold chains. Operators face near-term inventory, audit, and controller-replacement deadlines, while emerging baseline standards may affect future equipment procurements.

CISA’s “CISA 2030: Defend, Harden, Prevail” prioritizes operational technology security, software supply chain integrity, and continuity of essential services, while recognizing that intrusions may still occur. Federal buyers and contractors can use these priorities to inform acquisition planning and lifecycle controls, but CISA has not announced a specific solicitation or mandatory new requirement; an implementation and outcome-measurement approach is planned within 180 days.

GDIT and AppGate signed a strategic collaboration agreement to integrate AppGate zero-trust capabilities into GDIT’s Everest solutions for federal missions. The announcement signals potential demand across enterprise IT, operational technology, inter-agency, and tactical-edge environments, but identifies no contract award, solicitation, contract value, or procurement timeline.

Crytica Security’s RDAi device-level operational technology threat-detection solution is now available to federal and state, local, and education buyers through Carahsoft’s reseller network, NASA SEWP V, and NASPO ValuePoint. The partnership creates an existing-vehicle purchasing path for agencies evaluating OT cybersecurity, but the announcement provides no pricing, contract value, solicitation deadline, or specific deployment requirement.

The **Department of Defense** is investigating freezer-control failures that spoiled food at about six U.S. military commissaries in August 2026 as suspected cyberattacks; neither the cause nor any responsible party has been confirmed. The incidents highlight operational technology risks in food storage, but no solicitation, award, contract value, or procurement schedule has been identified.

The Office of Naval Research awarded Integer Technologies a $23.1 million contract for TRIDENT research and prototyping focused on threat-informed, zero-trust cybersecurity for shipboard power systems. The Navy obligated $10.1 million for the base period, with approximately $13 million tied to an option; the effort is expected to run through October 2030 and does not constitute a shipboard deployment.

NIST is accepting comments through November 30, 2026, on the initial public draft of SP 800-82 Revision 4. The guide provides risk-based OT security recommendations, not a standalone mandate, so contractors should distinguish guidance from binding requirements in applicable contracts and regulations.

The **U.S. Marine Corps** is expanding its Unified Controls Resilience Network (UniCRN) approach to protect operational technology supporting essential installation services. The effort may point to future demand for OT cybersecurity and infrastructure resilience capabilities, but no active solicitation, contract value, or procurement contact is identified.

Dragos Public Sector expanded its xOT cybersecurity capabilities and named former U.S. cyber and defense leaders to its board, while positioning Accenture Federal Services as a federal go-to-market and delivery channel. The announcement aligns the offering with agency security deadlines but identifies no solicitation, contract value, award, or procurement contact.

ICE awarded Roboteq a $1,304,296 sole-source contract for four Boston Dynamics Spot robots and related equipment, with delivery to Fort Benning, Georgia. The completed Homeland Security Investigations purchase signals demand for robotics in hazardous-environment law enforcement, but is not an open opportunity; employee opposition also raises workforce and reputational considerations for suppliers.

CISA’s “Defend, Harden, Prevail” strategy directs the agency to review core services within 60 days, develop an implementation and measurement approach within 180 days, and report progress within 365 days. The shift toward operational technology security, consequence-based risk analysis, and resilient communications may shape future contractor requirements, but no active solicitation or contract value has been identified.

A Federal News Network commentary warns that Iran-linked cyber activity increasingly targets U.S. critical infrastructure, the defense industrial base, subcontractors, and operational technology. It says NIST SP 800-171 controls can mitigate 68% of 130 mapped techniques, while appropriate monitoring can detect all 130—pointing contractors toward supply-chain, OT, and monitoring reviews rather than a new procurement mandate.

APTA’s Transit Cybersecurity Working Group has identified potential 2027 work on operational technology procurement requirements, OT assessment guidance, and transit-specific AI governance and System Assurance. The proposals are for further review—not adopted requirements or an open solicitation—but offer agencies and contractors planning cues for future cybersecurity and reliability needs.

Dispel and Tenable have integrated Tenable One OT Exposure intelligence with Dispel’s Zero Trust Engine to inform industrial remote-access decisions in real time. Available to joint customers across cloud, on-premises, and hybrid environments, the commercial offering is not a government award or solicitation but may inform OT cybersecurity requirements and market research.

The U.S. Army Information Systems Engineering Command (USAISEC) describes Risk Management Framework as a Service (RMFaaS), supporting cybersecurity engineering, compliance, continuous monitoring, and ongoing authorization. The announcement outlines an existing service model—not a solicitation or award—so contractors should treat it as capability context rather than an active procurement.

The NSA has issued new guidance on applying zero trust principles to operational technology (OT) systems. This document advises defense and critical infrastructure sectors on enhancing security but does not impose compliance requirements or set deadlines for implementation.

The National Institute of Standards and Technology (NIST) has published a draft extending cybersecurity guidance for operational technology (OT). Stakeholders can comment on the draft until November 30, 2026, as it aims to improve security across critical sectors like water and agriculture amidst rising cyber threats.

In August 2026, Rockwell Automation and H.S. Automation conducted a cybersecurity risk assessment for Indinvest LT, an aluminum manufacturer in Italy. This initiative aligns with recognized standards such as IEC 62443 and NIST, enhancing the company's operational resilience as industrial connectivity grows.

Corsha has been awarded a **$50 million** contract by the **U.S. Defense Logistics Agency (DLA)** to implement zero-trust connectivity solutions, aimed at enhancing cybersecurity within the DoD's logistics operations. This investment highlights the increasing need for advanced cybersecurity measures in operational technology environments, particularly for defense and critical infrastructure sectors.

The FBI probes a series of cyberattacks on Midwest water systems linked to Iranian threats. Local governments may boost investments in cybersecurity infrastructure, creating procurement opportunities in operational technology safety.

U.S. critical infrastructure sectors are increasingly vulnerable to cyber-physical threats, necessitating procurement of advanced cybersecurity solutions. Contractors specializing in operational technology modernization are uniquely positioned to assist agencies in mitigating these risks.

NIST has released Special Publication 1339, providing crucial backup guidance for Operational Technology (OT) environments. This document emphasizes the need for effective backup strategies and is likely to impact procurement requirements for cybersecurity solutions in both government and industrial sectors.

The National Institute of Standards and Technology has unveiled a draft guide aimed at enhancing ransomware response and recovery in industrial control systems. This initiative, developed alongside leading technology firms, signals an increased focus on cyber resilience and will impact procurement strategies in the manufacturing sector.

As industrial operators pivot towards a zero trust security model for operational technology (OT), the focus is shifting from purely identity verification to enhancing asset visibility and operational resilience. This transition paves the way for new procurement opportunities for companies offering integrated cybersecurity solutions tailored to OT environments.

The NIST's National Cybersecurity Center of Excellence has launched a critical cybersecurity initiative focusing on operational technology (OT). This project aims to address visibility challenges in OT environments, creating significant procurement implications for vendors offering cybersecurity solutions tailored for critical infrastructure.