WASHINGTON, D.C., July 23, 2026 — The Operational Technology Cybersecurity Coalition (OTCC) released a new position paper calling on U.S. policy makers to formally recognize ISA/IEC 62443 as the global standard for operational technology (OT) cybersecurity, warning that a growing patchwork of sector-specific mandates is creating compliance burdens without improving security outcomes.
The paper, "A Unified Approach to OT Cybersecurity," points to overlapping and duplicative requirements across the transportation, energy and international regulatory landscape. It cites the TSA's Pipeline Security Directives, NERC CIP's "double-reporting" burden in the energy sector, and the European Union's overlapping NIS2, CER and Cyber Resilience Act requirements as evidence that fragmented, sector-specific rules often recreate controls that already exist within established frameworks like ISA/IEC 62443.
"Governments should focus on adopting requirements aligned to standards that take a holistic approach and are developed by global experts in industrial automation cybersecurity," the paper states, noting this approach aligns with the last two administrations' National Cyber Strategies, both of which called for harmonizing and eliminating duplicative regulation.
The paper points to international precedent already underway. Standards Australia has formally adopted 62443 as a national standard. The EU's Cyber Resilience Act draws its technical baseline from 62443-4-1 and 62443-4-2. Saudi Arabia and Singapore have each anchored their national OT cybersecurity frameworks to the standard as well.
The OTCC outlines five recommendations for U.S. policy makers:
- Recognize ISA/IEC 62443 as the global OT security standard
- Shift from compliance to interoperability
- Catalyze market maturation through lead-user adoption
- Enhance sector-specific technical guidance and capacity building
- Fund workforce development for OT security competency
"Every new mandate that duplicates existing controls pulls engineering resources away from actual threat mitigation and toward paperwork," said Tatyana Bolton, executive director of the OTCC. "We already have a globally recognized, consensus-based standard built for the physics of industrial systems. Policy makers don't need to reinvent it. They need to recognize it."
The release comes as CISA prepares to finalize the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule this fall, one of several major cybersecurity regulations expected to move forward in the coming months.
About the Operational Technology Cybersecurity Coalition
The Operational Technology Cybersecurity Coalition (OTCC) is dedicated to advancing cohesive, risk-based and globally interoperable cybersecurity policy for industrial and operational technology environments. OTCC brings together leading experts to advocate for consensus-based standards that reduce regulatory fragmentation and strengthen critical infrastructure resilience worldwide.
