Loading story…
A new reliability standard has been introduced for major U.S. and Canadian electric grid operators, requiring comprehensive monitoring and logging of all network traffic on operational technology (OT) and industrial control systems. The regulation aims to enhance the ability of power companies to detect, prevent, and respond to unauthorized intrusions, particularly in light of recent attacks on the Ukrainian grid by Russian hackers and the discovery of Chinese threat actors within U.S. power company networks.
OT security experts highlight that the mandate is far-reaching, covering not only 'North-South' traffic entering OT networks but also 'East-West' traffic within them, including communications between operator stations, human interface workstations, controllers, and field devices. The sector faces significant challenges in implementing these requirements due to the complexity and scale of the systems involved, making compliance a substantial undertaking for the electricity industry.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Medium-impact and other covered systems have up to two additional years after the first deadline to comply with CIP-15-1, extending the rollout to 2030 for some environments. The phased schedule reflects the complexity and cost of implementing comprehensive OT monitoring across diverse utility networks.
Under the phased rollout of CIP-15-1, operators of critical high-impact sites must meet the new OT monitoring and logging requirements by October 1, 2028. This includes baselining normal behavior, detecting anomalies, and triaging alerts.
NERC introduced reliability standard CIP-15-1 for U.S. and Canadian electric grid operators, requiring monitoring and logging of both perimeter and internal OT network traffic. The rule shifts utilities toward a detect-and-respond, zero trust-style model for high- and medium-impact systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting highlighted growing concern that **state-affiliated and state-linked actors** are positioning for disruptive attacks against **operational technology (OT)** and critical infrastructure, with activity that may be difficult for operators to detect. A Codific analysis described five common pathways seen in disruptive grid-focused intrusions—often beginning with **human error or exposed perimeter services**, then escalating through **credential theft**, **remote access exploitation** (e.g., VPNs/gateways), **ransomware**, and misuse of **legitimate industrial commands** that can delay operations and complicate detection and recovery; it also warned that attacks on virtualized environments can hinder restoration efforts and that cascading impacts could be severe (e.g., Lloyd’s “Business Blackout” scenario estimating losses up to **$1T**). Recommended mitigations emphasized proven controls such as **phishing-resistant MFA** and **IT/OT segmentation**, rather than novel defenses. Separate commentary and media content also pointed to OT becoming a frontline in geopolitical escalation, including claims of a coordinated campaign tied to Iran-linked hacktivist activity targeting OT devices such as **Unitronics PLCs** used in water and industrial facilities, alongside psychological operations and SMS spoofing. Other items in the set were leadership/career/podcast-style content without specific incident or vulnerability detail and do not materially add to the OT/power-grid threat reporting.
Jun 29, 2026
Global cybersecurity agencies have issued a joint call for critical infrastructure operators to conduct comprehensive mapping of their operational technology (OT) environments. The guidance, supported by the United Kingdom's National Cyber Security Centre, the U.S. Cybersecurity and Infrastructure Security Agency, and other allied partners, emphasizes the urgent need for exhaustive OT inventories to combat evolving cyber-physical threats. Operators of essential services such as power grids, water systems, and manufacturing plants are being instructed to catalogue all assets by their criticality, ensuring that every component of their OT environment is accounted for. The framework outlined by these agencies includes documenting system connectivity, validating and maintaining records through structured change management, and rigorously managing third-party access and contractual risks. Security experts highlight that while creating a definitive record of OT assets is both feasible and necessary, it presents significant challenges, particularly for organizations with sprawling, decades-old networks. Legacy systems often lack the real-time visibility required for effective inventory, making the process complex and resource-intensive. Despite these obstacles, the increasing sophistication of cyber-physical threats means that organizations can no longer afford to operate with blind spots in their OT environments. The guidance stresses the importance of asset visibility as a foundational element of OT security, enabling organizations to identify vulnerabilities and respond more effectively to incidents. Agencies recommend that operators implement structured change management processes to ensure that asset records remain accurate and up to date. The guidance also calls for robust management of third-party access, recognizing that supply chain and contractor relationships can introduce additional risks. By following the principles-based framework, critical infrastructure operators can reduce the likelihood of undetected vulnerabilities and improve their overall security posture. The agencies warn that failure to maintain comprehensive OT inventories could leave organizations exposed to major cyber incidents. The call to action reflects a growing consensus among global cyber authorities that asset management is a critical defense against increasingly complex threats targeting industrial control systems. The guidance is intended to drive a cultural shift in how OT operators approach security, moving from reactive measures to proactive risk management. Experts agree that while the task is daunting, the benefits of improved visibility and control far outweigh the challenges. The initiative underscores the need for ongoing collaboration between government agencies, industry stakeholders, and security professionals to protect critical infrastructure from cyber threats. Ultimately, the guidance aims to ensure that operators are not caught off guard by attacks that exploit unknown or unmanaged assets within their OT environments.
Jun 29, 2026
CISA, the UK **NCSC**, and multiple international partners released **Secure Connectivity Principles for Operational Technology (OT)** guidance aimed at reducing risk created by increased connectivity into industrial environments (e.g., industrial control systems, sensors, and other critical services). The guidance is positioned for operators of essential services facing business and regulatory pressure to enable remote monitoring and management, and it emphasizes that formerly *air-gapped* OT is now more exposed due to expanded remote access and IT/OT convergence. The guidance highlights that insecure or exposed OT connectivity is being targeted by a broad range of adversaries, including **ransomware groups**, **state-backed actors**, and **pro-Russia hacktivists** conducting opportunistic attacks against global critical infrastructure. Recommended defensive themes include **network segmentation**, **strong authentication**, continuous monitoring, and minimizing remote access paths to prevent disruptive incidents with potential real-world safety and service-delivery impacts; CISA also solicited stakeholder feedback via a product survey. Separate opinion pieces discussing AI in critical infrastructure and power redundancy risks in OT, and an industry roundup of Chinese cybersecurity companies, do not provide additional reporting on this specific guidance release.
Jun 29, 2026