CISA Launches voluntary Installed Base Program to secure exposed OT assets

CISA announced the Installed Base Program on November 10, 2026, as a voluntary partnership with original equipment manufacturers to identify and secure exposed operational technology assets across critical infrastructure.

Original equipment manufacturers that join contact CISA at CISA.CSD.VM_InstalledBase@cisa.dhs.gov and sign an agreement covering roles, responsibilities and data sharing. Participating OEMs supply product-specific details, vulnerabilities, well-known misconfigurations and critical infrastructure alignment, and they work with CISA on notification and mitigation. CISA shares OEM-specific data only within CISA and the respective company under Traffic Light Protocol Amber+STRICT markings, not with other program partners. Partners generally meet with CISA once a month to share information.

CISA calls original equipment manufacturers foundational to U.S. critical infrastructure because they run industrial control systems and other products spread across sectors. In the context of the program, installed base means the products original equipment manufacturers make that customers deploy and operate. Four outcomes guide the program: strategic partnerships, sharing validated internet protocol (IP) data, visibility into exposed OT assets and attack vectors, and mitigation and hardening guidance. The program targets a persistent ownership gap while internet-exposed OT in water systems faces active exploitation, as shown by the July 2026 attacks.

To find who owns or runs internet-exposed vulnerable operational technology assets, CISA runs open-source scanning tools plus its Cyber Hygiene Vulnerability Scanning Service. Public information on exposed, vulnerable assets shows only the internet provider, not who owns the asset. When tools and public data cannot establish ownership, CISA may use its administrative subpoena authority to get contact information from service providers, typically an internet service provider.

In the first stage, OEMs review vulnerable IP data, validate ownership, prioritize exposed equipment by vulnerability and criticality, and send validated data back to CISA. CISA analyzes the data with open-source and internal tools to confirm a device’s existence, exposure, vulnerability and ownership.

If open-source data identifies an owner, CISA informs the OEM, which decides the notification step; otherwise CISA checks subpoena eligibility for the IP address. Using its administrative subpoena authority, CISA obtains owner or operator details from the service provider, the customer’s internet service provider. CISA Regional Cybersecurity Advisors notify vulnerable organizations based on subscriber information from the subpoena recipient, such as an internet service provider or cloud service provider.

In the feedback stage, CISA shares analysis results and notification status with the OEM, plus sector and IP exposure data with Sector Risk Management Agencies. CISA notifies asset owners with a CISA-developed mitigation guide that summarizes the vulnerability and recommends steps, including removing the OT asset from internet exposure.

The program provides mitigation recommendations rather than mandates; notified asset owners receive guidance and decide whether to remove exposed assets from the internet. CISA usually sends notices to U.S. organizations spanning the 16 critical infrastructure sectors, covering state, local, tribal and territorial governments.

CISA issued a July 30, 2026, alert warning of increased cyber threat activity against internet-exposed programmable logic controllers in water and wastewater systems. The alert followed hacks disrupting over 30 Minnesota community water systems in attacks from the prior Sunday through Monday ahead of July 31, 2026.

CISA told critical infrastructure owners, operators and integrators to take publicly exposed PLCs and other OT off the internet immediately. CISA warned that exposed OT can include undocumented cellular modems put in by operators, vendors or integrators and missed by routine scans.

Threat actors changed programmable logic controller passwords to lock out operators and modified IP addresses to disconnect devices from networks. According to state officials, the attacks disrupted operations at some utilities without affecting drinking water safety.

Minnesota IT Services turned on the state cybersecurity incident response plan once it found a coordinated cyber attack hitting OT at over 30 Minnesota community water systems. Minnesota municipalities reported equipment malfunctions that forced some utilities to temporarily switch to manual operations.

A joint FBI and EPA announcement says utilities in at least seven states faced incidents starting July 27, 2026, involving internet-facing OT such as PLCs. Minnesota activated a statewide cybersecurity incident response involving CISA, the EPA, the FBI, state agencies and local utilities for the water-sector attacks.

New Jersey reported two municipal water utilities temporarily ran in manual mode after attacks, while Michigan said attacks targeted nine water systems without public-health impacts. Press accounts said officials believe Iranian hackers were probably behind the Minnesota attacks, but investigators have not publicly attributed the attacks or named a perpetrator.

Censys counts more than 4,100 internet-exposed Rockwell Automation/Allen-Bradley hosts on the public internet, plus 4,100 Siemens hosts and over 2,000 Schneider Electric hosts. Censys explains that its map displays devices reachable via the public internet, rather than systems that are necessarily targeted or compromised.

Gary Barlet, public sector chief technology officer at Illumio, said “What concerns me most is that these events are becoming less surprising.” Felipe Fernandez from Fortinet Federal said cyber danger can turn into operational and public-health danger quickly when PLCs connect directly to the internet. Adam Ford from Zscaler said small water utilities need to protect against nation-state attackers despite limited staff and aging infrastructure.

Because legacy OT systems and protocols were not built for security, internet connectivity gives threat actors a pathway to target and exploit these assets. In April 2026, EPA said the water sector is still an attractive target for groups trying to disrupt critical infrastructure in the United States.

EPA’s 2024 inspections found over 70% of water systems were not in full compliance with Safe Drinking Water Act requirements. Some inspected water systems had critical weaknesses including unchanged default passwords and no multifactor authentication.

CISA stated that Americans depend on safe drinking water and wastewater treatment each hour, and that the water sector underpins critical infrastructure and the national economy. EPA warned that attacks on drinking water and wastewater systems may interrupt treatment, add contaminants, harm equipment, and weaken public trust. CohnReznick states that municipal water settings mix core physical operations with older systems, remote upkeep requirements, limited staff, and tight budgets.

To reduce exposure, CISA recommended removing PLCs from the internet, using a VPN or secure gateway, changing default passwords and limiting access to an IP allow-list. For Rockwell Automation MicroLogix 1400 controllers, CISA pointed owners to vendor guidance for restoring access if passwords were changed.

To help operators recover from lockouts, CISA advised keeping verified backups of PLC images, so operators can recover if they get locked out of devices. CISA’s alert from July 30, 2026, says the attacks triggered boil water notices and compelled some utilities to run manual operations for an extended period.

CISA, the EPA and the FBI urge utilities to practice manual OT operations and to exercise cybersecurity incident response and recovery plans. Free federal resources for water utilities include the CISA and EPA water-sector toolkit and no-cost vulnerability scanning.

CISA, the EPA, and the FBI recommend inventories of IT assets including OT assets. CohnReznick said leaders should demand a basic asset list covering owner, location, vendor, remote-access method, most recent patch or maintenance date, and whether the asset reaches the internet.

Federal guidance recommends firewall rules or access lists allowing only authorized communication between control-system devices, plus logging and monitoring for unusual access or changes. CISA advises using verified clean PLC backups once PLCs are removed from the internet. The FBI and EPA advise checking PLC project files for unauthorized changes before backups are restored. CohnReznick said municipal leaders should consider PLC logic, SCADA settings, network diagrams, and manual runbooks to be critical recovery assets.