In May 2025, CISA, the FBI, EPA and DOE listed five primary mitigations for operational technology: get OT off the public internet, replace default passwords, secure remote access, separate IT and OT networks, and practice running the process manually. They are basic, and that is the point.
1. Disconnect OT from the public internet
The first item is to disconnect OT devices from the public internet and remove unintended exposure. Start by finding out what is exposed. Many teams are surprised by a controller, camera or gateway that someone connected for convenience years ago.
If a device must be reachable, put something in front of it, as covered below. If nobody can say why it is reachable, that is your answer.
2. Replace default passwords
The guidance says to change default passwords right away and use strong, unique credentials, especially on internet-facing devices that can control OT. The December 2023 advisory on Unitronics PLCs shows why. As described in our post on that campaign, actors got in because devices had a default password or none.
Keep a record of which devices still use vendor defaults. A short spreadsheet beats a long intention.
3. Secure remote access
The agencies recommend private network connections where possible, VPNs with strong passwords and phishing-resistant multifactor authentication, least privilege, and disabling dormant accounts. Remote access shows up in nearly every public OT incident write-up, so it deserves its own review. See why OT remote access is the weak point.
4. Separate IT and OT
Use segmentation and a demilitarized zone for passing control data to enterprise systems. The aim is that a compromised office laptop cannot talk straight to a controller. Draw the network as it really is, not as the diagram says. Then list every path that crosses the line.
5. Practice running manually
The last mitigation is the one most often skipped: keep the ability to run OT systems manually, and test backups, standby systems and continuity plans on a schedule. If ransomware or an intruder forces you to shut down the networked parts, can operators still keep the process safe? A drill answers that better than a policy does.
The agencies also advise regular coordination with managed service providers, system integrators and manufacturers to find misconfigurations.
A sensible order of work
- Week one: inventory exposure and defaults.
- Month one: fix defaults, close unneeded exposure, review remote access accounts.
- Quarter one: segmentation changes and a first manual operations drill.
Adjust for your own change windows and safety reviews. Anything that touches a live process needs engineering sign-off.
Quick check
Who published the five mitigations?
CISA, the FBI, the EPA and the Department of Energy, on 6 May 2025.
Do these apply only to large utilities?
No. The steps are low cost and general, which is why they suit small operators well.
Safeguard's asset discovery and dependency scanning can help you list the software you run around your controls, and the free scan at gold.safeguard.sh/scan is a quick start. It is not an OT network monitoring tool.
Sources
Last reviewed: 19 October 2026.
