Key takeaways
- No, on both counts.
- Run your own exposure scan, the way CISA runs one against FCEB networks.
CISA's Binding Operational Directive 23-02, issued 13 June 2023, requires only Federal Civilian Executive Branch agencies to pull specific internet-exposed management interfaces — on routers, firewalls, VPN concentrators, load balancers and out-of-band controllers like iLO or iDRAC — off the public internet within 14 days of discovery, or isolate them behind a Zero Trust policy enforcement point; it says nothing about PLCs, HMIs or any other OT/ICS device, and binds no one outside federal civilian agencies. That narrow legal scope is exactly why OT/ICS operators tend to wave the directive away as somebody else's compliance problem — but CISA's own 2026 advisories against internet-exposed Siemens, Rockwell and Schneider Electric PLCs describe the identical exposure pattern BOD 23-02 was written to fix.
What BOD 23-02 actually requires
| BOD 23-02 | |
|---|---|
| Bound organizations | Federal Civilian Executive Branch (FCEB) agencies only |
| In-scope device classes | Routers, switches, firewalls, VPN concentrators, proxies, load balancers, out-of-band server management interfaces (e.g. iLO, iDRAC) |
| In-scope protocols | HTTP, HTTPS, FTP, SNMP, Telnet, TFTP, RDP, rlogin, RSH, SSH, SMB, VNC, X11 |
| Remediation deadline | 14 days from CISA notification or agency discovery |
| Compliance options | Remove the interface from the internet entirely, or front it with a Zero Trust-aligned policy enforcement point separate from the interface itself |
| Explicitly out of scope | Cloud service provider web applications/management portals and their APIs |
CISA's own role under the directive is active, not passive: it scans for in-scope interfaces across FCEB networks and reports positive findings to each agency through CyberScope, then reports FCEB-wide compliance status to OMB and DHS within six months and annually thereafter.
Does BOD 23-02 apply to OT/ICS devices, or the private sector?
No, on both counts. The directive's own text and CISA's implementation guidance scope it to FCEB agencies, and the device classes it names — enterprise routers, firewalls, proxies, load balancers and server out-of-band management — are IT network infrastructure. Neither document mentions PLCs, HMIs, engineering workstations, SCADA servers, or any OT/ICS-specific protocol. A private-sector device maker or OT asset owner is under no legal obligation created by this directive.
What CISA has done instead is say, publicly, that the underlying problem is not federal-specific: "while this Directive only applies to federal civilian agencies, ... the threat extends to every sector," and it recommends all organizations review and adopt the same guidance voluntarily. That recommendation is where OT/ICS relevance actually starts.
Why does the same exposure pattern keep showing up in CISA's OT advisories?
Three 2026 CISA publications make the connection concrete, not hypothetical:
AA26-097A(7 April 2026, updated 22 July 2026), issued jointly by the FBI, CISA, NSA, EPA, DOE and US Cyber Command, describes Iranian-affiliated actors exploiting internet-exposed PLCs across US critical infrastructure — Rockwell Automation/Allen-Bradley CompactLogix and Micro850, Schneider Electric BMX P34/Modicon M340, and Siemens S7-1200 devices among them — reaching the devices directly over the internet on ports including 502, 2222, 44818, 102 and 22 (the last for cellular modems used as a connection path), then manipulating HMI/SCADA displays and project files. CISA's own top recommendation was to disconnect the PLC from the public internet — the same first remediation option BOD 23-02 gives FCEB agencies. A 30 July 2026 CISA alertto the water and wastewater sector describes threat actors locking operators out of exposed PLCs by changing passwords and IP addresses, in incidents that led to boil-water notices and sustained manual plant operation. CISA's Internet Exposure Reduction Guidance(21 August 2026, updated 25 August 2026) was published directly in response to that pattern, and explicitly names industrial IoT, SCADA and ICS assets as part of its scope alongside IT — urging organizations to route OT remote access through a managed gateway rather than a direct connection to a PLC, HMI or RTU, and to routinely run exposure-discovery tools (Shodan, Censys, Thingful, Shadowserver) against their own footprint.
The throughline is the same in both the federal-IT and OT worlds: an administrative interface reachable from the open internet gets found by scanning tools attackers and defenders both use, and "found" becomes "exploited" faster than most asset owners expect. See S7comm protocol security for how this exact mechanism played out against Siemens S7 PLCs specifically in a separate, later 2026 advisory.
What should an OT/ICS asset owner or device maker actually do?
Run your own exposure scan, the way CISA runs one against FCEB networksCheck your organization's public IP ranges against Shodan, Censys or a similar internet-wide scanning service, and treat a hit on an engineering-software or ICS protocol port (102, 502, 2222, 44818, and standard remote-access ports like RDP/SSH/HTTP) as a finding to act on, not a surprise to be alarmed by later. Apply BOD 23-02's own two remediation options, even though it doesn't legally bind youEither remove the management or engineering interface from direct internet reachability, or put an actual policy enforcement point — a jump host, firewall, or VPN concentrator you control — in front of it. A device's own login page is not a policy enforcement point. Treat vendor engineering software as a management interface, even though BOD 23-02's literal device list doesn't name it. TIA Portal/STEP 7 sessions to a Siemens PLC, or Studio 5000 sessions to a Rockwell controller, carry the same administrative capability the directive is built to protect on IT infrastructure. Build the inventory before the policyA 14-day remediation clock is meaningless against a management interface you don't know exists; an accurate device and remote-access inventory has to come first.
A passive network read is one practical way to get that inventory without taking anything offline: SoftWSP's OT Snapshot service has an engineer record 24 to 72 hours of shop-floor traffic from a mirror port and turns it into a device inventory, a list of what is reachable and how, and an AI-assisted report where every finding cites the traffic that produced it, reviewed by an engineer before it goes out — a pcap-based read of what is actually talking, and to what, rather than a guess at what the network diagram says should be there.
BOD 23-02 and its implementation guidance are fetched directly from CISA's own pages; the device and protocol lists, deadlines, and advisory details above are quoted or closely paraphrased from those primary sources. This guide is general information, not a compliance determination for any specific sector or organization — confirm applicability of any CISA directive or alert against the current published text.
Sources
- CISA: BOD 23-02 — Mitigating the Risk from Internet-Exposed Management Interfaces (directive text)
- CISA: BOD 23-02 Implementation Guidance for Mitigating the Risk from Internet-Exposed Management Interfaces
- CISA: Internet Exposure Reduction Guidance (resources-tools)
- CISA/FBI/NSA/EPA/DOE/US Cyber Command Advisory AA26-097A: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (7 April 2026, updated 22 July 2026)
- CISA Alert: CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs (30 July 2026)
Frequently asked questions
Is CISA Binding Operational Directive 23-02 legally binding on OT/ICS operators or private companies?
No. BOD 23-02, issued 13 June 2023, is a binding operational directive under the Cybersecurity Act of 2015, and CISA's own directive scopes it to Federal Civilian Executive Branch (FCEB) agencies only. It creates no legal obligation for OT/ICS asset owners, device makers, or any private-sector organization. CISA's implementation guidance for the directive contains no OT/ICS-specific language at all — the devices it names (routers, switches, firewalls, VPN concentrators, proxies, load balancers, and out-of-band server management interfaces such as iLO and iDRAC) are enterprise IT network infrastructure, not PLCs, HMIs, or other industrial control devices. CISA has, however, publicly and repeatedly encouraged every sector to adopt the same practice voluntarily.
What exactly counts as a 'management interface' under BOD 23-02?
Per the directive and its implementation guidance, a covered management interface is a dedicated device interface, accessible over a network protocol, meant exclusively for authorized users to perform administrative activities on a device, a group of devices, or the network itself. The guidance lists the in-scope network protocols by name: HTTP, HTTPS, FTP, SNMP, Telnet, TFTP, RDP, rlogin, RSH, SSH, SMB, VNC, and X11. Web applications and interfaces used to manage cloud service provider offerings, including APIs and cloud management portals, are explicitly out of scope.
What does an FCEB agency actually have to do, and by when?
Within 14 days of CISA notifying an agency of an exposed interface, or of the agency discovering one itself, the agency must take at least one of two actions: remove the management interface from the public internet entirely (physical removal, VLAN segmentation, internal non-routable addressing, or a firewall), or protect it with Zero Trust-aligned capabilities that enforce access control through a policy enforcement point separate from the interface itself. CISA scans for in-scope devices and reports findings to agencies through CyberScope; agencies that cannot meet a deadline must notify CISA and submit a remediation plan.
Does CISA have separate guidance for internet-exposed OT, ICS or SCADA assets?
Yes, and it is more directly useful to an OT/ICS operator than BOD 23-02 itself. CISA's Internet Exposure Reduction Guidance, published 21 August 2026 and updated 25 August 2026, extends the same reduce-and-secure-remote-access logic to IT and OT/ICS/SCADA/IIoT assets together, and explicitly tells critical infrastructure organizations to route all necessary remote access through a secure gateway, firewall, VPN, or other centrally managed access solution rather than connecting directly to a PLC, HMI, or remote terminal unit (RTU). It also recommends routinely running exposure-discovery tools such as Shodan, Censys, Thingful, and Shadowserver against an organization's own IT and OT footprint — the same discovery method CISA uses against federal networks under BOD 23-02.
What should an OT/ICS operator do if no directive legally applies to them?
Treat BOD 23-02's own remediation options — remove the interface from the internet, or put a real policy enforcement point in front of it — as the practical baseline anyway, and confirm it against your own exposure rather than assuming it. CISA's 2026 advisories against internet-exposed Siemens, Rockwell and Schneider Electric PLCs describe attackers using the same public scanning services (Censys, Shodan, ZoomEye) CISA itself uses to find exposed federal interfaces. An asset owner that has never checked what its own IP ranges look like from Shodan or Censys is, in practice, relying on nobody having looked yet — not on being out of scope.
In this cluster
