Agencies issue guidance on secure connectivity for operational technology

U.S. and international agencies Jan. 14 released guidance on secure connectivity for operational technology environments. Examples of OT environments in health care include tools that manage energy control, HVAC, life-safety systems, door access controls, physical security systems and alarms. The guidance explains why organizations can face challenges prioritizing cybersecurity for OT, due to constraints such as dependence on legacy technologies ill-equipped for modern connectivity or security requirements. The guidance also outlines eight principles to be used as a framework to design, secure and manage OT environment connectivity.

“For hospitals, collaboration between OT owners, vendors and the cybersecurity team is critical and should begin at the OT acquisition phase,” said Scott Gee, AHA deputy national advisor for cybersecurity and risk. “Hospitals should also assess what impacts the loss of OT systems, such as building automation and HVAC systems, can have on clinical continuity and care delivery. For connected life-critical and mission-critical OT systems, it is strongly recommended that they have manual override features and the ability to operate independently, off-network.”

For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.