At military installations and government-owned facilities, operational technology (OT) systems work 24/7 to monitor the physical systems and processes that sustain daily operations. Energy distribution systems, water and wastewater utilities, fuel storage and distribution, airfield lighting, and building control systems rely on OT to monitor and control critical processes in real time. As OT has become more advanced and interconnected, cyber threat actors have also become more sophisticated and deliberate in their tactics. What were once isolated control systems are now interconnected digital environments, making them targets for cyberattacks.

Having a robust OT cybersecurity framework in place helps to safeguard critical infrastructure from system breaches, shutdowns, physical damage, economic disruption, and threats to public safety and the environment.

Recent federal facility criteria updates illustrate this shift. A February 2026 review of newly released UFM and UFS documents found that only one portion contained an explicit OT cybersecurity section referencing UFC 4-010-06—and those that did relied on identical boilerplate language directing readers back to that core standard. In other words, detailed technical requirements remain centralized and must be deliberately integrated during planning and design.

Pond’s experience supporting complex infrastructure and facility programs, particularly in federally regulated environments, informs a practical approach to OT cybersecurity that considers how operational systems are planned, designed, and sustained across their full lifecycle.

OT Cybersecurity in Federal Infrastructure in the Digital Age 

Operational Technology refers to hardware and software used to monitor and control physical processes. Unlike information technology (IT), which primarily manages data and business systems, OT interacts directly with the physical world. In Department of Defense environments, many of these systems are formally categorized as Facility-Related Control Systems (FRCS), and they carry defined cybersecurity design requirements under UFC 4-010-06. Across military installations and federal facilities, common OT systems include:

• Industrial control systems (ICS)
• Supervisory Control and Data Acquisition (SCADA) systems
• Building automation and management systems

In practical terms, OT systems are responsible for opening valves, regulating temperature, controlling traffic signals, and maintaining safe operating conditions. When these systems are disrupted, the consequences extend beyond data leaks or service disruptions; they can affect public trust and safety.

From Isolation to Exposure: How OT Systems Became Exposed to Cyber Risk

Early OT systems were isolated, off-grid physical control systems that lacked Wi-Fi, Bluetooth, or other ways of connecting to the internet. Instead, these systems relied on physical access (such as a USB drive) to get to the data. Cybersecurity was not a primary design consideration because connectivity was limited.

Today’s facilities and assets increasingly rely on networked systems to improve efficiency, visibility, and overall decision-making. Physical assets are now deeply intertwined with digital networks. As a result, cyber risk has expanded beyond traditional IT environments and into the operational systems that keep critical services running.

In 2021, attackers gained access to the SCADA system at a municipal water treatment facility and attempted to alter chemical levels in the water supply. While the attempt was stopped, it demonstrated how cyber access to operational systems can translate directly into public safety risks.

As infrastructure becomes more interconnected, OT cybersecurity is no longer a niche technical issue. It is a core consideration for federal agencies responsible for designing, delivering, and operating complex systems.

Why Federal Agencies Must Prioritize OT Cybersecurity from the Start

For federal agencies delivering infrastructure programs, OT cybersecurity cannot be treated as a downstream compliance task or post-construction add-on. DoD design criteria, including UFC 4-010-06, establish formal cybersecurity requirements for facility-related control systems. However, recent guidance documents do not list specific controls within each publication. Detailed requirements for segmentation, system boundaries, and access controls reside within the UFC itself and must be interpreted within project architecture decisions.

A reactive approach exposes agencies to avoidable risk and compliance challenges. Effective risk management begins when system architectures are defined, access pathways are established, and integration strategies are determined.

By prioritizing OT cybersecurity during planning and design, federal agencies can:

• Reduce long-term risk exposure
• Clarify responsibility between engineering and cybersecurity teams
• Avoid costly retrofits
• Strengthen resilience and mission assurance

Early OT cybersecurity integration helps infrastructure investments to be secure, compliant, and sustainable throughout their lifecycle. 

Where OT Cybersecurity Fits in the Project Lifecycle

OT cybersecurity is often associated with operations, but planning, design, procurement, and system integration all influence how operational systems connect, how access is managed, and how risk is documented.

Key considerations may include:

• System architecture and network segmentation
• Vendor and integrator access controls
• Documentation of cybersecurity requirements in contracts
• Testing and transition into operations

Embedding cybersecurity within the project lifecycle supports proactive risk management and aligns infrastructure delivery with long-term performance and asset management goals. Recent federal criteria updates show variation in how cybersecurity is incorporated across facility documents. This inconsistency underscores the importance of subject matter expertise when interpreting requirements and aligning them with mission-critical infrastructure delivery.

Conclusion: OT Cybersecurity as a Core Infrastructure Consideration

OT cybersecurity reflects a fundamental shift in how infrastructure and facilities operate in a connected world. As physical systems become more digital, managing cyber risk becomes inseparable from managing operational risk.

For government and federal agencies, understanding the basics of OT cybersecurity is the starting point, not the finish line. As standards evolve and IT and OT systems continue to converge, cybersecurity must be treated as a core infrastructure design and lifecycle consideration. Organizations that integrate OT cybersecurity early—aligning architecture decisions with federal standards and secure-by-design principles—position themselves to strengthen resilience, maintain compliance, and protect mission continuity over the long term.

Pond’s multidisciplinary teams bring together engineers, cybersecurity specialists, and federal program experts to help agencies integrate OT cybersecurity into facility planning, modernization, and sustainment efforts. From aligning with federal frameworks to incorporating secure-by-design principles into mission-critical infrastructure, our approach is designed to strengthen operational resilience while supporting long-term program objectives.

Learn more about how Pond supports secure, resilient infrastructure across federal markets.