Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI) and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC),along with other international partners and federal agencies have unveiled the joint cybersecurity guidance for critical infrastructure owners and operators integrating AI into their Operational Technology (OT) systems.

This guidance outlines the following four key principles:

• Understand AI: Understand the unique risks and potential impacts of AI integration into OT environments, the importance of educating personnel on these risks, and the secure AI development lifecycle.
• Consider AI Use in the OT Domain: Assess the specific business case for AI use in OT environments and manage OT data security risks, the role of vendors, and the immediate and long-term challenges of AI integration.
• Establish AI Governance and Assurance Frameworks: Implement robust governance mechanisms, integrate AI into existing security frameworks, continuously test and evaluate AI models, and consider regulatory compliance.
• Embed Safety and Security Practices Into AI and AI-Enabled OT Systems: Implement oversight mechanisms to ensure the safe operation and cybersecurity of AI-enabled OT systems, maintain transparency, and integrate AI into incident response plans.

“It focuses on machine learning, large language model-based AI, and AI agents because of the complex security considerations and challenges they pose, but the guidance also applies to systems augmented with traditional statistical modeling and logic-based automation,” CISA said.

CISA, along with the other agencies, encourage critical infrastructure owners and operators to review and follow the guidance to adopt a balanced approach to integrating AI into their OT environments, while continuously monitoring, validating, and refining their AI models.