White House Executive Order: Securing the U.S. Bulk-Power System (2026)
On August 26, 2026, the White House declared a national emergency to secure the United States bulk-power system, prohibiting foreign-produced grid equipment that poses an unacceptable risk and directing the Secretary of Energy to mitigate cyber and supply-chain threats to the electric grid.
Why it matters for OT operators: Grid operators now face federal pressure to prove their OT is secure and their equipment is trusted. Continuous, passive visibility into what is on the network is the first step to meeting that bar.
The White House · August 26, 2026Primary source → (opens in a new tab)
U.S. Coast Guard OT Cybersecurity Rule for the Marine Transportation System (2025)
The U.S. Coast Guard issued the first mandatory federal cybersecurity framework for ports, vessels and waterfront facilities, requiring OT asset inventories, incident reporting and network monitoring. The rule took effect July 16, 2025, with cybersecurity plans due July 2027.
Why it matters for OT operators: MTSA-regulated facilities must now inventory and monitor their OT. Tabor produces that inventory and monitoring in minutes and maps it to the requirements of 33 CFR 101.600.
U.S. Coast Guard · July 16, 2025Primary source → (opens in a new tab)
New York DEC Water and Wastewater Cybersecurity Mandate (2026)
New York became the first U.S. state to mandate OT cybersecurity for water and wastewater facilities, requiring network monitoring, incident reporting and OT/IT separation by law. The regulation was signed March 11, 2026, with compliance deadlines running through the end of 2027.
Why it matters for OT operators: This is the template other states are following. Utilities in scope need monitoring evidence now, and Tabor generates it against the 6 NYCRR requirements.
New York State DEC · March 11, 2026Primary source → (opens in a new tab)
2026 Minnesota Water System Cyberattack
Over two days in July 2026, a coordinated cyberattack targeted more than 30 municipal water systems across Minnesota. The cities of Plymouth, South St. Paul, Maple Plain and Braham publicly confirmed the attacks, and a preliminary U.S. investigation provisionally attributed them to Iranian hackers.
Why it matters for OT operators: Small and mid-size water utilities are being hit directly. Most have no OT visibility and would not see an intrusion until it caused an outage. Passive monitoring changes that.
Public reporting (Wikipedia) · July 2026Primary source → (opens in a new tab)
CISA BRICKSTORM Advisory: A Self-Reinstalling Backdoor in Critical Infrastructure (2026)
CISA, the NSA and the Canadian Centre for Cyber Security jointly warned of BRICKSTORM, a backdoor attributed to Chinese state-sponsored actors that targets critical infrastructure and automatically reinstalls itself if removed.
Why it matters for OT operators: Persistent, self-healing implants live in OT network traffic. You cannot remediate what you cannot see, which is why continuous passive network visibility is the baseline control.
CISA, NSA and Canadian Centre for Cyber Security · February 2026Primary source → (opens in a new tab)
60 Minutes: China's Volt Typhoon Inside U.S. Water and Utility Networks (2025)
In an October 2025 60 Minutes report, the general manager of a small Massachusetts water utility recounted being told by the FBI that he was one of roughly 200 targets, and the former Director of the NSA warned that every utility in America is a target. Chinese actors had reportedly been dormant in networks for years before discovery.
Why it matters for OT operators: Attackers dwell quietly for months in OT networks that have no monitoring. Continuous passive visibility is how an operator finds them before they act.
CBS 60 Minutes · October 2025Primary source → (opens in a new tab)
GAO and EPA: 170,000 U.S. Water Systems Face Cyber Risk (2024)
A federal audit found critical or high-severity vulnerabilities in 97 drinking water systems serving 27 million Americans, and reported that fewer than 25 percent of water and wastewater operators perform annual cybersecurity risk assessments. Most have no OT visibility at all.
Why it matters for OT operators: The gap is visibility. Tabor closes it in under 15 minutes and produces the risk-assessment evidence AWIA and state regulators expect.
U.S. GAO and EPA Inspector General · 2024Primary source → (opens in a new tab)