Fortinet Report: OT Security Governance Shifts to CISO as Maturity and Board-Level Concern Rises
OT Cybersecurity Becomes a Board-Level Priority, Fortinet Report Finds
Related Entities
Organizations
Full Report
Executive Summary
The governance of operational technology (OT) security is undergoing a fundamental transformation, moving from a niche factory-floor issue to a C-suite and board-level priority. According to Fortinet's 2025 State of Operational Technology and Cybersecurity Report, published on June 10, 2026, the responsibility for securing OT is rapidly consolidating under the Chief Information Security Officer (CISO). The report found that over half of organizations have already made this shift, up from just 16% in 2022, with 81% intending to do so within the next year. This centralization of security governance reflects a growing understanding of the severe business risks associated with cyber-physical systems. The study also draws a clear line between security maturity and operational resilience, noting that organizations with more advanced security practices suffer fewer and less severe operational disruptions from cyberattacks.
Regulatory Details
The report highlights several key trends and statistics regarding the state of OT security:
- Shift in Governance: The most significant finding is the shift of OT security responsibility to the CISO/CSO. This indicates that organizations are moving towards a unified cybersecurity strategy that encompasses both IT and OT environments.
- Maturity and Resilience: There is a direct correlation between the maturity of an OT security program and its effectiveness. Organizations with mature practices (e.g., network segmentation, threat intelligence integration) reported fewer intrusions and less impact on revenue and operations.
- Impact of Intrusions: While nearly half of all organizations still experienced cyber incidents that affected OT, the percentage of those that led to revenue-impacting outages decreased from 52% to 42%, suggesting that improved security measures are having a positive effect on resilience.
- Driving Factors: Key drivers for increased focus on OT security include the need for operational resilience, cost reduction (by avoiding downtime), and growing expectations of new regulatory requirements. Compliance is becoming a major objective for OT security programs.
Affected Organizations
This report is relevant to all organizations that operate Industrial Control Systems (ICS) or other forms of OT. This includes a wide range of industries:
- Manufacturing
- Energy (Oil, Gas, Electric)
- Transportation and Logistics
- Critical Infrastructure (Water, Waste)
- Healthcare (for medical devices)
- Building Management
Compliance Requirements
While the report doesn't detail specific regulations, it notes that the anticipation of new government mandates is a significant driver for improving OT security. Organizations are increasingly being required to meet standards such as:
- NIST Cybersecurity Framework (CSF)
- ISA/IEC 62443 series of standards for IACS security
- NERC CIP (for the North American bulk electric system)
- TSA Pipeline Security Directives
Organizations are expected to implement technical controls like network segmentation, access control, and continuous monitoring to meet these compliance obligations.
Impact Assessment
The findings of the Fortinet report have several business and operational implications:
- Increased Investment: The board-level focus will likely lead to increased budgets and resources for OT security initiatives.
- Organizational Change: The shift of responsibility to the CISO will require breaking down silos between IT and OT teams, fostering collaboration, and cross-training staff.
- Technology Convergence: Organizations will increasingly look for security solutions that can provide visibility and control across both IT and OT environments.
- Risk Management: OT cyber risk will be integrated into the overall enterprise risk management framework, rather than being treated as a separate, isolated issue.
Compliance Guidance
Based on the report's findings, organizations should take the following steps to mature their OT security programs:
- Establish Clear Governance: Formally assign responsibility for OT security to the CISO and establish a clear governance structure that includes stakeholders from both IT and OT departments.
- Adopt a Framework: Use an established cybersecurity framework like NIST CSF or ISA/IEC 62443 as a guide to build and measure the maturity of the OT security program.
- Implement Foundational Controls: Prioritize the implementation of foundational security controls, starting with a comprehensive asset inventory, network segmentation, and robust access control.
- Invest in OT-Specific Security Tools: Deploy security solutions that are purpose-built for OT environments and can passively monitor industrial protocols without disrupting operations.
- Develop an Incident Response Plan: Create and regularly test an OT-specific incident response plan that accounts for the unique safety and operational requirements of industrial environments.
Timeline of Events
MITRE ATT&CK Mitigations
A key practice identified in the report that correlates with higher security maturity and fewer operational disruptions.
Implementing firewalls and access control lists between IT and OT zones is a foundational step in securing industrial environments.
D3FEND Defensive Countermeasures
As highlighted by the Fortinet report, network segmentation is a cornerstone of a mature OT security program. Organizations should prioritize implementing a defensible architecture based on the Purdue Model. This involves creating a distinct OT network, isolated from the corporate IT network by a firewall-controlled DMZ. This prevents threats from easily spreading from IT to OT. Within the OT network, further micro-segmentation should be used to isolate critical control systems from each other. This is the most effective architectural control for limiting the blast radius of a cyberattack and improving operational resilience.
To achieve the visibility needed for board-level risk reporting, organizations must deploy OT-aware network security monitoring tools. These solutions connect passively to the network via a SPAN port and can decode industrial protocols (like Modbus, S7, DNP3) to identify anomalous or malicious activity without risking operational disruption. This provides the CISO with crucial data on threats within the OT environment, enables detection of misconfigurations, and helps enforce segmentation policies. This visibility is fundamental to managing cyber-physical risk effectively.
As IT and OT converge, managing access becomes paramount. Organizations should extend their Identity and Access Management (IAM) programs to the OT environment. This means enforcing the principle of least privilege for all users and systems accessing OT assets. Role-based access control (RBAC) should be implemented to ensure engineers and operators only have access to the systems they need to do their jobs. For remote access, secure methods with Multi-Factor Authentication must be mandated. Centralizing access control under the CISO's purview, as the report indicates is happening, allows for consistent policy enforcement across the entire enterprise.
Timeline of Events
Fortinet publishes its 2025 State of Operational Technology and Cybersecurity Report.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.