Securing AI in operational technology: the joint CISA/NSA principles

What was published and by whom

CISA's announcement, dated December 3, 2025, says CISA and the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) published "Principles for the Secure Integration of Artificial Intelligence (AI) in Operational Technology (OT)". The announcement also says the guide was developed with the National Security Agency's Artificial Intelligence Security Center, which is the NSA's part in this work.

The Canadian Centre for Cyber Security published its own notice on the same date. The notice says the Cyber Centre joined CISA and international partners in releasing the guidance. Its partner list names the German BSI, the Netherlands' NCSC-NL, New Zealand's NCSC-NZ, the United Kingdom's NCSC-UK, the FBI and the NSA AISC alongside ASD's ACSC.

One limit applies to everything below. I was given the CISA press release and the Canadian Cyber Centre notice. I was not given the full joint publication, which both pages point readers to. This explainer covers what those two pages say and no more.

Who the guide is for and what it covers

CISA's announcement says the guide provides four key principles. It says they help critical infrastructure OT owners and operators "mitigate unique risks and achieve a balanced integration of AI into OT environments."

On technical scope, CISA says the guide focuses on machine learning (ML) and large language model (LLM) based AI, and on AI agents. CISA adds that the guidance may also be applied to systems augmented with traditional statistical modeling and other logic-based automation. If your plants run older statistical or rules-based automation, the announcement says the principles may still apply to them.

The four principles

CISA's announcement lists the four steps in short form. The Canadian notice names them slightly differently. Both lists describe the same four areas.

Understand AI. CISA says this step is to "Educate personnel on AI risks, impacts, and secure development lifecycles."

Assess AI use in OT. CISA says this step is to evaluate business cases, manage OT data security risks, and address immediate and long-term integration challenges. The Canadian notice words this principle as "Consider AI use in the OT domain."

Establish AI governance. CISA says this step is to implement governance frameworks, test AI models continuously, and ensure regulatory compliance. The Canadian notice calls this "governance and assurance frameworks."

Embed safety and security. CISA says this step is to maintain oversight, ensure transparency, and integrate AI into incident response plans.

Why the agencies say the principles matter

The Canadian notice lists the potential benefits for critical infrastructure owners and operators as increased efficiency and productivity, better decision-making, cost savings and an improved customer experience. It then states the risk side. It says that integrating AI into OT environments that manage essential public services "also introduces significant risks." It says these risks must be carefully managed to ensure the availability and reliability of critical infrastructure.

CISA Acting Director Madhu Gottumukkala is quoted in the CISA announcement. He says OT systems are the backbone of the nation's critical infrastructure, and that integrating AI into them "demands a thoughtful, risk-informed approach."

Nick Andersen, CISA's Executive Assistant Director for Cybersecurity, is also quoted. He says AI can enhance the performance of OT systems that power vital public services, but "it also introduces new avenues for adversarial threats."

Is this a requirement?

The two pages describe the guide as principles and use the language of encouragement. They do not describe a legal obligation, a deadline or an enforcement mechanism.

CISA's Andersen says CISA strongly encourages OT owners and operators to apply the principles. He says the purpose is to ensure AI is implemented "safely, securely, and responsibly." The Canadian notice uses similar wording. It says the Cyber Centre urges critical infrastructure owners and operators to review the guidance and implement the principles.

One governance item in the guide does refer to external obligations. The governance principle includes ensuring regulatory compliance. The pages do not say which regulations apply, so that question has to be answered from your own sector's rules and from the full publication.

Applying the principles in an OT program

The two pages do not give an implementation procedure, a control list or a maturity model. The mapping below restates the four principles as questions a security leader can put to an OT program. It adds no requirements of its own.

Understand AI. The principle names three subjects for personnel education: AI risks, AI impacts and secure development lifecycles. A security leader can ask who in the OT organization has been educated on each of those three, and who has not.

Assess AI use in OT. The principle names three tasks. The first is to evaluate the business case for each AI use. The second is to manage the security risks to OT data. The third is to address both immediate and long-term integration challenges. A security leader can ask whether each proposed or existing AI use in OT has a documented business case, and who owns the OT data security risks it creates.

Establish AI governance. The principle names governance frameworks, continuous testing of AI models and regulatory compliance. A security leader can ask whether a governance framework covers AI in OT, whether testing of AI models is continuous or a one-time exercise, and who confirms regulatory compliance.

Embed safety and security. The principle names oversight, transparency and incident response. A security leader can ask who maintains oversight of each AI-enabled OT system and what transparency into its behavior exists. They can also ask whether AI-related events appear in current incident response plans. The press release says AI should be integrated into those plans, which is the same point.

Scope decides which systems go through these questions. Because the guide says it may also apply to traditional statistical modeling and logic-based automation, an inventory of AI in OT could include those systems too.

What the two pages leave out

The pages do not say how often models should be tested, what "oversight" means in practice, or which controls make up a "governance framework." They do not name specific threats, attack techniques or incidents. They also do not say how the principles fit with existing OT security standards. Those details are likely to be in the full joint publication, which the Canadian notice links under the title "Principles for the secure integration of artificial intelligence in operational technology."

Before you set internal policy, read that publication directly. CISA also points readers to its Artificial Intelligence and Industrial Control Systems webpages for related resources, which I was not given.