Photo By William Farrow | Operational Technology, or OT, includes the systems controlling and monitoring...... read more read more
REDSTONE ARSENAL, Ala. — The U.S. Army Engineering and Support Center, Huntsville, has completed a major milestone in its effort to improve the cybersecurity of operational technology systems across the Department of Defense, providing military leaders with the data needed to prioritize modernization, manage cyber risk and plan future investments.
The Huntsville Center recently completed a comprehensive operational technology inventory for the U.S. Army Reserve and is delivering final inventory products for the Defense Logistics Agency, while work continues in support of the Army National Guard.
The inventories mark the completion of the program's first phase, shifting the focus from identifying assets to developing remediation strategies and long-term sustainment plans.
Operational Technology, or OT, includes the systems controlling and monitoring facilities and infrastructure, such as heating, ventilation and air conditioning systems, fire alarms, access control systems, surveillance cameras, building management systems and medical equipment.
Specifically, such systems fall under the category of Facility-Related Control Systems (FRCS), a subset of control systems used to monitor and control equipment and systems related to Department of War real property facilities.
As these systems become increasingly connected to enterprise networks, they are now subject to cybersecurity requirements traditionally applied only to information technology systems.
"Operational technology is no longer isolated infrastructure," said Kevin Miller, Huntsville Center Operational Technology Branch project manager.
"These systems have digital identities, communicate across networks and directly support critical missions,” Miller said.
“Before organizations can secure them, they have to know exactly what they own, where it is and what risks it presents."
The program began with inventory contracts for the Army Reserve in fiscal year 2021, followed by National Guard efforts awarded through 2024. While the Reserve inventory is complete and Defense Logistics Agency deliverables are nearing completion, National Guard assessments remain ongoing, with additional sustainment efforts already under consideration.
During the first phase, teams conducted detailed inventories across hundreds of facilities, documenting thousands of operational technology assets. Each inventory captured information including system ownership, operating system, serial number, Internet Protocol and Media Access Control addresses, end-of-life dates and cybersecurity risk levels.
The resulting data provides Army Reserve commanders and facility managers with a comprehensive risk register and a long-term roadmap for budgeting equipment replacement and modernization over the next five to 20 years. Under the direction of Huntsville Center, contractors covered over 40 million square feet at facilities across the nation and inventoried nearly ten thousand devices for the Army Reserve.
"The inventory is much more than a list of equipment," Miller said. "It becomes a decision-making tool that allows leadership to prioritize funding, address the highest risks first and build realistic modernization plans instead of reacting to problems one year at a time."
The inventories also revealed significant cybersecurity challenges. Many facilities continue to rely on outdated operational technology that was designed decades ago, including unmanaged commercial network switches and legacy operating systems. Much of that equipment cannot meet current cybersecurity accreditation standards and, in many cases, cannot be adequately secured.
Historically, many facility systems remained in service if they continued functioning. However, evolving cybersecurity guidance now requires many operational technology systems to comply with Risk Management Framework and Authority to Operate requirements because they possess network connectivity or digital components.
According to Miller, those changes make visibility into operational technology assets essential. "If you don't know what's connected to your network, you can't manage the risk," he said.
"The inventory establishes that baseline so organizations can determine whether a system can be patched, upgraded, isolated through compensating controls or needs to be replaced entirely."
Not every operational technology system can be secured using traditional information technology practices. Some legacy devices cannot tolerate intrusive vulnerability scanning, while others lack the capability to support modern security controls. In those cases, organizations must rely on alternative protective measures, including physical security, restricted network access, architectural segmentation and Plans of Action and Milestones.
To avoid disrupting mission-critical systems during inventories, project teams use nonintrusive discovery techniques that identify network characteristics without affecting system operations.
The next phase of the program focuses on developing remediation plans outlining how each system can achieve cybersecurity compliance through software updates, hardware refreshes, compensating controls or complete replacement.
The final phase will establish continuous monitoring processes that maintain current inventories while tracking cybersecurity posture over time.
Miller said consolidating operational technology infrastructure into centralized network enclaves and virtualized environments can further improve cybersecurity while reducing long-term operating costs. "Centralized architectures provide greater visibility, simplify maintenance and reduce the overall attack surface," he said.
"Instead of managing hundreds of isolated systems independently, organizations can monitor and secure them through enterprise services while supporting the mission more efficiently."
The program has also highlighted organizational challenges beyond technology.
Responsibility for operational technology often spans multiple stakeholders, including installation facilities organizations and information technology offices, creating coordination and accreditation challenges. Access restrictions and varying state-level approval processes have also affected inventory efforts in some locations.
Despite those obstacles, the completed inventories provide organizations with a comprehensive understanding of their operational technology environments and establish a foundation for future modernization.
Huntsville Center’s Facility Related Control Systems Cybersecurity Mandatory Center of Expertise assisted in the creation and execution of a quality assurance (QA) process to ensure that relevant stakeholders received deliverables that gave them more insight into their existing infrastructure and a foundation upon which they could strengthen their cybersecurity posture.
Patrick Phillips, FRCS MCX information security systems analyst, travelled extensively to perform QA inspections on contractor inventory activities in the field. Phillips observed contractor activities to ensure that the inventories were being conducted safely and in a cybersecure manner according to the relevant cybersecurity standard.
“I’m not partial to travel,” said Phillips, “but I saw a real value to the customer with me being on site with the contractors.”
Zachary Allen, FRCS MCX information security systems analyst, also participated in both the active (i.e., QA visits) and reactive portion of the QA process by reviewing contractor deliverables for thoroughness, technical accuracy, and adherence to the applicable contract. For the Army Reserve alone, the contractors created over thirty-three thousand files with Allen reviewing a large representative sample.
As agencies continue transitioning toward more secure and sustainable operational technology environments, Ron Brook, Huntsville Center Operational Technology branch chief, said the program's phased approach—from inventory and discovery to remediation and continuous monitoring—offers a practical roadmap for reducing cyber risk while enabling long-term investment planning.
"The goal isn't simply to document existing equipment," Brook said. "It's to give leaders the information they need to protect critical infrastructure, make informed investment decisions and ensure these systems remain secure and reliable for years to come."
| Date Taken: | 07.31.2026 |
| Date Posted: | 07.31.2026 15:24 |
| Story ID: | 571270 |
| Location: | US |
| Web Views: | 15 |
| Downloads: | 0 |
This work, Huntsville Center expertise identifies, prioritizes operational technology risks, by William Farrow, identified by DVIDS, must comply with the restrictions shown on https://www.dvidshub.net/about/copyright.
No keywords found.
