Introducing AI in operational technology (OT) environments can “introduce risks that require careful management to support the safety, security, and reliability of OT systems,” according to the latest Cybersecurity and Infrastructure Security Agency (CISA) guidance.

This guidance document – called “Principles for the Secure Integration of Artificial Intelligence in Operational Technology” – outlines how critical infrastructure owners and operators can help ensure the safety and security of OT environments.

Specifically, it explores the following general principles to help reduce risk when integrating AI into OT systems:

1. Understand AI risks. Understand the unique risks and potential impacts of AI integration into OT environments, the importance of educating personnel on these risks, and the secure AI development lifecycle.
2. Consider AI use in the OT domain. Assess the specific business case for AI use in OT environments and manage OT data security risks, the role of vendors, and the immediate and long-term challenges of AI integration.
3. Establish AI governance and assurance frameworks. Implement robust governance mechanisms, integrate AI into existing security frameworks, continuously test and evaluate AI models, and consider regulatory compliance.
4. Embed safety and security practices Into AI and AI-enabled OT systems. Implement oversight mechanisms to ensure the safe operation and cybersecurity of AI-enabled OT systems, maintain transparency, and integrate AI into incident response plans.

The document was co-authored by the Cybersecurity and Infrastructure Security Agency (CISA) and Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), in collaboration with other US and international agencies.

Read the complete guidelines at CISA.