Operational technology (OT) security has moved from the server room to the plant floor. As manufacturers, utilities, and critical infrastructure operators converge information technology (IT) and OT networks, a single unplanned outage can freeze programmable logic controllers (PLCs), halt production, and trigger cascading regulatory and reputational damage. The latest multinational guidance on IT/OT outage communications — issued September 2, 2026, by the Canadian Centre for Cyber Security and co-sealed by the FBI, CISA, and international partners — reframes how vendors and service providers talk about incidents as a core resilience control, not a public-relations afterthought.
For industrial automation buyers, the signal is unambiguous: the vendors and integrators you rely on for PLCs, HMIs, and SCADA systems are now expected to communicate failures with the same rigor they apply to engineering them.
Why Outage Communications Became an OT Security Priority
OT environments prioritize availability and physical safety over data confidentiality. When a PLC or controller fails — whether from a cyber intrusion or a routine fault — operators need immediate, accurate information to decide whether to isolate a line, switch to manual fallback, or shut down safely.
Historically, however, service providers have often defaulted to vague or delayed messaging during incidents. The new guidance argues that this silence erodes situational awareness, undermines trust, and slows recovery at the exact moment speed matters most.
Market Trend: Outage communications is emerging as a procurement differentiator. Asset owners increasingly evaluate vendors on incident-response transparency, because a supplier that communicates poorly during a fault can extend downtime far beyond the original technical failure.
What the Multinational Guidance Actually Requires
Published under the title "Communicating Under Pressure: Best Practices for Service Providers," the guidance targets technology and critical infrastructure providers supporting both IT and OT systems. Its recommendations apply regardless of whether an outage stems from malicious cyber activity or a non-malicious event.
The four core measures in the joint guidance
-
Develop a communications plan with defined incident thresholds and clearly identified target audiences.
-
Practice transparency and use plain-language messages that avoid PR spin.
-
Provide root cause analysis and technical information that end users can act on.
-
Align all messaging with legal and regulatory requirements.
The co-sealed FBI guidance adds that providers should state clearly what is known and unknown, and give customers actionable guidance while investigations and remediation are still underway.
The emphasis on plain language is particularly relevant in OT. Plant engineers and control-system technicians need precise, operational detail — not corporate boilerplate — to contain a failure affecting PLC logic and physical processes.
Analyst Insight: The convergence of IT and OT has exposed a communications gap. IT teams speak in terms of confidentiality and data; OT teams speak in terms of uptime and safety. Standardized outage communications are a practical bridge between the two disciplines.
PLCs in the Crosshairs: The Threat Context Behind the Guidance
The guidance does not arrive in a vacuum. It lands amid a sustained wave of activity targeting programmable logic controllers — the devices that translate control logic into physical action on factory floors, in water treatment plants, and across energy grids.
Recent PLC threat data shaping the urgency
-
Aug 19, 2026 (AA26-231A): CISA warned of threat actors actively targeting Siemens S7 Series PLCs, with mitigations for ongoing threats to OT devices.
-
2025–26: An Iran-affiliated campaign pursued internet-exposed PLCs across U.S. water and wastewater utilities, energy facilities, and government installations.
-
CyberAv3ngers (2023): Exploitation of Rockwell Automation / Allen-Bradley PLCs, including default credentials and HMI defacement at small utilities.
For each of these incidents, the difference between a contained event and a prolonged outage often hinged on how quickly operators received accurate information about which controllers were affected and what actions were safe to take.
The IT/OT Communications Gap and Why It Persists
Traditional IT security frameworks assume rapid patching and frequent reboots. OT systems — particularly legacy PLCs running proprietary protocols — cannot always tolerate those disruptions without risking process instability.
This mismatch means outage communications must be tailored. A generic "service disruption" notice is useless to a plant manager who needs to know whether a specific PLC has been compromised, whether manual fallback is viable, and whether safety interlocks remain intact.
Market Trend: Expect outage communications requirements to flow into procurement contracts. Vendors that can demonstrate documented communication plans and root-cause disclosure are better positioned to win critical infrastructure and industrial automation deals.
What This Means for Industrial Automation Buyers
For teams selecting PLCs, controllers, and automation vendors, the guidance reframes resilience as a vendor-relationship issue as much as a hardware issue. Buyers should now ask suppliers pointed questions about their outage communication practices before signing.
Five questions to ask PLC and automation vendors before procurement
- Do you maintain a documented outage communications plan with defined thresholds and audiences?
- How quickly do you issue plain-language incident notifications that distinguish known facts from unknowns?
- Will you provide root cause analysis and actionable technical guidance during active investigations?
- How do you coordinate messaging across IT and OT customers when a single incident affects both?
- Are your communications aligned with sector-specific legal and regulatory obligations?
Frequently Asked Questions
Does the IT/OT outage guidance apply only to cyberattacks?
No. The guidance explicitly covers outages caused by both malicious cyber activity and non-malicious events, recognizing that the communications principles — clarity, transparency, and actionable detail — are identical in either scenario.
Why are PLCs singled out in OT security discussions?
Programmable logic controllers execute the logic that drives physical processes. If a PLC is compromised or fails, attackers or faults can manipulate machinery, disable safety functions, or halt production — making PLC-specific incident information critical for safe recovery.
Is this guidance legally binding?
The joint guidance itself is advisory best practice rather than regulation. However, it aligns with existing legal and regulatory obligations, and procurement contracts or sector regulators may adopt its measures as enforceable requirements over time.
The September 2026 guidance marks a maturing of OT security thinking: resilience is no longer just about patching PLCs and segmenting networks. It now includes how clearly and quickly the ecosystem communicates when those defenses fail.
