Report
MeriTalk, in partnership with Claroty, surveyed 100 OT/CPS security administrators and managers across federal civilian and DOD agencies. This report examines the state of Federal OT security, identifies critical strategy gaps, and offers recommendations to strengthen resilience.
Cyber-physical systems (CPS) now sit at the heart of federal mission delivery – powering everything from weapons platforms and traditional Building Management Systems (BMS)/Facility-Related Control Systems (FRCS) controls to the Internet of Things (IoT) and connected medical devices.
For this research, CPS include OT, BMS/FRCS, IoT devices, and medical devices that bridge the digital and physical worlds. These systems integrate sensing, computation, control, networking, and analytics to interact with the physical environment, including human operators.
As these once-isolated environments increasingly converge with enterprise IT, the task of protecting the digital-physical seam has become both a strategic imperative and a key battleground for nation-state adversaries. New policy shifts underscore the urgency.
The Department of Defense (DOD)’s forthcoming zero trust for operational technology (OT) blueprint, the NIST Cybersecurity Framework 2.0 update, and high-profile campaigns like Volt Typhoon have elevated OT and CPS defense from a specialized concern to a governmentwide priority.
Building on the 2024 Guardians of Government report, MeriTalk and Claroty’s 2025 research offers a sharper, year-over-year lens into federal CPS resilience. Drawing on responses from 100 OT/CPS security administrators and managers across federal civilian and DOD agencies, the study explores:
• Evolving OT/CPS strategies – How architectures, governance, and assessments are maturing
• Zero trust momentum – How new mandates and emerging threats are reshaping priorities
• Resource realities – Where agencies are making progress and where gaps still persist
• Security differentiators – What sets the most effective agencies apart
91% of federal OT/CPS leaders say the rapidly evolving geopolitical threat landscape has intensified their agency’s focus on OT and broader CPS security
100% launched new CPS security initiatives in the past year, with more than 85% increasing focus on governance, traditional OT, and IoT security
Zero trust mandates are now twice as likely to drive CPS strategy as they were in 2024
68% of leaders anticipate a disruptive OT/CPS incident within the next year, likely impacting IoT devices and/or BMS/FRCS systems
Despite increased investments, just 36% have achieved full asset visibility – a critical foundation for all other security measures
62% still lack in-house CPS expertise and 60% remain concerned about internet-facing, end-of-life OT assets
68% of leaders say they’ve increased the percentage of air-gapped systems in their OT and/or broader CPS environments, including 87% of DOD leaders and 33% of federal civilian leaders
70% use transportable OT security assessment capabilities, with another 16% planning to adopt them in the next year
Agencies that avoided incidents are more likely to have in-house CPS leadership, fewer unpatchable legacy systems, fully deployed network protection and threat detection, and modern access controls
Prioritization of OT and CPS security is surging across every layer of the cyber-physical stack, propelled by escalating geopolitical threats, growing IT/OT convergence, and momentum from zero trust mandates. In the last year, 100% of CPS leaders invested in at least one OT/CPS security improvement.
91%
of federal leaders say the rapidly evolving geopolitical threat landscape has intensified their agency’s focus on OT and broader CPS security, and
97%
report a growing level of OT/IT convergence, saying multiple OT systems interface with enterprise IT networks
Please complete the form to view the Report.