US Air Force targets OT security

The U.S. Air Force has set up a new office to secure the digital systems that run base buildings, utilities and fuel operations. (govinfosecurity.com) Those systems are the computers and controllers behind badge readers, heating and cooling, power, water and fuel storage. The Air Force calls the new unit the Cyber Resiliency Office for Control Systems, or CROCS. (govinfosecurity.com) Department of the Air Force Principal Cyber Advisor Wanda Jones-Heath said the service adopted an operational technology security strategy in May 2021, but CROCS did not reach initial operating capability until 2024. She said the office is designed as a “one-stop shop” for policy and execution. (govinfosecurity.com) Operational technology is the software and hardware that opens doors, pumps fuel and keeps buildings running, rather than the office networks that handle email and files. The Pentagon’s facility-control rules cover networked systems used to monitor and control infrastructure, including utilities, building controls and electronic security systems. (wbdg.org) (acq.osd.mil) The Air Force move comes after years of Pentagon work on these risks. A 2019 Defense Department memo ordered updated cybersecurity plans for facility-related control systems through fiscal years 2020 to 2026, with priority on systems tied to critical assets, internet-facing networks and stand-alone systems that still need authorization. (acq.osd.mil) The service has also tightened its own rules. A 2024 Department of the Air Force guidance memo reissued cybersecurity policy for Civil Engineer-owned control systems and their devices, networks, applications and data. (wbdg.org) Air Force and Space Force officials have been tying base infrastructure more directly to combat readiness. In an April 2025 service news release, senior leaders said base-level networks, information systems and command-and-control systems are essential to readiness and resilience. (spaceforce.mil) Jones-Heath said the Air Force is the first U.S. military service with an office dedicated to operational-technology cybersecurity. The office now gives the service a single place to track and harden the systems that keep its installations functioning. (govinfosecurity.com)