ItInsightsWorld Deep Dive: Why Siemens and Charter of Trust Now Treat Operational Technology as a National Security Question

Start with the conclusion, because the headline is not the meeting itself. The gathering that Siemens and Charter of Trust convened in Washington, D.C. — senior officials, industrial executives and cybersecurity policy specialists in one room — matters because of what it assumed: that defending critical infrastructure company by company no longer works. Everything else in the agenda followed from that premise. For readers outside the security world, the useful takeaway is a change of category. Operational technology, the controllers and software that keep substations balanced, trains moving and assembly lines cycling, has quietly been reclassified from an IT cost line into a national security file.

This ItInsightsWorld analysis unpacks the background behind that reclassification, the reasons collective defense is being pushed as the answer, the fault line running through the debate, and a practical framework for deciding what it means for your own operation.

Three things to take away before the detail

• Coordination has moved from goodwill to obligation: reporting clocks, shared vulnerability data and joint monitoring are becoming the baseline expectation for operators of essential systems.
• The industrial sector is not a secondary target. According to the IBM X-Force 2026 Threat Index, manufacturing was the most attacked industry for a fifth consecutive year, accounting for 27.7% of the incidents the team responded to, with data theft the leading objective.
• Buying a firewall is not a strategy. The question being decided right now is who owns assurance across a supply chain that spans vendors, integrators and operators.

Background: an alliance born to close a rules gap

Charter of Trust was established at the 2018 Munich Security Conference, with Siemens a founding member and its most persistent promoter. The moment of its birth is worth noting: the alliance emerged from a geopolitical forum, not a trade show, which set its tone from day one as a public-interest mechanism rather than a marketing club. Its early signatories paired heavy industry with aviation, insurance, telecoms and semiconductor makers — nine organisations in the first cohort — and the group has since grown into a cross-sector network that actively engages governments and the wider cybersecurity community.

The intellectual core is a short list of ten principles, among them ownership of cyber and IT security, security by default, transparency and response during incidents, and responsibility throughout the digital supply chain. The alliance briefing material reproduced in the U.S. government's supply-chain security library (csrc.nist.gov) lays these out in full. The premise underneath them is simple enough for a non-specialist: in a connected economy, trust is a shared asset, and no single vendor can manufacture it alone. That mission — foster trust and reinforce global cyber resilience through collaboration — is why the Washington, D.C. session looked less like a product briefing and more like the start of a policy conversation.

Why the risk picture changed

The growing digitisation and interconnection of industrial systems made operational technology vulnerability a paramount national security concern, and three reinforcing forces turned a technical trend into a strategic one.

1. The attack surface fused with the office network

Plants that once ran closed, isolated control networks now carry remote diagnostics, cloud analytics, supplier access and over-the-air updates. Every one of those paths is an IT door into an OT room. The consequences of a failure are physical: a stalled production line, an unbalanced grid, a batch written off.

2. Attackers followed the disruption value

Ransomware's economics favoured operational targets. ENISA's Threat Landscape 2026 (enisa.europa.eu) records ransomware as the most damaging threat facing European organisations, alongside DDoS at 51.3% and unauthorised access at 39.5% of mapped activity. On the cost side, IBM's Cost of a Data Breach research put the industrial sector's average breach cost at USD 5.56 million in its 2024 edition, above the global average of USD 4.44 million reported the following year — a spread that explains why plant owners price downtime differently from data loss.

3. Governments turned information-sharing into a legal duty

This is the shift most coverage of the dialogue missed. In the US, the Cyber Incident Reporting for Critical Infrastructure Act was enacted in 2022 and still awaits its implementing rule; once in force, covered entities across the nation's 16 critical infrastructure sectors would face a 72-hour deadline to report a substantial cyber incident and 24 hours to report a ransom payment, according to CISA's published framework (cisa.gov). Voluntary cooperation was the 2018 model. Timed, auditable disclosure is the emerging one, and it changes the incentive to hoard vulnerability data.

What the dialogue actually put on the table

Three working themes came out of the session, and each answers a specific failure mode.

1. Coordinated threat monitoring. The goal is continuous rather than episodic visibility, so that anomalies in one operator's environment raise a flag for peers running similar equipment.
2. Faster exchange of vulnerability data. Government representatives and industry experts discussed scaling joint operational capabilities so data on emerging vulnerabilities moves faster and more transparently. When monitoring is continuous and communication channels stay open, weaknesses in critical infrastructure can be identified and remedied rapidly and comprehensively.
3. A framework that spans the gap. The convening served as a venue for beginning to envision a coordinated defense framework that bridges federal regulatory and executive bodies with private sector technology providers. Participants also pressed a point that regulators often miss: cyber policy and regulation must match the practical realities of operating heavy machinery and manufacturing pipelines.

The scale behind that ambition is not trivial. Siemens, a founding member of Charter of Trust and a supplier of secure IT/OT solutions, counts more than 1,300 cybersecurity experts worldwide who work to ensure the resilience of its products. Through a network of thousands of manufacturers, distributors, integrators, and end-users, it maintains a deep understanding of the cyber threat landscape, not only in the US but around the world. Dr. Sumit Chanda, COO of Atos Group Security and co-chair of Charter of Trust, stressed the alliance's role in converting collaboration into concrete outcomes — a pointed remark, because the historic failure of industry coalitions is the gap between signed statements and shipped fixes.

The fault line: design or decree

Underneath the cooperation sits a genuine disagreement about method, one the alliance itself has put on its agenda: the fourth edition of the CyberTrust Talk, hosted by Siemens in Berlin, was framed around "Trust by Design or Trust by Regulation?". Both camps want the same outcome; they differ on whether trust should be engineered into products before they ship or enforced afterwards by law. The contrast below is the cleanest way for a general reader to hold the debate.

Dimension	Trust by design	Trust by regulation
Who decides the standard	Manufacturers and engineering teams, via internal baselines	Legislators and agencies, via binding requirements
Speed of adoption	Fast where a dominant supplier sets the template	Slow: drafting, consultation, transposition, enforcement
Weakness	Voluntary; laggards face little penalty	One-size-fits-all rules can clash with plant realities
Evidence today	Ten-principle charter model since 2018	Timed incident and ransom-payment reporting duties
Likely end state	A hybrid: design obligations written into regulation, compliance proof demanded at procurement

Read together with the Washington, D.C. agenda, the pattern is a bridge rather than a choice: industry supplies the technical templates, governments supply the deadline, and both supply the reporting channel.

Common misconceptions

• "Our control network is air-gapped, so this isn't our problem." Service access, vendor updates and mapped IT/OT interconnections routinely reintroduce paths that the isolation was meant to remove.
• "Collective defense is just another conference communique." It becomes operational the moment shared indicators shorten the interval between discovery and patching — and once reporting duties make silence a compliance failure.
• "A big vendor's security team covers my risk." More than 1,300 specialists inside one supplier protect that supplier's products; they do not secure your configuration, your credentials or your integrator's laptop.
• "This is only for power and transport." Any site with programmable controllers, safety logic or continuous processes inherits the same exposure class.

A judgment framework you can use this quarter

For readers who need a decision rather than a description, work through these in order:

1. Inventory what physical process each connected system controls, and name the safety consequence of losing it. Treat this as the risk currency, not data volume.
2. Segment by zone and conduit using ISA/IEC 62443 as the engineering reference, and validate that remote-access paths terminate inside a monitored boundary.
3. Anchor monitoring practice to NIST's Guide to Operational Technology Security, SP 800-82r3 (nvlpubs.nist.gov), which is the most quotable public baseline for OT topologies.
4. Rewrite supplier contracts to demand responsibility throughout the digital supply chain: named security contact, disclosure timetable, patch-support end dates.
5. Decide in advance what you would report within a 72-hour window and to whom, before a real incident forces the call.
6. Join at least one sector coordination channel, public or industry-run, and test it with a tabletop exercise rather than trusting the mailing list.

Trend judgment

Three developments look probable. First, coordination metrics migrate into procurement: buyers will ask suppliers how they share vulnerability data, not only which certificates they hold. Second, the alliance model spreads — a body founded at the 2018 Munich Security Conference is now a template, and newer industry groupings follow the same cross-sector, government-facing design. Third, the hardest argument moves from whether to collaborate to how to protect the credibility of shared intelligence when competitors are on the same channel. Defending systemic threats has become an increasingly difficult task for individual organizations acting alone; the organisations that treat that sentence as guidance rather than rhetoric will be the ones with something to report at the next dialogue.

FAQ

What is operational technology, in plain terms?

The hardware and software that control physical processes — controllers, sensors, safety systems, scheduling software. IT stores and moves information; OT moves the world.

Why is Charter of Trust involved alongside a government audience?

Because the technical knowledge about industrial systems sits mostly with private manufacturers, while the legal authority to require reporting and interoperability sits with governments. Neither side can build a coordinated framework alone.

Does this change anything for a mid-sized manufacturer?

Yes, mainly contractually and operationally: expectation of faster disclosure, evidence of segmentation, and named responsibility across suppliers. The compliance burden is heavier in regulated sectors, but the baseline is spreading through customer requirements.

Is the 72-hour reporting rule already binding today?

The 2022 law is in force, but the specific reporting obligations take effect on dates set by the implementing rule. Treat it as imminent rather than optional — that is the posture most operators should adopt now.

Who runs the alliance's day-to-day work?

Co-chairs drawn from member companies, including Dr. Sumit Chanda of Atos Group Security, coordinate working groups that translate discussion into published practice.

Bottom line

The dialogue convened by Siemens and Charter of Trust is best read as an early draft of a security contract between states and industry: governments supply deadlines and authority, manufacturers supply visibility and expertise, and the shared vulnerability data in between is the consideration. For anyone whose daily life depends on a plant, a grid or a rail line staying up, that is the part worth paying attention to — not the photo from the room.