Federal agencies and defense industrial base organizations face a converging set of OT mandates: meet the visibility and logging requirements under M-26-14,and adopt CISA's newly issued BOD 26-04, which replaces flat KEV deadlines with a risk-based model that can demand patching the highest-risk vulnerabilities within three days. The challenge isn't the frameworks — it's operationalizing them in OT environments where IT-style security architectures and tools don’t always apply.

‍

Nozomi Networks brings together a former asset owner and an OT practice leader and a leading OT cybersecurity strategist to cover what M-26-14 requires operationally and how to apply BOD 26-04's risk-based prioritization where rapid patching often isn't an option.

‍

Attendees will leave with:

• Practical steps for meeting M-26-14's logging and network visibility requirements
• How to apply BOD 26-04 in OT — using exposure and asset context to prioritize, defer and compensate when you can't patch on a three-day clock
• How Nozomi Networks supports compliant, mission-ready OT security at scale

‍