CISA Warning: Iran PLC Attacks on Critical Infrastructure – Compliance Implications Under NIS2, DORA, and CMMC 2.0

Introduction: A New Wave of PLC Attacks on Critical Infrastructure

In early 2025, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Environmental Protection Agency (EPA) jointly updated their warning regarding Iran-affiliated threat actors targeting programmable logic controllers (PLCs) in critical infrastructure. The advisory highlights ongoing malicious cyber activities aimed at compromising industrial control systems (ICS) used in water, energy, and other essential sectors. This is not a hypothetical threat — it's an active, state-sponsored campaign that demands immediate attention from compliance teams across both US and EU jurisdictions.

For organizations operating in critical infrastructure, this warning intersects with a complex web of regulatory obligations: the EU's NIS2 Directive and Digital Operational Resilience Act (DORA), and the US Department of Defense's Cybersecurity Maturity Model Certification (CMMC) 2.0. This article breaks down the technical details of the attacks, maps them to regulatory requirements, and provides actionable steps for compliance teams to strengthen their defenses.

Technical Details of the Iran-Linked PLC Attacks

According to the joint advisory, Iran-affiliated threat actors have been observed targeting PLCs — the small but powerful computers that control industrial processes such as water treatment, power generation, and manufacturing. The advisory provides indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with these actors. Key technical observations include:

• Targeting of PLCs: Attackers focus on PLCs from major vendors, often exploiting default credentials, unpatched vulnerabilities, or weak network segmentation.
• Initial Access: Gained through exposed remote access services (e.g., RDP, VPN with weak authentication), phishing, or compromised third-party connections.
• Lateral Movement: Once inside the OT network, attackers move laterally to reach PLCs, often using standard engineering station software.
• Impact: Ability to manipulate physical processes — altering chemical dosing in water treatment, disrupting turbine controls in energy, or halting production lines in manufacturing.

The advisory emphasizes that these attacks are ongoing and that asset owners and operators should not assume they are immune. Recommended mitigations include network segmentation between IT and OT environments, multi-factor authentication (MFA) for all remote access, regular vulnerability assessments, and robust incident response plans.

Sectors at Risk: Water, Energy, and Manufacturing

The warning specifically calls out the water and wastewater sector, but the TTPs apply broadly to any sector relying on PLCs. The energy sector — including electric utilities, oil and gas, and renewable energy — faces similar risks. Manufacturing, particularly in critical supply chains, is also vulnerable. For compliance teams, understanding which assets are PLC-connected and how they are exposed is the first step toward regulatory alignment.

Compliance Obligations: NIS2, DORA, and CMMC 2.0

The Iran PLC attacks directly implicate several major cybersecurity regulations on both sides of the Atlantic. Below, we map the attack vectors to specific requirements under NIS2, DORA, and CMMC 2.0.

NIS2 Directive (EU)

The NIS2 Directive (Directive (EU) 2022/2555) applies to essential and important entities across 18 sectors, including energy, transport, health, and digital infrastructure. Member states were required to transpose NIS2 into national law by 17 October 2024. Key requirements relevant to PLC attacks include:

• Risk Management Measures (Article 21): Entities must implement technical and organizational measures to manage cybersecurity risks, including network segmentation, access controls, and vulnerability management.
• Incident Reporting: Entities must report significant incidents within 24 hours (early warning) and 72 hours (notification). A PLC compromise affecting operational technology would likely qualify.
• Supply Chain Security: NIS2 requires entities to address cybersecurity in the supply chain, including third-party access to OT systems.
• Management Accountability: Senior management can be held liable for non-compliance, with penalties up to EUR 10 million or 2% of global turnover for essential entities.

DORA (EU)

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to financial entities — banks, insurers, investment firms, and crypto-asset service providers — from 17 January 2025. While financial entities may not operate PLCs directly, they often provide critical services to energy and water utilities. DORA requirements relevant to ICS security include:

• ICT Risk Management Framework: Financial entities must have a comprehensive framework covering all ICT assets, including those supporting critical infrastructure clients.
• Third-Party Risk Management: When financial entities rely on third-party providers that operate PLCs (e.g., in energy trading), they must assess and monitor those providers' cybersecurity.
• Incident Reporting: Major ICT-related incidents must be reported to competent authorities, with potential cascading effects from PLC attacks.

CMMC 2.0 (US)

The Cybersecurity Maturity Model Certification 2.0, finalized in October 2024 and effective December 2024, applies to all Department of Defense (DoD) contractors and subcontractors handling Controlled Unclassified Information (CUI). Many defense contractors operate manufacturing facilities with PLCs. CMMC 2.0 Level 2 requires 110 practices aligned with NIST SP 800-171 Rev 2, including:

• Access Control (AC): Limit access to PLCs to authorized users and enforce MFA.
• System and Communications Protection (SC): Segment OT networks from IT networks.
• Risk Assessment (RA): Conduct regular vulnerability scans and risk assessments of PLCs.
• Incident Response (IR): Develop and test incident response plans for ICS compromises.

Non-compliance can result in loss of DoD contracts, making CMMC 2.0 a critical driver for ICS security in the defense supply chain.

Using Geopolitical Intelligence for Proactive Compliance

Staying ahead of state-sponsored threats requires more than reactive patching. Organizations need real-time threat intelligence that correlates adversary TTPs with their own asset inventories. The AIGovHub SENTINEL module provides AI-native geopolitical intelligence, monitoring over 435 sources including CISA, FBI, OFAC, and global news feeds. SENTINEL can:

• Track Threat Actors: Monitor for mentions of Iran-affiliated groups, their TTPs, and new IOCs.
• Alert on Regulatory Changes: Receive real-time updates when agencies like CISA or ENISA issue new guidance related to ICS security.
• Correlate with Your Environment: Map threat intelligence to your asset portfolio, flagging vulnerable PLCs or exposed remote access points.
• Support Incident Response: Provide contextual intelligence during an incident to inform containment and remediation decisions.

By integrating geopolitical intelligence into compliance workflows, organizations can move from a reactive posture to a proactive, risk-based approach that satisfies regulatory expectations for continuous monitoring.

Actionable Steps for Compliance Teams

Based on the CISA/FBI/EPA advisory and the regulatory requirements outlined above, compliance teams should take the following steps:

1. Identify and Inventory PLCs: Know every PLC in your environment, including make, model, firmware version, and network connectivity.
2. Apply Network Segmentation: Separate OT networks from IT networks using firewalls and one-way gateways. Ensure PLCs are not directly accessible from the internet.
3. Enforce Multi-Factor Authentication: Require MFA for all remote access to OT systems, including vendor connections.
4. Patch and Update: Prioritize patching known vulnerabilities in PLCs and engineering workstations. Use CISA's Known Exploited Vulnerabilities (KEV) catalog as a guide.
5. Conduct Regular Vulnerability Assessments: Scan OT networks for weaknesses, and perform penetration testing on ICS environments.
6. Develop and Test Incident Response Plans: Ensure plans cover OT-specific scenarios, including manual override procedures and communication with regulators.
7. Map to Regulatory Frameworks: Use tools like AIGovHub's interactive compliance checkers to align your controls with NIS2, DORA, or CMMC 2.0 requirements.
8. Monitor Threat Intelligence: Subscribe to CISA alerts and consider platforms like AIGovHub SENTINEL for real-time geopolitical risk monitoring.

Conclusion

The CISA/FBI/EPA warning on Iran-affiliated threat actors targeting PLCs is a clarion call for critical infrastructure operators and their compliance teams. The convergence of active state-sponsored threats with stringent regulatory frameworks like NIS2, DORA, and CMMC 2.0 means that cybersecurity is no longer just an IT issue — it's a board-level compliance imperative. By taking immediate action to segment networks, enforce access controls, and integrate threat intelligence, organizations can protect their operations and demonstrate regulatory compliance. Explore AIGovHub's SENTINEL module for geopolitical threat monitoring and compliance tracking to stay ahead of emerging risks.

This content is for informational purposes only and does not constitute legal advice.