Cybersecurity experts called on CISA to convert its voluntary guidance for operational-technology security into mandatory federal requirements, The Record reported on 7 October. The argument: critical-infrastructure operators — water, energy, manufacturing — continue to run unsegmented OT networks and delay patching on internet-facing devices, and voluntary frameworks have not moved the needle. The piece reports the expert position and its rationale; no regulator has committed to rulemaking in the reporting, and any US move would need statutory authority, so the mandate itself is proposed, not enacted. The debate matters for Australia because the SOCI Act's enhanced obligations for critical infrastructure already mandate risk-management programs covering OT, making the US voluntary-versus-mandatory question a live comparison point for how effective the Australian regime proves.

• Source article