Review – 3 Advisories and 2 Updates Published – 12-2-25

Today CISA’s NCCIC-ICS published two control system security advisories for products from Iskra and Industrial Video & Control, as well as a medical device security advisory for products from Mirion Medical. They also updated two advisories for products from Mitsubishi Electric.

Advisories

Iskra Advisory - This advisory describes a missing authentication for critical function vulnerability in the Iskra iHUB and iHUB Lite smart metering gateways.

Industrial Video & Control Advisory - This advisory describes a code injection vulnerability in the IVC Longwatch video surveillance and monitoring system.

Mirion Advisory - This advisory describes three vulnerabilities in the Mirion EC2 Software NMIS BioDose.

Updates

Mitsubishi Update #1 - This update provides additional information on the MELSEC iQ-R Series/iQ-F Series advisory that was originally published on June 6^th, 2023, and most recently updated on April 25, 2024.

NOTE: I briefly discussed the updated Mitsubishi advisory on Sunday.

Mitsubishi Update #2 - This update provides additional information on the CNC Series advisory that was originally published on July 24^th, 2025.

NOTE: I briefly discussed the updated Mitsubishi advisory on Sunday

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-2-updates-published-59b - subscription required.

OMB Sends UAS List of Associated Elements IFR to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received an interim final rule (IFR) from the OMB on “American Security Drone Act of 2023; Unmanned Aircraft System List of Associated Elements”. This rulemaking was not listed in the Spring 2025 Unified Agenda. It looks like this rulemaking is implementing the requirement of §1823(a) of the American Security Drone Act of 2023 {Section 1821 et seq, PL 118-31, 137 STAT. 691}.

This requirement in §1823 is placed upon the Federal Acquisition Security Council (FASC). The FASC was established by the Federal Acquisition Security Council Rule. The FASC is an executive branch interagency council chaired by a senior-level official from the Office of Management and Budget. This is the reason that the OMB is authoring this regulation.

The term ‘associated elements’ is used in §1823 to describe those parts of unmanned aircraft systems that are “related to the collection and transmission of sensitive information (consisting of communication links and the components that control the unmanned aircraft) that enable the operator to operate the aircraft in the National Airspace System.” The ‘list of associated elements’ will be used to limit federal agencies from acquiring such elements when they come from a ‘covered foreign entity’ {§1822(1)}.

I do not expect that I will be covering this rulemaking in any detail, but I do expect that I will announce its publication in the appropriate Short Takes post.

STB Sends Regulatory Barriers NPRM to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a notice of proposed rulemaking (NPRM) from the Surface Transportation Board (STB) on “Eliminating Regulatory Barriers to Competition: Review of 49 CFR Part 1144” [link added]. This rulemaking was not listed in the Spring 2025 Unified Agenda, but it looks like this is the STB’s implementation of the requirements of EO 14267, Reducing Anti-Competitive Regulatory Barriers.

It does not look like this rulemaking will have any specific impact on hazmat transportation issues, so I will probably not be covering this rulemaking in any detail. I would expect to announce it’s publication in the appropriate Short Takes post.

Review - Bills Introduced – 12-1-25

Yesterday, with both the House and Senate in Washington, there were 36 bills introduced. Two of those bills will receive additional coverage in this blog:

S 3290 A bill making appropriations for financial services and general government for the fiscal year ending September 30, 2026, and for other purposes. Hagerty, Bill [Sen.-R-TN]

S 3293 A bill making appropriations for energy and water development and related agencies for the fiscal year ending September 30, 2026, and for other purposes. Kennedy, John [Sen.-R-LA]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, as well as a brief look at an intelligence sharing bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-12-1-25 - subscription required.

Review S 2388 Introduced – Cyber Circuit Rider Program

Back in March Sen Cortez-Masto (D,NV) introduced S 1018, the Cybersecurity for Rural Water Systems Act. The bill would require USDA to establish a rural water and wastewater cybersecurity circuit rider program” similar to the one established in 7 USC 1926(a)(22), but focused on cybersecurity. The bill would authorize $10-million per year through 2028 to support the program.

This bill is essentially the same as S 2388, the Cybersecurity for Rural Water Systems Act, that was introduced by Cortez Masto in July 2023. No action was taken on that bill in the 118^th Congress.

Moving Forward

Neither Cortez-Masto nor her sole co-sponsor {Sen Rounds (R,ND)} are members of the Senate Agriculture, Nutrition, and Forestry Committee to which this bill was assigned for consideration. This means that it is unlikely that there is sufficient influence to see the bill considered in Committee. Adding $10-million dollars in spending is sure to draw opposition from many Republicans, but there may still be sufficient bipartisan support in the Committee to see the bill approved if it were considered.

As with most bills, there would not be sufficient interest in this legislation to see the Senate leadership tie up the Senate for the time that it would be necessary to consider this bill under regular order. Because of the added spending involved, it would not be possible to pass this bill under the Senate’s unanimous consent process; it would take just a single Senator to object to passage of the bill to kill consideration.

Commentary

The current circuit rider program has about 147 personnel periodically helping small water systems and small wastewater treatment systems. CISA reports about 153,000 water treatment facilities in the US with the vast majority (93 % by one estimate -pg 3) being small systems that would be covered by the circuit rider program. That means that each circuit rider would have to cover about 1,000 systems. They do not get around very often.

 

For more details about the provisions of this bill, including a brief look at the related NRWA actions, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2388-introduced-cyber-circuit-rider - subscription required.

Review – Committee Hearings – Week of 11-30-25

With both the House and Senate back from their Thanksgiving break, there is a moderately busy hearing schedule. Of interest here are two fact-finding hearings on grid security and communications security. There are also two Space Geek hearings.

Grid Security

On Tuesday the Subcommittee on Energy of the House Energy and Commerce Committee will hold a hearing on “Securing America’s Energy Infrastructure: Addressing Cyber and Physical Threats to the Grid”.

Communications Security

On Tuesday the Subcommittee on Telecommunications and Media of the Senate Commerce, Science, and Transportation Committee will hold a hearing on “Signal Under Siege: Defending America’s Communications Networks”.

Space Geek Hearings

On Wednesday the Senate Commerce, Science, and Transportation Committee will hold a nomination hearing  that will bring Jared Isaacman back before the Committee for his renomination to be NASA Administrator.

On Thursday the Subcommittee on Space and Aeronautics of the House Science, Space, and Technology Committee will hold a hearing on “Strategic Trajectories: Assessing China’s Space Rise and the Risks to U.S. Leadership”.

 

For more information on these hearings, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/committee-hearings-week-of-11-30 - subscription required.

Review - S 2465 Introduced – FY 2026 THUD Spending

Back in July Sen Hyde-Smith introduced S 2465, the Transportation, Housing and Urban Development, and Related Agencies Appropriations Act, 2026. At the same time the Senate Appropriations Committee published their Report on the Bill. While there is a cyber security mention in the bill, the main focus here will be PHMSA spending in the bill and discussions in the Report, as well as some UAS discussions in the Report.

S 2465 is be similar to S 4796, the Transportation, Housing and Urban Development, and Related Agencies Appropriations Act, 2025, that was introduced by Sen Schatz (D,HI) in July 2024. No action was taken on that bill in the 118^th Congress. The related House bill, HR 9028, was also introduced in July 2024, and similarly, no action was taken on that bill in the 118^th Congress.

Moving Forward

The plan in the House currently appears to be to add the language of S 2431 to the substitute language for the consideration of HR 4016, the Department of Defense Appropriations Act, 2026. The Senate has not yet held their first cloture vote that would allow actual debate to begin on the bill. This probably indicates that there is still some backroom dealing going on to determine the broad outline of what will end up in the Senate version of the bill. Then further dealing with determining what further amendments will be considered on the floor.

Right now, SA 3951 from Sen Collins (Chair of the Appropriations Committee) is the current candidate for the substitute language to be considered, and it includes the language from S 2431. But a lot can happen in the short legislative month of December.

 

For more information on the provisions of this bill dealing with cybersecurity, PHMSA, and UAS issues, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2465-introduced-fy-2026-thud-spending - subscription required.