CISA Adds ABB B&R Automation Studio to No‑Cost Cyber Services Program

Why ABB B&R Automation Studio is in the spotlight

ABB B&R’s Automation Studio is a widely used development environment for programmable logic controllers (PLCs) and motion control applications across manufacturing, energy, and transportation sectors. Its popularity makes it a frequent target for threat actors seeking to disrupt production lines or exfiltrate proprietary data. Recent advisories have highlighted several CVEs affecting the underlying runtime libraries, prompting operators to look for faster, authoritative ways to assess and remediate risk.

CISA’s no‑cost cyber services: what’s new

The Cybersecurity and Infrastructure Security Agency announced that, starting this month, its Secure‑by‑Design service bundle will include a dedicated track for ABB B&R Automation Studio users. The program provides:

• Automated vulnerability scanning of Automation Studio projects and deployed PLC firmware, leveraging the same signatures that power CISA’s National Vulnerability Database (NVD).
• Configuration hardening guides tailored to the Studio environment, covering best‑practice network segmentation, credential management, and secure update pipelines.
• Incident‑response playbooks that map common attack vectors—such as malicious ladder logic injection—to concrete containment steps.
• Direct reporting channel to CISA’s cyber‑incident hotline, enabling rapid escalation when a breach is suspected.

All services are offered at no charge to eligible organizations, including critical‑infrastructure owners, small‑to‑mid‑size manufacturers, and academic labs that rely on Automation Studio for research.

Expert perspective

"Industrial control systems have historically lagged behind IT in adopting security best practices," says Dr. Maya Patel, senior analyst at the Industrial Cybersecurity Center. "CISA’s move to bundle Automation Studio into its free services signals a recognition that the line between OT and IT is blurring, and that vendors need to work hand‑in‑hand with government agencies to raise the baseline security posture."

Patel adds that the hardening guide is especially valuable because it translates generic IEC 62443 controls into concrete steps for B&R’s runtime environment, something that many plant engineers struggle to do on their own.

How to get started

1. Register your organization on the CISA portal at the Secure‑by‑Design page. You’ll need to provide basic contact information and a brief description of your Automation Studio deployment.
2. Upload a copy of your project files (or point the scanner to a network segment where the PLCs are reachable). CISA’s automated tool will analyze the code for known insecure patterns, such as hard‑coded passwords or unvalidated input fields.
3. Review the generated report. The output includes a risk rating, a list of actionable remediation steps, and links to relevant CISA advisories.
4. Implement the hardening recommendations. Typical actions include enabling TLS for the B&R Runtime, disabling unused services, and configuring role‑based access control within the Studio IDE.
5. Submit any incident details through the dedicated “Report a Cyber Issue” form. CISA will acknowledge receipt within 24 hours and coordinate with the affected vendor if a zero‑day is suspected.

Practical takeaways for plant managers

Action	Why it matters	Quick tip
Run the CISA scanner before each major software rollout	Catches regressions that might re‑introduce old flaws	Schedule scans as part of your change‑management checklist
Apply the hardening guide to every new PLC deployment	Reduces the attack surface from day one	Use the provided configuration templates and store them in version control
Keep the incident reporting channel bookmarked	Faster response if a breach is detected	Assign a secondary contact in case the primary is unavailable

Looking ahead

CISA plans to expand the program to other automation platforms, including Siemens TIA Portal and Rockwell Studio 5000, later this year. For ABB B&R customers, the immediate benefit is a clear, government‑backed path to securing their control logic without incurring additional consultancy costs.

If your organization runs Automation Studio, taking advantage of this no‑cost service is a practical step toward aligning with the NIST 800‑82 guidelines for industrial control system security and the IEC 62443 series of standards.

---

For more details, see the official CISA announcement and the downloadable hardening guide on the ABB B&R support site.