Plus: CMS clarifies condition-level noncompliance oversight; ASHRAE introduces new energy-saving requirement; CISA releases guidance on zero trust adoption for OT