What it means
OT environments often prioritize safety, availability, determinism, long equipment life, and tightly controlled change. Security measures must account for physical consequences and operational constraints.
Why it matters
Controls designed for office IT can disrupt production or safety when applied without engineering and operator involvement.
Practical focus
- Inventory assets, communications, dependencies, and safety functions
- Segment business and control networks with explicit pathways
- Use passive monitoring and planned maintenance windows
- Coordinate security decisions with engineering, operations, and safety owners
Common mistakes
- Scanning fragile devices without testing
- Assuming isolation means no connectivity
- Applying patches without operational validation
- Treating safety and cybersecurity as separate risk systems
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: