What it means
OT legacy system compensating controls reduce exposure when obsolete hardware, operating systems, software, or protocols cannot support preferred security safeguards.
Why it matters
Unsupported systems often remain essential, but “cannot patch” is not a complete risk decision and does not justify unrestricted access or invisible operation.
Practical focus
- Document the limitation, business and safety function, threat exposure, consequence, vendor status, replacement constraints, and risk owner.
- Apply segmentation, allowlisting, controlled access, protocol filtering, monitoring, physical protection, backup, spares, rebuild, and procedural safeguards.
- Set verification, review, expiry, replacement milestones, and escalation if the compensating control weakens or exposure changes.
- Preserve this evidence: Retain the exception, risk assessment, compensating-control design, tests, monitoring, approvals, review dates, and modernization plan.
- Exercise this failure scenario: A legacy device remains broadly reachable for years under a permanent exception whose compensating controls were never tested or monitored.
Common mistakes
- Using the label OT Legacy System Compensating Controls without defining scope, ownership, decision authority, and the exact data, systems, people, or process affected.
- Treating a policy, contract, diagram, dashboard, or tool demonstration as proof that OT Legacy System Compensating Controls operates consistently in production.
- Closing work without retaining the evidence needed to reconstruct the decision and verify the intended control outcome.
- Testing only the normal path and never rehearsing the failure condition: A legacy device remains broadly reachable for years under a permanent exception whose compensating controls were never tested or monitored.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: