OT cybersecurity is the protection of operational technology, the control systems and networks that run physical processes, against cyber threats, with safety, availability and reliable operation as the first priorities.
OT includes PLCs, DCS, SCADA, safety instrumented systems, HMIs, historians and engineering workstations. An attack can do more than steal data: it can stop production, damage equipment or create unsafe conditions. That changes the approach. Security measures must not interrupt control, and changes must be tested and scheduled around operations.
Core practices are well established. Keep an accurate asset inventory. Segment networks into zones with controlled connections between them, the zones-and-conduits model of the ISA/IEC 62443 series. Control and monitor remote access, especially for vendors and integrators. Harden and patch where possible, and use compensating controls where patching is not possible. Monitor network traffic passively for unexpected commands. Keep offline backups of controller programs and configurations, and practice recovery.
Key references are NIST SP 800-82 for guidance, the ISA/IEC 62443 standards for requirements across asset owners, integrators and product suppliers, and CISA advisories on specific vulnerabilities. A common gap is the assumption that the plant is air-gapped. Remote access tools, vendor laptops, USB drives and new data connections for analytics or AI often break that assumption without anyone recording it.
Questions about OT cybersecurity
What is the difference between IT security and OT security?
The priorities. OT security puts safety, availability and reliable operation first, because an attack can stop production, damage equipment or create unsafe conditions. IT traditionally ranks confidentiality first.
Is an air-gapped plant safe from cyberattacks?
The air gap itself is often not real. Assuming the plant is air-gapped is a common gap: remote access tools, vendor laptops, USB drives and new data connections for analytics or AI often break that assumption without anyone recording it.
Which standards and guidance cover OT cybersecurity?
NIST SP 800-82 gives guidance. The ISA/IEC 62443 standards set requirements across asset owners, integrators and product suppliers. CISA advisories cover specific vulnerabilities.
Related terms
IT/OT convergence
IT/OT convergence is the integration of information technology, the systems that handle business data, with operational technology, the systems that monitor and control physical equipment, so data and practices flow between them.
SCADA
SCADA (supervisory control and data acquisition) is a computerized system that gathers data from remote or distributed equipment and lets operators monitor and control it.
PLC (programmable logic controller)
A PLC (programmable logic controller) is a ruggedized industrial computer that reads inputs from sensors, runs a user program, and drives outputs such as motors and valves in real time.
DCS (distributed control system)
A DCS (distributed control system) is a plant control system in which control functions are spread across many autonomous controllers near the equipment, linked by a network to central operator stations.
Industrial AI agent
An industrial AI agent is, in loose current usage, a software system that pursues a goal in a plant setting by reading data, reasoning over it, and taking or proposing actions through connected tools, usually built around a large language model.