Operational technology (OT) underpins essential services and defense capabilities, making its security a matter of national resilience. As industrial systems become more connected, cyber incidents can threaten not only data but also safety, reliability, and continuity of operations.
Effective Operational Technology Security Practices must account for the unique demands of critical infrastructure, where protective measures cannot disrupt essential processes. Asset visibility, network segmentation, controlled access, continuous monitoring, and tested recovery plans help reduce risk while supporting dependable operations.
Secure OT by Designing for Safety and Reliability
Operational technology (OT) security must be designed around the safety and reliability requirements of the industrial process it supports. In critical infrastructure, a security change that disrupts control or visibility can affect physical operations, so cybersecurity measures should be assessed alongside operational hazards and service requirements.
Use a defense-in-depth design that accounts for system architecture, equipment capabilities, and safe operating states. Controls should not interfere with time-sensitive communications or safety functions. Where feasible, test configuration changes and security updates in a representative environment before applying them to production systems.
Coordinate design decisions among cybersecurity, engineering, safety, and operations teams. Document how systems should behave during loss of connectivity, component failure, or a suspected cyber incident, and define approved procedures for maintaining safe operations. These foundations guide the asset, network, and access controls described in subsequent practices.
Operational Technology Security Practices should protect systems without compromising the dependable operation of the infrastructure they control.
Inventory Assets and Map Industrial Processes
An accurate inventory gives security teams a clear view of the devices and connections that support industrial operations. Record controllers, sensors, actuators, operator workstations, servers, and network equipment, including legacy or temporarily connected assets. Where details cannot be verified, mark them as unknown for follow-up.
For each asset, document its owner, purpose, location, operating system or firmware, and relevant communication links. Map how information and control commands move between business networks, industrial systems, and physical processes. This context helps teams assess exposure without treating every device as interchangeable.
A practical inventory should capture:
- Asset identifiers, type, and physical or logical location
- Operational function, accountable owner, and critical dependencies
- Network connections, protocols, and links to other systems
- Known maintenance constraints and verification status
Keep records current through approved change processes and periodic checks with engineering and operations staff. In critical infrastructure, this process supports Operational Technology Security Practices by helping responders understand which systems may be affected by a change or cyber incident.
Identify controllers, sensors, workstations, and network devices
An accurate inventory begins with identifying the devices that control or observe industrial processes. Record programmable logic controllers (PLCs), distributed control system components, remote terminal units, and safety instrumented system controllers, along with the sensors and actuators connected to them. These devices may communicate using industrial protocols that differ from standard office-network traffic.
Include engineering and operator workstations, human-machine interface (HMI) terminals, historians, servers, and any computers used to configure or maintain equipment. Document network infrastructure such as switches, routers, firewalls, wireless access points, and gateways, including devices that bridge business and operational networks.
Where available, capture each asset’s manufacturer, model, firmware or operating-system version, network address, physical location, and connection method. Passive discovery and review of engineering records can help identify assets while reducing the risk of disrupting sensitive processes; verify findings with site personnel when records are incomplete.
A reliable inventory supports Operational Technology Security Practices by clarifying which devices require protection and helping teams recognize unauthorized or unexpected equipment.
Document asset owners, functions, and dependencies
Record a named owner or responsible team for each operational technology (OT) asset, along with its operational purpose and the process it supports. This clarifies who can confirm an asset’s status, approve changes, and coordinate maintenance or security decisions.
Document dependencies between assets and services, including links to controllers, sensors, operator workstations, engineering tools, and supporting systems such as time or authentication services. Note which processes may be affected if a component or connection becomes unavailable.
Keep records accurate by validating them with operations, engineering, and information technology personnel, then updating them after approved changes. Where ownership or dependencies are unknown, mark them as unverified and assign follow-up responsibility rather than treating incomplete information as fact.
This context helps teams assess the operational impact of a cyber incident and prioritize response actions without disrupting safety or reliability. Clear ownership and dependency records therefore provide a practical foundation for Operational Technology Security Practices in critical infrastructure environments.
Segment Networks to Limit Cyber Incidents
Network segmentation divides an OT environment into zones according to operational function and risk, limiting how far a cyber incident can spread. Separating enterprise IT from control networks helps prevent a compromised office device from communicating directly with controllers or other safety-related systems.
Design boundaries around documented process dependencies, not convenience alone. Use firewalls or other appropriate controls to permit only necessary traffic between zones, and restrict pathways to critical assets. Segmentation should be tested carefully: changes can disrupt time-sensitive communications or interfere with industrial operations.
A practical approach includes:
- Separating corporate IT, supervisory systems, and control devices where feasible.
- Allowing only approved protocols, ports, and communication paths between zones.
- Reviewing rules periodically and removing access that is no longer required.
Well-planned segmentation supports Operational Technology Security Practices by reducing unnecessary connectivity while preserving reliable process operation. Its design should reflect the site’s architecture, safety requirements, and documented vendor dependencies.
Manage Remote Access and User Privileges
Remote access should be limited to approved business needs and routed through controlled, monitored connections, such as a managed access gateway. Require authorization before granting access, define its duration and scope, and record sessions where technically and operationally appropriate. These controls reduce opportunities for unauthorized entry without disrupting necessary maintenance.
Apply least privilege by granting each user only the permissions required for assigned duties. Use named accounts rather than shared credentials, and remove or adjust access promptly when roles change or work ends. Strong authentication, including multifactor authentication where supported, can help protect accounts from credential misuse.
Operational Technology Security Practices should account for system limitations: some legacy equipment may not support modern authentication or monitoring. In such cases, use compensating controls, such as restricting access through a secured intermediary, and assess changes with safety and availability in mind.
Review remote-access permissions and logs regularly. Coordinate vendor access with site personnel, establish clear approval and escalation procedures, and ensure connections can be disabled quickly if suspicious activity is detected.
Require approved, monitored remote connections
Remote access to operational technology (OT) environments should be permitted only through documented, approved pathways. Organizations should define who may connect, which systems they may reach, and the business purpose and duration of each session. Direct connections from the internet to control systems should be avoided.
Use controlled access points, such as a secure gateway or jump host, and require strong authentication. Access should be time-limited and granted only after authorization by the relevant system owner. Where practical, separate vendor access from employee access and restrict each connection to the specific equipment and tasks required.
Monitor remote sessions through centralized logs and, where appropriate, session recording. Alerts can help identify access outside approved hours, unexpected destinations, or unusual activity. Monitoring should be configured carefully so it does not disrupt time-sensitive or safety-critical processes.
These measures support Operational Technology Security Practices while preserving operational reliability. Organizations should periodically review access approvals, logs, and connection methods, and revoke accounts or permissions when work ends or a user’s role changes.
Apply least privilege and strong authentication
Grant each user and service account only the permissions needed for its assigned duties. In operational technology environments, this limits the potential impact of a compromised account and reduces the chance of accidental changes to controllers, operator interfaces, or safety-related systems.
Use role-based access where practical, with separate accounts for routine work and administrative tasks. Avoid shared credentials because they make it difficult to trace actions to an individual. Review access regularly, and promptly remove or adjust permissions when responsibilities change.
Require strong authentication for remote access and privileged accounts, such as multifactor authentication where supported by the systems and operating conditions. Apply controls carefully to avoid disrupting time-sensitive processes or equipment that cannot support modern authentication; use compensating safeguards, such as tightly restricted access paths and enhanced monitoring, where needed.
These measures support Operational Technology Security Practices by making access deliberate and accountable while respecting the availability and safety requirements of critical infrastructure.
Protect OT Systems Through Vulnerability Management
Vulnerability management in operational technology must account for the safety and availability requirements of industrial processes. Maintain an authorized inventory of OT assets and use vendor advisories, vulnerability databases, and security assessments to identify relevant weaknesses, including those in unsupported or legacy equipment.
Do not assume that a patch can be applied as soon as it becomes available. Confirm compatibility with the equipment vendor and assess potential effects on control functions; where testing is possible, validate changes in a representative environment before deployment. Coordinate maintenance with operations staff to reduce disruption.
When patching is not feasible, document the risk and apply suitable compensating controls, such as restricting network access, disabling unnecessary services, or increasing monitoring. Assign owners and review dates to these measures so temporary mitigations do not become forgotten exceptions.
Effective Operational Technology Security Practices also require prioritizing vulnerabilities by exploitability, exposure, and potential impact on safety and mission continuity—not solely by severity scores. Keep decisions and remediation status documented for accountable, risk-informed oversight.
Monitor OT Networks for Suspicious Activity
Operational technology networks require monitoring that accounts for their real-time functions and safety requirements. Passive network sensors can observe traffic without sending probes that might disrupt older controllers or sensitive processes. Monitoring should cover communications between control systems, engineering workstations, and connected networks.
Establish baselines for normal industrial communications, including expected devices, protocols, and communication patterns. Compare observed activity with these baselines to identify anomalies such as an unfamiliar device, unusual connections, or unexpected changes in traffic. An alert should prompt investigation, not be treated as proof of an attack.
Use monitoring methods suited to the environment, coordinating with operations staff before deploying or changing tools. Where practical, combine network visibility with relevant logs and alerts from OT systems. Clear escalation procedures help security teams assess suspicious activity while minimizing disruption to industrial operations.
These Operational Technology Security Practices support timely detection without compromising availability. Record findings and refine baselines as authorized equipment, processes, and communications change.
Establish baselines for normal industrial communications
A communications baseline describes the expected traffic among operational technology (OT) assets during normal operations. It should identify which devices communicate, the protocols and services they use, and the typical timing and direction of exchanges. This reference helps security teams distinguish routine activity from unexpected changes.
Build the baseline from network observations gathered across representative operating conditions, including scheduled maintenance and relevant production cycles. Consult process engineers and asset owners to validate what monitoring reveals; unusual traffic may reflect a legitimate operational change rather than a cyber incident.
Record approved communication paths and note when patterns vary by operating mode or time. Because industrial processes and configurations change, review the baseline after equipment upgrades, network changes, or process adjustments, and periodically confirm that it remains accurate.
A well-maintained baseline supports OT monitoring without relying solely on generic IT assumptions. As part of Operational Technology Security Practices, it gives defenders a practical basis for investigating new connections, unfamiliar protocols, or unexpected communication volumes while accounting for safety and reliability requirements.
Use monitoring methods suited to sensitive environments
Monitoring in operational technology environments should minimize disruption to control processes. Passive network sensors can observe traffic from a mirrored switch port or network tap, helping identify unusual communications without sending probes that may affect older or sensitive devices.
Where active scanning could create operational risk, use asset data, configuration records, and vendor-approved methods to assess activity. Coordinate any testing with operations staff, and conduct it during an approved maintenance window when necessary. Monitoring tools should be validated for compatibility with the specific equipment and protocols in use.
Alerts should be prioritized according to operational context, such as unexpected communication between network zones or changes in controller traffic. Review findings with personnel who understand normal process behavior, since unusual activity may reflect planned maintenance as well as a security concern. These measured methods support Operational Technology Security Practices while preserving safety and system availability.
Secure Engineering Workstations and Removable Media
Engineering workstations often provide the tools used to configure, program, and maintain industrial control systems. Apply the same care used to protect other OT assets: restrict access to authorized personnel, use dedicated accounts, and limit software installation to approved applications. Keep systems updated through changes tested for compatibility with operational requirements.
Removable media can introduce malware or transfer sensitive configuration files between environments. Permit only authorized, inventoried devices, and scan them on a designated security station before use. Where operationally feasible, disable unused ports and prevent uncontrolled connection of personal or unknown storage devices.
Document approved procedures for transferring files and configuring equipment, including who may authorize exceptions. These measures support Operational Technology Security Practices without disrupting necessary maintenance. Because some legacy tools may require specific hardware or software, validate controls with system owners before deployment.
Prepare Incident Response for Industrial Environments
Incident response in operational technology (OT) environments must account for both cybersecurity and physical safety. A response that interrupts control processes can affect equipment, personnel, or essential services, so plans should define when and how systems may be isolated without creating additional hazards.
Prepare procedures with IT and OT teams, operators, safety personnel, and relevant external partners. Assign decision-making authority, communication responsibilities, and escalation paths. Include scenarios such as unauthorized access, malware, loss of control, and suspected compromise of engineering workstations.
Plans should specify how to preserve evidence while maintaining safe operations, who can approve containment actions, and how to report incidents through established channels. Useful preparation steps include:
- Maintain current contact lists, system diagrams, and response playbooks.
- Conduct exercises using realistic scenarios, then document and address gaps.
These Operational Technology Security Practices make response actions clearer under pressure. Review plans after exercises, incidents, and significant changes to processes or systems.
Build Resilience with Backups and Recovery Plans
Recovery plans should define how critical OT functions will be restored after equipment failure, ransomware, or other disruption. Identify the systems and configurations needed to resume safe operations, and assign accountable personnel for each recovery task.
Maintain protected, offline or otherwise isolated backups of controller logic, device configurations, engineering files, and relevant system documentation. Record backup dates and versions, restrict access, and verify that files can be restored; an untested backup may not support recovery.
- Set backup schedules according to operational needs and the rate of system change.
- Store copies separately from production networks to reduce exposure to the same incident.
- Test restoration procedures in a controlled environment before relying on them.
Recovery plans should address dependencies, such as power, communications, and vendor support, and specify safe operating steps during restoration. These Operational Technology Security Practices help organizations recover methodically while preserving personnel safety and infrastructure reliability.
Sustain OT Security Through Training and Continuous Review
OT security training should reflect the duties of the people who operate, maintain, and protect industrial systems. Operators need guidance on recognizing unusual behavior and reporting concerns, while engineers and administrators need role-specific instruction on approved access, configuration changes, and handling removable media.
Training should account for operational constraints: exercises and demonstrations must not disrupt safety-critical processes or introduce unapproved changes to live equipment. Organizations can use controlled simulations, tabletop exercises, and documented procedures to help staff practice responses without putting production at risk.
Continuous review keeps Operational Technology Security Practices aligned with changes in equipment, processes, personnel, and threats. Review access rights, security procedures, incident lessons, and training materials on a defined schedule and after significant operational changes or incidents.
Track completion and use assessments, exercises, and audit findings to identify gaps. Update guidance when procedures or system configurations change, and ensure contractors receive relevant instructions before they access OT environments.