IT vs OT cybersecurity: the process changes the decision
IT and operational technology need many of the same security controls, but the consequences of using them can differ. OT monitors or controls physical equipment. A change that protects an office application may interrupt a production process if it has not been tested for that environment. NIST's OT guidance therefore treats performance, reliability and safety as security requirements, not as exceptions to them.
Start with what the system controls
We would begin an OT security brief with the process, not a software shopping list. Identify what each system monitors or changes, which equipment depends on it and what happens if communication stops. A business application may also be safety-critical; the IT label does not make its failure harmless. The useful distinction is the system's job and the consequences of interruption. Record those consequences before deciding which controls can operate automatically and which need an operator's decision.
A security change needs an operating procedure
For each proposed patch, scan or access restriction, ask how compatibility will be checked, who can approve the change and how the previous configuration will be restored. Agree a maintenance window with the people responsible for the process. Where immediate change is impractical, require a documented interim risk decision rather than treating an old system as exempt from security. NIST SP 800-82 provides the OT-specific guidance; it does not certify that a particular tool is safe for a particular plant.
Test the response with the operators
Put a concrete incident into the acceptance exercise. If monitoring identifies a suspect engineering workstation, who decides whether to disconnect it? What process information does that person need, and what continues to operate during investigation? The exercise should expose gaps between the security team's authority and the operator's responsibilities. Ask bidders to explain their proposed response for the actual equipment and operating state, not to demonstrate the same automated isolation rule used on an office laptop.
Next action
Bring the process diagram, maintenance constraints and incident responsibilities to the OT security briefing.
