OT cybersecurity for critical infrastructure: protect the process first
A defensible OT security programme protects the physical process before it protects the technology around it. NIST guidance treats performance, reliability and safety as distinctive OT requirements. Operators should therefore establish process criticality and system ownership, control the paths into and between zones, monitor safely, and prove that trusted operation can be restored.
Stage one: know the process and its owners
List the services the site must deliver and the states it must avoid. Map the controllers, safety systems, supervisory servers, engineering tools, historians, identity services, remote connections and external dependencies supporting those outcomes. Assign an operational owner to each function and a technical owner to each asset. Record software state, backups and maintenance authority. The stage is complete when the operator can explain which physical consequence follows the loss or manipulation of each critical function, not merely when a scanner has produced an inventory.
Stage two: control paths and privileges
Design zones around consequence and operating trust. Permit only required conduits, with named ownership and a reason for each one. Broker vendor access so it is approved, time-bound, monitored and disabled by default. Protect engineering workstations and removable-media routes because they carry legitimate change into the process. Legacy equipment may need compensating controls rather than a patch. The evidence output is an approved architecture, access register and exception process that operations and security both understand.
Stages three and four: observe, then prove recovery
Introduce monitoring in a way the operator has assessed as safe. Establish normal communications and process behaviour, route alerts to people who can interpret operational context, and rehearse escalation. Then test protected copies of controller logic, configurations and documentation in a suitable environment. Exercises should include operations, engineering, safety, communications and executive decisions. A programme is mature when the site can isolate a suspect path, move to a safe operating mode and restore trusted control through a rehearsed process. Tool count is not the measure. Continuity and controlled recovery are.
Next action
Use the four-stage framework to identify the next evidence output your site cannot yet produce.
