Introduction
On January 18, 2024, a control-system misoperation at a water site in Muleshoe, Texas, kept a tank overflowing for 30+ minutes, according to Waterfall's 2025 report. That is what an OT incident looks like: physical, immediate, and hard to undo.
Dragos found that 25% of its ransomware cases ended in a complete shutdown of an OT site. Consequences include halted production, manual operations, equipment damage, and regulatory exposure.
OT security protects the systems that monitor and control physical processes. This guide covers a layered approach: visibility, segmentation, access control, monitoring, response, and safe recovery.
Key Takeaways
- Build an accurate asset inventory first; you can't prioritize what you can't see.
- Segment IT from OT and treat remote access, USB media, and vendor links as high-risk.
- Adapt patching, monitoring, and response to safety and uptime limits.
- Map controls to NIST SP 800-82, CSF 2.0, and IEC 62443, then test that they work.
OT Security Best Practices for Industrial Environments
OT security takes more than technical controls. It needs operating procedures, governance, and plant-level expertise, because a cyber event can affect physical processes and worker safety.
What Makes OT Different
NIST's OT guide puts safety, reliability, and performance first. Traditional IT programs center on confidentiality, integrity, and availability. Rapid change and standard IT remediation timelines often don't fit a running line.
Main risk categories:
- Legacy systems that lack vendor support or patches
- Insecure industrial protocols that allow interception and command injection
- IT/OT convergence without adequate segmentation
- Exposed remote access and third-party connections
- Unauthorized devices and removable media
- Limited visibility into what is connected
Visibility is a real gap. Dragos reported in 2024 that 61% of its services engagements involved limited asset visibility, without publishing sample size or geographic scope.
An Ongoing Practice
OT security isn't a project with an end date. It includes asset lifecycle management, continuous monitoring, periodic reassessment, incident exercises, and review after any change to a plant, vendor, or process.
General OT Security Precautions
Build the Inventory
Start with a non-disruptive inventory of PLCs, SCADA and DCS components, HMIs, RTUs, safety systems, engineering workstations, historians, network gear, remote-access gateways, and IIoT devices.
NIST notes that passive monitoring and manual inspection can maintain inventory, while active scanning may require taking production offline.
For each asset, record:
- Owner, location, and process function
- Criticality and recovery requirement
- Firmware or OS version and support status
- Network zone, ports, services, and user accounts
CISA's August 2025 asset inventory guidance also asks for communication pathways and process dependencies, which let you rank exposure by operational consequence.
Set Governance and Baselines
Shared governance matters. IT, OT security, plant operations, engineering, safety, procurement, and vendors should agree in writing on who approves changes, accepts risk, isolates systems, and makes safety decisions.
Then harden each device:
- Remove default credentials on PLCs and HMIs
- Disable unnecessary services and ports
- Restrict USB and removable media
- Limit administrative privileges
- Document exceptions for legacy equipment
Choose a Framework Baseline
Don't use a generic IT checklist. Pick a risk-based baseline and map controls to it.
| Framework | Use |
|---|---|
| NIST SP 800-82 Rev. 3 (2023) | OT-specific risk, architectures, and safeguards |
| NIST CSF 2.0 (2024) | Govern, identify, protect, detect, respond, recover |
| IEC 62443 | Security programs, zones, conduits, security levels |
| MITRE ATT&CK for ICS | Adversary techniques and detection context |
Sector rules such as NERC CIP and TSA directives apply only to covered entities.
Secure OT Installation and System Changes
Before new equipment touches a production network, map its communications, trust boundaries, vendor dependencies, maintenance paths, and safety implications. Require security and operations sign-off.
Segment with Zones and Conduits
IEC 62443-3-2 requires you to define the system, split it into zones and conduits, assess each one's risk, and assign target security levels. Separate enterprise IT, an OT DMZ, site operations, control networks, safety systems, and vendor access. Allow only explicit, allowlisted conduits.
Don't count on an air gap. NIST's 2025 guidance on portable media (SP 1334) describes firmware moving into isolated OT networks on removable media, and warns that this creates cyber risk.
Test Before You Change
NIST advises testing patches offline and validating operational and safety effects. Monitoring agents, active scanning, and IDS/IPS need testing too. Use a lab or simulation where possible, and schedule production changes in approved maintenance windows.
Stop a high-impact change if any of these is true:
- Asset dependencies are unknown
- No tested backup exists
- Rollback steps are undefined
- Safety personnel aren't involved
- A live process is affected without an approved recovery plan
Safe Operation of OT Systems
Lock Down Remote Access
Dragos found insecure remote conditions at 65% of assessed sites, and remote services such as VPNs or RDP were involved in more than half of the ransomware cases it handled (global figures, not US-only).
A 2025 CISA and Coast Guard threat hunt found standard IT user accounts that could reach a SCADA VLAN directly. Their recommendations:
- Dedicated bastion hosts for OT access, with phishing-resistant MFA
- Individual identities and least privilege
- Time-limited approvals and immediate revocation after work
- Logging of authentication, commands, configuration changes, and file transfers, aggregated into a SIEM
Monitor Against a Baseline
Establish normal communication and process behavior, then watch for deviations:
- Unexpected PLC logic changes
- New device connections
- Unusual engineering-workstation activity
- Unauthorized protocol commands
- Access outside approved windows
Respond Without Creating a Bigger Problem
Containment must involve operators. An automated isolation can trigger an unsafe shutdown or interrupt a critical control loop. Decide in advance when to isolate, observe, fail over, or go manual.
Build OT-specific playbooks for scenarios such as:
- IT-to-OT movement
- Ransomware
- Compromised vendor access
- Unauthorized controller changes
- Removable-media infections
- Safety-system concerns
- Loss of monitoring
NIST recommends that operations, engineering, vendors, and safety staff help write and approve them. Keep paper or offline copies on hand.
When You Lack 24/7 Coverage
Many plants can't staff round-the-clock OT monitoring. A managed detection and response model can fill the gap.
DeepSeas' CyberFusion SOC, for example, offers 24/7 monitoring, threat intelligence, and response coordination, and can work with existing SIEM or EDR investments. Its analysts validate alerts from passive OT detection tools, and every response action gets human and safety review.
Environmental and System Safety Considerations
Compensate for What You Can't Patch
Legacy operating systems, unsupported firmware, and fragile devices often can't be patched or rebooted. NIST's patch process calls for compensating controls when patching is delayed:
- Segmentation and access restrictions
- Application allowlisting
- Virtual patching where appropriate
- Increased passive monitoring
CISA's guide suggests weighing downtime costs against replacement or compensating controls.
Map Dependencies and Suppliers
Assess how corporate IT, cloud platforms, IIoT devices, historians, MES, identity services, engineering tools, and wireless links connect to production. An IT compromise shouldn't be able to disable a line.
Bring suppliers, OEMs, integrators, contractors, maintenance laptops, and removable media into the risk model. Set requirements for procurement, onboarding, access approval, updates, and offboarding.
NERC CIP-013-2 shows what this looks like for covered power entities:
- Vendor incident notification
- Access termination
- Vulnerability disclosure
- Software authenticity
Protect Recovery
Keep offline or resilient backups of PLC logic, HMI configurations, engineering workstations, network configurations, historian data, and critical servers.
NIST recommends off-site, geographically diverse PLC backups, integrity checks, and restoration tests. If a full test is infeasible, verify integrity at minimum.
Measure What Matters
Track metrics that show whether OT controls hold up in production:
- Critical-asset coverage and inventory accuracy
- Remote-access review completion
- Detection and response performance
- Backup restoration success
- Unresolved high-risk pathways
- Cyber-related downtime
Common OT Security Mistakes to Avoid
- Trusting the air gap. Vendor laptops, USB media, temporary connections, and undocumented devices all bridge it.
- Applying IT controls blindly. Aggressive scans, unplanned patching, forced reboots, and broad auto-isolation can interrupt processes or damage fragile equipment. NIST warns that active scans may require production to be offline.
- Buying tools without discipline. Stale inventories, standing vendor access, shared accounts, ignored alert context, and unrehearsed recovery undo the investment.
- Treating compliance as the goal. NIST says SP 800-82 shouldn't be used purely as a checklist. Documentation should support fewer reachable attack paths and better resilience.
On removable media specifically, NIST recommends scanning before and after use, device and file allowlisting, disabling Autorun, and detecting removable-media activity.
Conclusion
Strong OT security comes down to a few habits:
- Know what's connected
- Control how systems communicate
- Govern who can change them
- Monitor continuously
- Recover safely when prevention fails
Make it routine. Schedule reviews, test playbooks with plant and engineering teams, plan around maintenance windows, oversee suppliers, and keep improving. A one-time project goes stale the moment a plant changes.
Frequently Asked Questions
What is OT security?
OT security protects industrial control systems, connected devices, and physical processes from cyber threats. Its aim is to preserve safety, operational availability, and process integrity.
Why is OT security different from IT security?
OT puts safety, availability, reliability, and process integrity first, while IT traditionally centers on data confidentiality, integrity, and availability. Legacy equipment and uptime demands also limit patching and scanning.
What are the most important OT security best practices?
Start with asset visibility, segmentation, secure remote access, and least privilege. Add OT-aware monitoring, tested incident response, resilient backups, and safe recovery.
How can organizations secure legacy OT systems that cannot be patched?
Use compensating controls: segmentation, allowlisting, restricted access, and virtual patching where suitable. Add passive monitoring, maintenance planning, and tested backups.
How should remote access to OT environments be managed?
Require MFA, individual accounts, least privilege, and time-bound approvals. Broker access through jump hosts, log sessions, oversee vendors, and revoke access immediately after work.
Which frameworks or standards guide OT security in the US?
NIST SP 800-82, NIST CSF 2.0, IEC 62443, CISA guidance including the Cross-Sector CPGs, and MITRE ATT&CK for ICS. Sector rules such as NERC CIP and TSA directives apply to covered entities.
