OT Security for CISOs Who Cover the Plant Floor

TL;DR: Operational technology (OT) security protects the systems that run physical processes, from the controllers behind a pump station to a building's air handling. Unlike office information technology (IT), it ranks safety and availability ahead of confidentiality, and devices often run 10 to 20 years. A chief information security officer (CISO) can anchor the program in the National Institute of Standards and Technology (NIST) SP 800-82 Rev. 3 and start with an asset inventory built with plant staff.

What is OT security?

Operational technology (OT) security protects the systems that run physical processes: the controllers behind a pump station, a packaging line or a building's air handling. The stakes differ from office IT. A federal training catalog describes OT as the setting "where threats can cause physical disruptions, safety risks, and economic loss" (NICCS).

The National Institute of Standards and Technology (NIST) gives the working definition. OT "encompasses a broad range of programmable systems and devices that interact with the physical environment" or manage devices that do (NIST). Its examples go well past the factory floor (NIST):

• industrial control systems (ICS)
• building automation and physical access control systems
• transportation systems
• physical environment monitoring and measurement systems

That list matters for scope. In our reading, a CISO who owns IT plus the plant often also owns the badge readers and the chiller controls, whether the org chart says so or not.

The two U.S. references to hold

NIST SP 800-82 Rev. 3 is the core guide. NIST finalized it in September 2023, and it supersedes the 2015 Rev. 2 (NIST). It sets out how to secure OT "while addressing their unique performance, reliability, and safety requirements," and covers typical system topologies, common threats and vulnerabilities, and recommended countermeasures (NIST). An initial public draft of Revision 4 is open, with comments due by November 30, 2026 (NIST).

CISA's OT principles come from the Cybersecurity and Infrastructure Security Agency (CISA) page for Principles of Operational Technology Cyber Security. The document was developed by the Australian Cyber Security Centre with international partners, including CISA, the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) (CISA). It is written for organizations making decisions on designing, implementing and managing OT environments (CISA).

A practical first step: read the NIST overview chapters before the control sections, then hand the CISA principles to your operations lead. In our reading, the two documents work best side by side, one as the technical reference and one as the common language. For unfamiliar terms, keep the CISO security glossary open.

How is OT security different from IT security?

For a chief information security officer (CISO) who built a program on the information technology (IT) side, the plant floor runs on a different order of priorities. The controls look familiar. The trade-offs behind them do not.

The table below follows a comparison published by Shieldworkz. In it, the OT asset types are industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs) and human-machine interfaces (HMIs).

What changes in practice

Safety and availability come first. The same comparison puts confidentiality last in OT, behind safety, availability and integrity. We think this is the line that trips up IT-trained teams most often. Stolen production data is a problem. In our reading, a controller that halts a line or overrides a limit is a bigger one.

Availability carries real weight here. OT systems often operate 24/7 with minimal downtime, so the IT habit of rebooting to clear a fault or apply a fix does not carry over.

The long lifespans compound this. A device expected to run 10 to 20 years will outlast several generations of the IT estate around it. Many of these systems were not originally designed with cybersecurity in mind. In our reading, a security leader should expect to defend equipment that cannot be upgraded, rather than plan around replacing it.

Patch cycles follow the plant's maintenance windows. OT patching is planned and requires careful testing. In our reading, the real calendar is set by scheduled shutdowns, not by a vendor's release cycle. Three steps help:

• Get the outage and turnaround schedule from operations and map critical fixes to it.
• Test patches on a spare or staged unit before they reach a running line.
• Between windows, rely on compensating controls such as segmentation and tight remote access, and record the accepted risk.

For more on where plant-floor duties sit among senior roles, see CISO vs CIO vs CSO vs CTO.

What is the Purdue model?

The Purdue model is a layered map of an industrial site. It sorts every system, from a sensor on a pipe to the corporate finance server, into numbered levels. Then it sets rules for which levels may talk to which.

The National Petroleum Council (NPC) topic paper traces it to the Purdue Enterprise Reference Architecture (PERA), a control systems reference model first developed in December 1990 and published a year later. Its security role is segmentation. The paper says it provides a framework for segmenting industrial control system (ICS) networks from corporate enterprise networks and the internet. It also serves as the baseline architecture for ICS frameworks, including the National Institute of Standards and Technology (NIST) 800-82 guidance covered earlier.

The levels, bottom to top

How the levels become network zones

The NPC paper describes an Extended Purdue model that applies specific risk layers and security zones. Each boundary between levels is a place to filter and log traffic.

In our reading, the risk column is the part to show a board. Risk rises as you go down the stack, toward equipment that carries the least IT security tooling and the highest safety consequence.

The model has limits. Many modern sensors communicate directly with cloud monitoring software over cellular networks, skipping the middle levels.

Three checks a CISO can ask for this quarter:

• A map of plant assets assigned to levels, with owners named.
• Every connection that crosses the DMZ, with its business reason.
• Confirmation that vendor remote access terminates in the DMZ, not at Level 2 or below.

Where the Purdue model falls short

The Purdue model assumes data climbs or descends one layer at a time, with the demilitarized zone (DMZ) as the single crossing between plant and enterprise. Three pressures now route traffic around that ladder. In our reading, Federal guidance has adjusted by treating segmentation as one part of the design, not all of it.

Three pressures on the layers

The cellular sensors described in the previous section are the plainest case. They connect outward without touching the levels the model was built around.

None of this has retired the model. Industrial uptime requirements and budgets often mean the new can't yet replace the old, and many are advocating a hybrid approach of applying macro segmentation (Zscaler).

Segmentation as one control among several

Zones and conduits are the segmentation piece. They are listed as one item of three.

FBI Cyber Division Assistant Director Brett Leatherman put the reasoning directly: "Resilience in OT isn't achieved through any single control; it requires layered defenses that raise the cost for adversaries at every stage" (CISA).

In our reading, the shift is from asking which layer a device sits in to asking how each connection is granted, limited and watched. The levels still tell you where consequences are highest. They no longer tell you where the traffic goes.

What to check

• List every path that bypasses the DMZ, including cellular links, cloud telemetry and vendor remote access.
• For each path, name who authenticates the session and who reviews its logs.
• Compare that list against the eight connectivity principles and note the gaps for your plant leads.

What NIST SP 800-82 says and which revision to use

The National Institute of Standards and Technology (NIST) publishes Special Publication (SP) 800-82 as its main guidance for securing systems that run physical processes. The short version: build your program on Rev. 3, and start reading the Rev. 4 draft now, because that draft shows where the document is going.

Three revisions, one direction

Rev. 2 was finalized in June 2015 under the title Guide to Industrial Control Systems (ICS) Security. Its scope was the classic control stack: supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS) and programmable logic controllers (PLC). NIST withdrew it on September 28, 2023.

Rev. 3 went final the same day. The change is in the title. It is now a guide to operational technology (OT) security, and its draft listed an expansion in scope from ICS to OT. The examples now reach building automation, transportation and physical access control systems. The draft also listed an OT overlay for the NIST SP 800-53 Rev. 5 controls, with tailored baselines for low-, moderate- and high-impact OT systems.

Rev. 4 is a draft. Its initial public draft is dated September 21, 2026, and comments are open through November 30, 2026. The listed changes matter to a security leader:

• It is restructured around the NIST Cybersecurity Framework (CSF) 2.0, with risk management reorganized under the CSF Govern Function.
• It expands sector coverage to water and wastewater, food and agriculture, freight rail and maritime vessels, plus Industrial Internet of Things (IIoT) and cloud convergence.
• It adds guidance on asset management and network monitoring and detection.
• Its architecture guidance focuses on protecting system management functions and applying zero trust principles.

Which one to work from

• Cite Rev. 3 in policies, audits and contracts. It is the final version, and a withdrawn Rev. 2 reference in a vendor questionnaire or control mapping is a quick fix.
• Read Rev. 4 as a preview. Do not treat it as final. Draft text can change before NIST publishes the final version.
• Comment if your plant has a stake. Your engineers know where the draft's monitoring or zero trust guidance will not fit legacy controllers.

In our reading, the CSF 2.0 restructuring is the change with the most reach for a chief information security officer (CISO). Once OT risk sits under Govern, plant-floor risk joins the same reporting line the board already sees, which ties into board cybersecurity oversight. The zero trust material also fits with the joint OT zero trust guidance covered earlier in this guide.

What CISA's guidance for critical infrastructure asks of operators

The Cybersecurity and Infrastructure Security Agency (CISA) has put its name to three operational technology (OT) documents that a plant-floor CISO can hold a program against. None of them is a regulation. They describe practices, and a reader can test their own environment against each one.

Principles of OT Cyber Security

This one is international. CISA lists it with a publish date of October 1, 2024. It was developed by the Australian Signals Directorate's Australian Cyber Security Centre with CISA and other partners. It aims to help organizations making decisions for designing, implementing, and managing OT environments. CISA describes it as of moderate technical complexity, and it assumes the reader already knows the basics.

Secure Connectivity Principles for OT

This joint CISA and UK guidance carries a publish date of January 14, 2026. What it adds here is a sharper audience. CISA says the principles are particularly critical for operators of essential services.

Adapting Zero Trust Principles to OT

The multi-agency zero trust guide, introduced in an earlier section, is titled Adapting Zero Trust Principles to Operational Technology. It names three constraints directly: technology gaps from legacy infrastructure, operational constraints, and the safety requirements. It also warns that zero trust adoption must be done carefully without disrupting their own systems in the process. Chris Butera, CISA Acting Executive Assistant Director for Cybersecurity, said CISA has observed threat actors like Volt Typhoon targeting OT systems.

In our reading, the three documents work best as a sequence. Start with the principles to set expectations. Use the connectivity guidance to audit what crosses the boundary. Then phase in zero trust controls where legacy gear and safety limits allow.

CISA also lists companion pieces next to the connectivity guidance. One is on asset inventory guidance for owners and operators. Another covers maintaining a definitive view of your operational technology (OT) architecture. We think an inventory comes first, because none of the checks above can be run without one.

Whether any of this guidance binds your organization depends on sector rules and contracts, so check those with counsel. For terms used here, see the glossary.

Who owns OT security when the CISO seat covers the plant floor

Our view is simple: operational technology (OT) risk reaches the chief information security officer (CISO) only when three things are in place. The first is a reporting line that gives the CISO standing outside corporate IT. The second is a working relationship with plant engineering. The third is a board that asks about the plant floor by name. In our reading, if any of the three is missing, OT risk tends to stay inside operations and surface only after an incident.

The reporting line

In our reading, a CISO who reports through the chief information officer often inherits a mandate that ends at the IT boundary. Plant networks then fall under operations or engineering budgets, and security findings travel through a manager who does not own them. Before you take or reshape the seat, check whether your charter names OT assets explicitly. Our guide to CISO reporting structure and the reporting lines report cover the options in detail.

Plant engineering

The plant engineer controls change windows, vendor access and the safety case. In our reading, a CISO who arrives with policy and no site time will be routed around. We think the practical step is a named counterpart at each site, plus a joint change process that both teams sign. Consequence is the shared language: the stakes in OT include physical disruptions, safety risks, and economic loss.

Board oversight

In our reading, boards that receive one blended cyber score rarely see plant exposure. Ask for a separate OT line in the risk register, with an owner on both the security and operations side. See board cybersecurity oversight for how directors frame that duty.

Hiring and training

When screening OT-capable hires, look for people who have worked inside a plant change process, not only people who hold a credential. Training catalogs help you set the bar. The federal catalog run by the National Initiative for Cybersecurity Careers and Studies lists OT courses where participants cover threat detection, segmentation, and incident response for these environments, with objectives such as building secure architectures and incident response plans. A catalog entry is not an endorsement: the catalog states that it does not own the courses it lists.

Accountability

Accountability without authority is the common failure. If the CISO answers for OT incidents but cannot approve OT changes, the role carries blame without control. Write down who decides, who is consulted and who answers before the first incident tests it. Our CISO accountability guide covers how to document that split.

First steps for a sitting security leader taking on OT

The guidance covered earlier points to a short sequence. We would take these five steps in this order, and each one works only if the plant team owns it with you.

1. Build the asset inventory with plant staff. The National Institute of Standards and Technology (NIST) defines operational technology (OT) more broadly than the control room. Its examples include industrial control systems, building automation systems, transportation systems, physical access control systems, and environment monitoring and measurement systems. Walk the site with a controls engineer. Use the asset inventory guidance from the Cybersecurity and Infrastructure Security Agency (CISA) noted earlier, and record who is allowed to change each device. In our reading, a network scan alone misses what the plant team knows from memory.

2. Map every connection into the OT environment. CISA says OT systems are "becoming increasingly interconnected, digitally monitored, and remotely operated." The same release warns that "Improperly secured pathways create opportunities for threat actors to gain access to information technology (IT) and OT networks." Count the following:

• vendor support links
• cellular modems in cabinets
• data historians that replicate to the corporate network
• any human-machine interface (HMI) reachable from the internet

CISA has a fact sheet on the last item, titled Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems.

3. Review remote access against the secure connectivity principles. CISA and the UK National Cyber Security Centre outline "eight principles to use as a framework to design, secure, and manage connectivity into OT environments." Test each remote path from step two against all eight. A path that nobody on the plant side can justify is a candidate for removal. A path that operations needs gets a named owner and a review date.

4. Rehearse incident response with operations. Brett Leatherman, Assistant Director of the FBI Cyber Division, said OT environments "often lack the visibility to detect them early," referring to nation-state actors. Run a tabletop exercise in which the plant manager, not the security team, decides whether to isolate a production line. The security team learns what a shutdown costs, and operations learns what containment requires.

5. Check how an OT incident would feed materiality and disclosure. A plant event reaches the disclosure process through people, so the handoff needs to be written down. Check three things:

• Which plant measures reach the group that assesses cybersecurity materiality. Downtime, safety events and lost output are typical.
• Who on the operations side is named in the escalation path.
• Whether the incident response plan states when that call happens.

The materiality decision guide and the entry on Form 8-K Item 1.05 set out what the rule asks. Counsel decides how it applies to your company.

The order matters less than finishing each step jointly. In our reading, an inventory or a tabletop exercise that operations did not help build tends to be ignored on the plant floor. A new leader can fold these steps into the first 90 days plan.

What this guide does not cover

This guide does not walk through individual controls in NIST SP 800-82 or the full text of each CISA publication, and it does not assess or compare OT security vendors or products. Whether any of this guidance binds your organization depends on sector rules and contracts. Nothing here is legal advice, so take disclosure and regulatory questions to counsel. For the rules and the record behind it, see CISO Accountability: What the Rules Actually Put on the Role.