What Is Operational Technology?
The computers that move the physical world: what operational technology is, where you find it, how it differs from IT, and why safety and availability come before confidentiality.
What OT is
Most of IT is about information: documents, mail, databases, web shops. A wrong value in a spreadsheet is annoying, but it stays on the screen. Operational technology (OT) is different: it is the computing that reaches out and changes something in the physical world. A program decides to open a valve, and water flows. A relay decides to trip a breaker, and a power line goes dead.
The US National Institute of Standards and Technology (NIST) defines OT in its guide SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023), as "a broad range of programmable systems and devices that interact with the physical environment (or manage devices that interact with the physical environment)". Its examples include industrial control systems, building automation, transportation systems and physical access control. A Rev. 4 draft appeared on 21 September 2026; as of 2026, Rev. 3 is still the final version.
Within OT, an industrial control system (ICS) is the system that runs an industrial process. NIST calls ICS a "general term that encompasses several types of control systems, including SCADA systems, DCS, and other control system configurations such as PLCs". Those three, supervisory control and data acquisition (SCADA), distributed control systems (DCS) and programmable logic controllers (PLCs), are explained on Industrial Control Systems. In daily speech, people use "OT" and "ICS" almost interchangeably; strictly, ICS is a subset of OT.
Where OT lives
Almost every sector that moves, makes or distributes something physical depends on OT:
| Sector | What OT controls | If it fails |
|---|---|---|
| Electricity | Generators, substations, breakers, transformers, grid control centers (see The Power Grid) | Regional power outage, damaged equipment |
| Water and wastewater | Pumps, chemical dosing, filters, reservoir levels | Unsafe drinking water, flooding, sewage overflow |
| Manufacturing | Production lines, robots, ovens, packaging machines | Scrap, injuries, weeks of lost production |
| Oil, gas and chemicals | Pipelines, compressors, reactors, safety shutdown systems | Fire, explosion, toxic release, environmental damage |
| Transport | Railway signaling, tunnel ventilation, locks and bridges, traffic lights | Collisions, stranded travelers |
| Buildings | Heating, ventilation and air conditioning (HVAC), elevators, access doors, fire systems | Overheated data rooms, people locked in or out |
| Healthcare | Infusion pumps, imaging equipment, hospital building systems | Harm to patients, canceled treatment |
The scale ranges from one controller in a pumping station to a national grid with thousands of substations. What they share is a physical process that has to keep running, whatever the computers do.
Why physical consequences change everything
Physics does not wait. Water keeps flowing into a tank while a controller reboots; a chemical reaction keeps producing heat while an operator's screen is frozen. That has three consequences that run through this whole topic:
- Timing matters. Many controllers read their inputs and update their outputs every few milliseconds. A protection relay in a substation must react to a short circuit in a fraction of a second. A delay that would be invisible on a web page can be dangerous here.
- Errors are not undone. A database can be restored from backup; a burst pipe or a burned-out transformer cannot. Recovery may mean months of waiting for a replacement part.
- People can get hurt. Engineers design OT so that failures lead to a safe condition, and separate safety systems watch the process independently. Anything that interferes with those systems, including a well-meant security tool, is a safety issue. Safety and Reliability covers this in depth.
IT and OT compared
IT and OT use much of the same technology: Ethernet, IP, Windows, Linux, virtual machines. The difference is in what the systems are for and therefore in how they are run.
| Aspect | IT | OT |
|---|---|---|
| Purpose | Process and store information | Monitor and control a physical process |
| First priority | Often confidentiality of data | Safety of people and equipment, then availability |
| Lifecycle | Laptops 3–5 years, servers around 5 | Often quoted as 15 to 30 years for controllers and plant systems |
| Patching | Monthly, often automated | Only after vendor approval, in planned maintenance windows, sometimes never |
| Uptime | Planned downtime at night or at the weekend is normal | Runs 24/7; a stop may need a plant shutdown that is planned months ahead |
| Timing | Delays of a second are acceptable | Real time: deadlines in milliseconds for control and protection |
| Failure impact | Data loss, downtime, fraud | Injury, environmental damage, outage for whole regions |
| Owner | IT department | Engineering and operations; vendors often maintain the systems |
| Change | Frequent, agile | Rare, tested on a copy or during a shutdown, with a safety review |
The ownership row matters more than it looks. OT is usually run by electrical, process or control engineers who know the plant intimately and are measured on uptime and safety. IT people who join them bring network and security skills the plant often lacks, and learn in return why "just patch it" is not an answer. Most of the good OT security work happens where those two groups trust each other.
Safety first: from CIA to AIC
Information security is often summarized as the CIA triad: confidentiality, integrity and availability. In an office, a data breach (lost confidentiality) is often the worst case. In OT the order is commonly turned around and written as AIC:
- Availability: the process must keep running and be controllable. Operators who lose their view of the process ("loss of view") or their ability to act ("loss of control") cannot keep it safe.
- Integrity: commands and measurements must be correct. A falsified pressure reading or an unauthorized setpoint change can be more dangerous than an outage, because nobody notices it.
- Confidentiality: still important (network drawings, recipes, credentials), but rarely the first concern.
Above all three sits safety. Many practitioners say OT security exists to protect safety and reliability, not data. NIST puts it this way in the abstract of SP 800-82r3: OT security must address OT's "unique performance, reliability, and safety requirements". In practice this means a security control is acceptable only if it cannot stop the process or a safety function from working. An antivirus scan that blocks a file the operator screen needs, or an account lockout on the only console in the control room, can be worse than the attack it tries to prevent.
Critical infrastructure
Critical infrastructure is the set of assets and services a society cannot do without for long: electricity, gas, drinking water, transport, healthcare, food, telecommunications and finance. Much of it runs on OT. Because a disruption hits millions of people and other sectors (no power means no water pumps, no payment terminals, no mobile network), governments regulate its security and resilience.
In the European Union two directives set the rules: NIS2 for cybersecurity and the Critical Entities Resilience (CER) Directive for physical and overall resilience. In the Netherlands they are implemented by the Cyberbeveiligingswet (Cbw) and the Wet weerbaarheid kritieke entiteiten (Wwke), both in force since 15 August 2026. For the energy sector, the Rijksinspectie Digitale Infrastructuur (RDI) is the supervisor.
In the United States there is no single law: the bulk electric system follows the mandatory NERC CIP standards, enforced by the Federal Energy Regulatory Commission (FERC); pipelines and railroads follow security directives of the Transportation Security Administration (TSA); and drinking water systems assess their risks under the Safe Drinking Water Act.
In the United Kingdom the Network and Information Systems Regulations 2018 cover operators of essential services, with a competent authority per sector (for electricity in Great Britain, the energy department and Ofgem). A Cyber Security and Resilience Bill to update them is before Parliament as of October 2026.
The details are on OT Regulation; the general NIS2 picture is on Governance, Frameworks and Compliance.
The IT/OT boundary and why it blurs
The IT/OT boundary is the place where the office and business network meets the control network: the firewalls, servers and data flows that connect the two. Business systems need data from the plant (production figures, meter readings, maintenance alarms), and engineers need to reach plant systems from their desks or from home. Every such connection is also a possible path for an attacker from the internet-facing office network into the process.
Thirty years ago many control networks were physically separate ("air-gapped"), used serial cables and proprietary protocols. That separation has eroded:
- Controllers, operator stations and historians now run on Ethernet, TCP/IP and standard Windows or Linux.
- Business processes want live plant data for planning, billing and maintenance.
- Vendors support their equipment remotely.
- New sensors and analytics send data straight to cloud services (see IT/OT Convergence).
Several of the incidents on Threats and Notable Incidents began in IT and crossed this boundary, or caused an OT shutdown without ever reaching OT. The usual answer is a deliberate, narrow boundary: an industrial DMZ between the two networks, explained on The Purdue Model and OT Architecture, with segmentation on both sides.
A day in an OT environment
To make this concrete, follow a network engineer at a fictional transmission system operator, the company that runs the high-voltage grid. It is a generic picture, not a description of any real company.
- 07:30 · Control room handover. The night shift of grid operators hands over to the day shift. The large screens show the grid's state: line loadings, voltages and the system frequency close to 50 Hz. The operators work in an energy management system on top of SCADA; they are the "users" the network engineer supports.
- 09:00 · Change review. A switch in a substation is due for a firmware update. The change is planned for a window when the substation's bay is out of service for maintenance anyway, approved by the substation engineers, tested first on a spare switch in the lab, and the control room is told when it will happen. Compare the office, where the same update would roll out overnight.
- 11:15 · An alarm. Monitoring shows a new device talking on a substation network. It turns out to be a contractor's laptop connected for testing protection relays. The visit was approved but the laptop was not registered; the engineer updates the asset inventory and reminds the field team of the procedure. No scan was run to find out: the information came from passive monitoring.
- 14:00 · Data request. The asset-management department wants transformer temperatures in its business dashboards. Instead of opening a path from the office into the control network, the data will be replicated to a server in the industrial DMZ, and the dashboards read it there.
- 16:30 · Exercise. A short tabletop session: what if the connection to the backup control center fails during a storm? Operators, engineers and the security team walk through who decides what, and how long the grid can be run with reduced visibility.
Nothing in this day is dramatic, and that is the point: in OT, most of the work is preventing surprises, coordinating with the people who run the physical process, and changing things slowly and deliberately.