An IT security policy that forces a monthly password reset makes sense on an office laptop. Applied to a PLC controlling a production line, it can shut down equipment mid-shift. How OT priorities differ from IT, and why legacy equipment is the recurring problem.
An IT security policy that forces a monthly password
reset and automatic patching makes sense on an office laptop. Applied
unmodified to a PLC controlling a production line, the same policy can
shut down equipment mid-shift or brick a controller that was never
designed to receive an automatic update in the first place.
Operational technology (OT) — the PLCs, HMIs, and industrial control
systems running physical processes — has different priorities than IT.
IT security typically ranks confidentiality first; OT security
generally ranks availability and safety first, since an unplanned
shutdown of a production line or safety system has direct physical and
financial consequences that a delayed email doesn’t.
| Environment | Typical priority order |
|---|---|
| IT | Confidentiality, then Integrity, then Availability |
| OT | Availability and Safety, then Integrity, then Confidentiality |
Plant-floor equipment often runs for decades, far longer than a
typical IT refresh cycle, which means many facilities have controllers
running unsupported operating systems that can never be patched against
known vulnerabilities. Network segmentation — isolating OT networks
from the broader corporate IT network — is frequently the practical
substitute for patching equipment that simply can’t be updated.
See our related guide on
CMMC 2.0 compliance for the contractual framework defense
manufacturers must meet around Controlled Unclassified Information.
CMMC defines the compliance requirement; OT cybersecurity fundamentals
like network segmentation and asset inventory are part of how a
facility actually achieves it on equipment that predates most of the
framework’s assumptions.
OT cybersecurity fundamentals fit inside the digital transformation
work covered in SCMEP’s Digital
Transformation programs. As a NIST Manufacturing
Extension Partnership affiliate serving South Carolina manufacturers
since 1989, our focus is practical steps for legacy equipment, not
a generic IT security checklist.
If your team is assessing OT network security or planning
segmentation for legacy equipment, you can
browse the Industry 4.0 and Digital
training catalog or email the training team.
IT security typically prioritizes confidentiality first, while OT security generally prioritizes availability and safety first, since an unplanned shutdown of a production line has direct physical and financial consequences.
Plant-floor equipment often runs for decades, far longer than a typical IT refresh cycle, leaving many facilities with controllers running unsupported operating systems that can never be patched against known vulnerabilities.
Network segmentation isolates OT networks from the broader corporate IT network, and is often the practical substitute for patching equipment that can’t be updated due to its age or manufacturer support status.
CMMC defines the contractual compliance requirement around Controlled Unclassified Information. OT cybersecurity fundamentals like network segmentation and asset inventory are part of how a facility actually achieves that compliance.
