IT

What is IT (Information Technology)?

IT (information technology) is the combination of computers, networks, storage, software and services an organisation uses to collect, process, store and exchange information in support of its business processes. IT is the digital backbone of administration, communication, planning and decision-making. In industry, IT sits alongside OT (operational technology), which measures and controls physical processes. Where the two worlds meet, OT convergence emerges.

🧱 What are the components of IT?

More and more of these components are no longer bought but consumed as a service: infrastructure, platform and software from the cloud (IaaS, PaaS and SaaS) alongside on-premise systems and virtualised servers.

🧠 What does IT do in an organisation?

IT makes it possible to:

• Store and retrieve data - customer records, financial accounts, product specifications
• Communicate - email, chat, video calls and document sharing, internally and with supply chain partners
• Automate business processes - through ERP, CRM, HR systems and electronic data interchange (EDI)
• Support decisions - with reports, dashboards and data analysis
• Work reliably and securely - with firewalls, backups, access management and backup power from a UPS

🔐 Which security priorities does IT follow?

Information security in IT revolves around the CIA triad: confidentiality, integrity and availability. In an office environment confidentiality usually comes first: a breach of personal data or trade secrets is the biggest risk, not least because of the GDPR (in Dutch, the AVG).

In OT the order is reversed. Availability and integrity come first, with the safety of people and plant as the overriding requirement. That difference explains why a measure that is routine in IT, such as rebooting a server straight after an update, can be unacceptable in a factory.

Well-known frameworks for IT security and IT management:

🔄 What is the difference between IT and OT?

A more detailed comparison is in Differences Between IT and OT.

🔧 How does IT handle lifecycles and patching?

IT works in short, predictable cycles. Laptops and servers are typically replaced after three to five years and software receives continuous updates. Microsoft releases security updates on Patch Tuesday, the second Tuesday of each month, and most organisations roll them out within days to weeks through patch management and change management.

A typical IT approach to maintenance and patching:

1. Inventory - keep an up-to-date CMDB or asset inventory
2. Prioritise - assess vulnerabilities using CVSS scores and information on active exploitation
3. Test - roll updates out to a pilot group first
4. Deploy - automatically through management tools and Group Policy
5. Verify - check with vulnerability scans and report patch coverage

When a vendor ends support, as Microsoft did for Windows 10 on 14 October 2025, IT replaces the system. In OT such an operating system often keeps running for years on operator stations and engineering workstations, because the application is only certified on that version. This is how legacy systems arise that need extra segmentation to protect them.

🏭 Where do IT and OT meet?

In the Purdue Model IT covers levels 4 and 5: business planning and logistics (ERP, email, databases) and the enterprise network with internet and cloud access. Level 3 holds site systems such as MES and the historian; the interface between levels 4 and 3 is described in ISA-95.

Ideally an industrial DMZ (level 3.5) sits between IT and OT. No system on level 4 or 5 has a direct connection to level 3 or below: traffic terminates in the DMZ, where it is inspected and logged. Typical connections are:

• ERP ↔ MES - production orders down to the plant, completions and consumption back up for inventory management
• Historian replication - process data mirrored to a server in the DMZ for reporting
• Remote access - vendors and engineers via a jump server with MFA
• Shared services - time synchronisation, antivirus updates and patches through an intermediate server in the DMZ

The importance of the IT/OT boundary became clear at Colonial Pipeline in 2021: ransomware hit only the IT network, yet the pipeline was shut down as a precaution. With NotPetya (2017), malware spreading through IT networks also halted production at companies worldwide.

🤝 Which conflicts arise between IT and OT, and how do you align them?

Common tensions:

• Patch policy - IT wants to patch quickly, OT fears a production stop or losing vendor support
• Scanning and tooling - active network scans from IT can crash older PLCs
• Ownership - unclear who is responsible for the switch, firewall or server on the plant floor
• Accounts - shared operator accounts clash with personal IT accounts

How to bring both worlds into line:

1. Define roles and ownership - for example an OT security officer alongside the CISO and one shared security policy with an OT annex
2. Use fitting standards - ISO 27001 for the organisation, IEC 62443 and NIST SP 800-82 for the OT environment
3. Segment - network segmentation with an IDMZ and, where needed, a data diode for one-way traffic
4. Adapt IT processes - patching in maintenance windows, passive monitoring instead of active scans
5. Organise joint incident response - one incident response plan for IT and OT

Since 15 August 2026, the Dutch Cyberbeveiligingswet, which transposes NIS2 into Dutch law, has required essential and important entities to manage risk across all their network and information systems. IT and OT therefore fall under the same duty of care.

❓ Frequently asked questions

What does the abbreviation IT stand for?

IT stands for information technology. The term covers all the hardware, software, networks and services an organisation uses to process information. The related term ICT explicitly adds communication technology, such as telephony.

Is OT part of IT?

OT is not part of IT but a separate domain that measures and controls physical processes using PLCs, SCADA and DCS. OT does use more and more IT technology, such as Ethernet, Windows servers and virtualisation. As a result the two domains are converging, even though their priorities differ.

Why can’t IT security simply be applied to OT?

IT security assumes regular patching, rebooting and active scanning. In OT those actions can disrupt a production process or invalidate a certified configuration. OT therefore needs adapted measures based on standards such as IEC 62443.

Which standard does IT use for information security?

The most widely used standard for IT information security is ISO 27001, with the controls in ISO 27002 as its detailed guidance. Many organisations also use the NIST Cybersecurity Framework 2.0, and Dutch government bodies use BIO2.

How long does IT equipment last?

IT equipment such as laptops and servers typically lasts three to five years before replacement makes sense. OT components often stay in service for ten to fifteen years or longer. That difference in lifetime is a major cause of outdated systems in factories.

Where is the boundary between IT and OT in the Purdue model?

In the Purdue model IT sits on levels 4 and 5, with ERP, email and the enterprise network. OT covers levels 0 to 3. The boundary is guarded by an industrial DMZ at level 3.5, so that no direct connections exist between the two networks.

📌 In summary

IT is the technology behind information management and digital communication: it processes data with confidentiality first, short lifecycles and frequent updates. In industry IT works alongside OT, but with different priorities. A clear boundary through an industrial DMZ, shared agreements on patching and ownership, and standards such as ISO 27001 and IEC 62443 make that collaboration secure.