What is OT (Operational Technology)?
OT (Operational Technology) is the hardware and software that directly monitors and controls physical devices, industrial processes and installations, and in doing so detects or causes changes in the physical world. Where IT is about data and information, OT is about pumps, valves, motors, furnaces and switches that must keep working precisely and reliably. Think of the control system of a production line, a drinking water treatment plant, a power grid, a road tunnel or the HVAC installation of a hospital. The US standards body NIST defines OT broadly as programmable systems and devices that interact with the physical environment, including building management, fire control and physical access control systems.
🧱 Which systems make up OT?
OT is not a single product but a collection of systems that together control a process. The main components:
| System / component | Function | Typical location |
|---|---|---|
| Sensors and actuators | Measure (temperature, pressure, level) and switch (valves, motors) | In the field |
| PLC (Programmable Logic Controller) | Executes control logic in cycles of milliseconds | Control cabinet next to the machine |
| DCS (Distributed Control System) | Integrated control of continuous processes on a single site | Chemicals, refining, energy |
| RTU (Remote Terminal Unit) | Collects data and controls remote installations | Pumping stations, substations, pipelines |
| SCADA (Supervisory Control and Data Acquisition) | Central monitoring and operation, often over long distances | Control room |
| HMI (Human-Machine Interface) | Operator screen used to view and adjust the process | Machine or control room |
| SIS (Safety Instrumented System) | Independently brings the process to a safe state when danger arises | Alongside the process control system |
| Historian | Stores process data long-term for analysis | Supervisory layer |
Together these systems are also known as ICS (Industrial Control Systems) or IACS. Communication between the components runs over fieldbuses and, increasingly, over Industrial Ethernet using protocols such as Modbus and ProfiNET.
🧠 What exactly does OT do?
OT ensures the reliable, predictable execution of physical processes in real time. Typical tasks include:
- Control - keeping temperature, pressure, flow or speed at the desired value
- Switching - starting, stopping or changing over machines, pumps and conveyors
- Protection - using interlocks and an SIS to prevent a process from reaching a dangerous state
- Alarming - warning operators when something deviates
- Recording - capturing process data for quality, traceability and optimisation
A failure in OT has direct physical consequences: lost production, damaged equipment, environmental harm or injury. That is why OT is designed and managed differently from office IT.
🏗️ How is an OT environment structured?
Most OT environments are described using the Purdue Model, developed in 1992 at Purdue University under Theodore J. Williams. The model divides systems into functional levels; level 3.5, the industrial DMZ, is a later addition from security practice:
| Level | Name | Examples |
|---|---|---|
| 0 | Physical process | Sensors, actuators, motors, valves |
| 1 | Basic control | PLC, RTU, controllers, SIS |
| 2 | Supervisory control | SCADA, HMI, engineering stations |
| 3 | Operations | MES, historian, batch management |
| 3.5 | Industrial DMZ | DMZ between OT and IT |
| 4–5 | Enterprise network | ERP, email, cloud |
Levels 0 to 3 form the OT network; levels 4 and 5 belong to IT. Although modern architectures with cloud and edge computing break the strict layering, Purdue remains the common basis for OT architecture and segmentation.
🔄 What is the difference between OT and IT?
OT and IT increasingly use the same technology, but their priorities differ. A detailed comparison is available in the differences between IT and OT.
| Aspect | OT | IT |
|---|---|---|
| Purpose | Control of physical processes | Processing of data and information |
| Priority | Safety and availability, then integrity, then confidentiality | Confidentiality, integrity, availability |
| Impact of a failure | Production stop, damage, injury | Data loss, disrupted services |
| System lifetime | 10–30 years | 3–5 years |
| Patching | Only after testing, often during a planned shutdown | Regular and largely automated |
| Timing behaviour | Deterministic, response times in milliseconds | Delays of seconds usually acceptable |
| Networks | Fieldbuses, Industrial Ethernet, industrial protocols | Ethernet, Wi-Fi, internet |
| Owner | Production, operations, engineering | IT department |
In short: IT mainly protects information, while OT protects a process and the people around it. An antivirus tool that quarantines a file is a sensible response in IT, but in OT the same action can stop a controller.
🏭 Where is OT used?
- Discrete manufacturing - production lines, robots, packaging machines and industrial automation
- Process industry - chemicals, refining, pharmaceuticals and food, often with a DCS
- Energy - power plants, wind farms and high-voltage substations
- Water - drinking water production, sewage pumping stations and wastewater treatment
- Infrastructure and transport - tunnels, bridges, locks, rail and traffic systems
- Buildings - building automation, HVAC, lifts and access control
Many of these sectors are part of critical infrastructure: an outage affects not only the company but society as a whole.
🔐 Why is OT security different?
OT was isolated for decades, so many systems and protocols were designed without authentication or encryption. Through OT convergence, Industry 4.0 and the IIoT they are now reachable. Well-known incidents show what is at stake:
| Year | Incident | Impact |
|---|---|---|
| 2010 | Stuxnet | Manipulated Siemens PLCs damaged uranium centrifuges in Iran |
| 2015 | BlackEnergy | Power outage of up to six hours for around 225,000 customers in Ukraine |
| 2016 | Industroyer | Malware that directly operated circuit breakers in Kyiv |
| 2017 | TRITON | Attack on the safety instrumented system of a petrochemical plant |
| 2021 | Colonial Pipeline | Ransomware in IT led to a precautionary shutdown of a pipeline |
| 2024 | FrostyGoop | Heating for more than 600 apartment buildings in Lviv cut off via Modbus commands |
More recently, Volt Typhoon has shown that state actors quietly pre-position access in critical infrastructure, not to steal information but to be able to disrupt OT in a conflict. The international IEC 62443 series and the NIST SP 800-82 guide (revision 3, September 2023) describe how to secure OT in a structured way.
🛠️ How do you secure an OT environment in practice?
A practical approach usually follows these steps:
- Map all assets - an up-to-date asset inventory of PLCs, HMIs, switches and firmware versions is the foundation for every measure.
- Segment the network - apply network segmentation following the zones and conduits model from IEC 62443, with a DMZ between IT and OT.
- Restrict access - set up role-based access management and allow remote access only through a controlled jump server with MFA.
- Monitor passively - use network monitoring and central logging that understand OT protocols, without loading the process.
- Manage vulnerabilities based on risk - patch management in OT happens after vendor testing and during planned shutdowns; where patching is not possible, segmentation and monitoring compensate.
- Prepare for incidents - an OT-specific incident response plan defines who may decide to shut down an installation or continue running it manually.
Define a target security level (SL 1 to 4) per zone based on the risk assessment; not every zone needs the same level of protection.
🇳🇱 Which rules apply to OT in the Netherlands?
Since 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet) has been in force, implementing the European NIS2 directive. The act applies to an estimated 8,000 essential and important entities, including energy, drinking water, wastewater, transport, chemicals, food and manufacturing. Organisations must register, take appropriate cybersecurity measures (duty of care) and report significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report within one month. The duty of care covers OT as well, not just office IT. The Dutch NCSC provides information and support, while sector regulators supervise compliance.
❓ Frequently asked questions
What does OT stand for?
OT stands for Operational Technology: hardware and software that monitors and controls physical processes and devices. Dutch professionals also use the English term. OT includes PLCs, DCSs, SCADA, HMIs and safety systems, among others.
Is OT the same as ICS?
ICS (Industrial Control Systems) is a subset of OT: the control systems of industrial processes. OT is broader and also includes building management, fire alarm systems and physical access control. In practice the terms are often used interchangeably.
Why can’t OT systems simply be patched like IT?
OT systems often run continuously, and a restart means a production stop or a safety risk. In addition, a vendor must first validate a patch, because an update can change the timing behaviour or certification of a controller. OT patches are therefore tested and usually installed during a planned maintenance shutdown.
How long do OT systems last?
OT systems have a lifetime of 10 to 30 years, compared with 3 to 5 years for typical IT components. As a result, many plants still run controllers and Windows versions that no longer receive vendor updates. These legacy systems require additional compensating measures.
Is OT covered by NIS2 and the Dutch Cybersecurity Act?
Yes, the Dutch Cybersecurity Act applies to all network and information systems of an organisation in scope, so it covers OT as well. A cyber incident that disrupts a production process or the supply of drinking water or energy may have to be reported. Organisations must therefore include their OT in risk assessment, security measures and incident response.
What is IT/OT convergence?
IT/OT convergence is the integration of IT and OT systems, networks and teams, so that production data becomes available for planning, analysis and optimisation. It delivers efficiency but enlarges the attack surface of OT. Proper segmentation and joint management by IT and OT teams are therefore prerequisites.
📌 In summary
OT is the technology that monitors and controls physical processes, from a PLC in a factory to SCADA at a water utility, with safety and availability as the top priority. Connecting OT to IT makes it smarter and data-driven, but also more vulnerable; segmentation, monitoring and security in line with IEC 62443 and the Dutch Cybersecurity Act are therefore essential.