Cyber risk in operational technology environments

Why OT is different

Operational technology — SCADA, distributed control systems, PLCs, safety instrumented systems and the networks that connect them — controls physical processes. The following are common tendencies rather than universal rules, but they explain why OT security cannot simply copy an enterprise IT approach:

The convergence of IT and OT — remote access, cloud historians, IIoT sensors, vendor connectivity — has delivered real operational benefit. It has also removed much of the isolation that once protected these systems.

The threat is real and documented

• Ukraine, December 2015: attackers remotely operated distribution SCADA, causing power outages for around 225,000 customers — the first publicly confirmed cyber attack to disrupt a power grid.
• Colonial Pipeline, May 2021: a ransomware attack on the IT environment led the operator to shut down pipeline operations as a precaution, disrupting fuel supply across the US East Coast. The OT was not directly compromised — the dependency between IT and OT was enough.
• Australia, 2024–25: the Australian Signals Directorate (ASD) responded to more than 1,200 cyber incidents; critical infrastructure accounted for 13%, up two percentage points on the prior year. ASD's advice to critical infrastructure includes maintaining a current OT asset inventory, identifying isolation points, and building the ability to isolate and operate vital OT systems through a crisis.

Australia's regulatory context

The Security of Critical Infrastructure Act 2018 (SOCI Act) covers 11 critical-infrastructure sectors, but its obligations attach to defined critical-infrastructure assets and their responsible entities. CIRMP requirements vary by asset class. Baseline rules require cyber and information-security hazards to be addressed through a prescribed or equivalent framework. Enhanced rules that commenced on 10 June 2026 impose additional requirements and, for specified asset classes, updated frameworks and higher maturity expectations. Organisations should confirm the rules that apply to their asset class rather than relying on a single maturity level.

Compliance is a floor, not a strategy. Some frameworks are IT-centred, while C2M2 and AESCSF expressly address energy and operational environments. In every case, OT implementation must be interpreted through engineering, safety and operational constraints.

Six principles that should anchor every OT program

In October 2024, ASD's Australian Cyber Security Centre, with partner agencies from the US, UK, Canada, New Zealand, Germany, Japan, the Netherlands and South Korea, published the Principles of operational technology cyber security. They are a useful test for any OT decision:

1. Safety is paramount.
2. Knowledge of the business is crucial.
3. OT data is extremely valuable and needs to be protected.
4. Segment and segregate OT from all other networks.
5. The supply chain must be secure.
6. People are essential for OT cyber security.

What good looks like

1. Know what you have. An accurate, maintained OT asset inventory — devices, firmware, communications paths and dependencies — is the foundation. You cannot protect, patch or isolate what you cannot see.
2. Zones and conduits. Apply the IEC 62443-3-2 risk-assessment approach: partition assets into zones based on shared security requirements and risk, identify the conduits that connect them, assess each zone and conduit, and assign target security levels. Make the IT/OT boundary deliberate, with a properly designed industrial DMZ.
3. Control remote access. Vendor and engineer remote access is one of the most common pathways into OT. Broker it, authenticate it strongly, log it and time-limit it.
4. Plan for isolation and manual operation. Know which systems can be disconnected, how the plant runs without them, and for how long. Rehearse it.
5. Monitor with OT-aware tools. Passive monitoring that understands industrial protocols detects anomalies without disrupting fragile devices.
6. Bring engineering and security together. Many OT risks are best mitigated by engineering controls — hard-wired safety interlocks, physical isolation, process limits — not just cyber controls.
7. Secure the supply chain. Specify security requirements in procurement (IEC 62443-4-1/4-2 for suppliers and components) and assess integrator and vendor access.

Common pitfalls

• Treating OT as "IT with older computers" and deploying active scanning that can disrupt some legacy or fragile controllers.
• Security teams without operational context — and operations teams without security accountability.
• Board-level cyber reporting that omits OT entirely.
• Incident response plans that cover data recovery but not safe shutdown and restart of physical processes.

OT security is engineering risk management with a cyber dimension — and it needs both disciplines in the room.

References

• Australian Signals Directorate, Principles of operational technology cyber security.
• Australian Signals Directorate, Annual Cyber Threat Report 2024–25: factsheet for critical infrastructure.
• Cyber and Infrastructure Security Centre, current SOCI regulatory obligations, and the 2026 enhanced CIRMP rules.
• NIST, SP 800-82 Rev. 3 — Guide to Operational Technology Security.
• IEC, IEC 62443-3-2 — security risk assessment for system design.
• US Department of Energy, Cybersecurity for the Electricity Subsector.
• US Government Accountability Office, Colonial Pipeline cyberattack overview.