Operational technology (OT)

Operational technology, or OT, is the hardware and software that watches and steers physical things: the controllers that open valves in a water plant, run the machines on a production line or keep a building at the right temperature. The U.S. National Institute of Standards and Technology (NIST) describes it in its Guide to Operational Technology (OT) Security, SP 800-82 Rev. 3, as a broad range of programmable systems and devices that interact with the physical environment, or that manage devices that do. Information technology (IT) stores and moves data; OT makes something happen in the physical world, so a fault or an attack can stop a plant or put people in danger.

What are examples of operational technology?

The most common examples are control systems: NIST lists industrial control systems, building automation systems, transportation systems, physical access control and environmental monitoring systems. Inside them, a few building blocks come up again and again:

• A programmable logic controller (PLC) is a rugged industrial computer that reads sensors and drives motors, valves and switches according to a program that runs in a continuous loop.
• SCADA (supervisory control and data acquisition) collects data from equipment spread over a wide area, such as a pipeline, a water network or a power grid, and lets operators control it from a central room.
• A distributed control system (DCS) runs a process on a single site, such as a refinery or a power station, with many controllers working under one supervisory layer.
• A human-machine interface (HMI) is the screen through which an operator sees the process and gives commands.

What is the difference between OT and IT?

The main difference is what each one protects first. In a typical IT system the priority is keeping data confidential and correct; in OT, NIST writes, human safety comes first, followed by protection of the process (SP 800-82 Rev. 3, Section 2.4 and Table 1). That changes everyday decisions:

• Availability. Many industrial processes run around the clock. Restarting a server is routine in IT, but in OT it can stop production, so outages are planned days or weeks ahead.
• Lifetime. NIST notes that IT components typically last three to five years, while OT equipment is often in service for 10 to 15 years and sometimes longer.
• Updates. Office computers often patch themselves automatically. OT updates must be tested by the vendor and by the plant first, and some equipment runs old operating systems that no longer receive patches at all.
• Timing and resources. Controllers must respond within strict time limits and often have little spare memory, so a security tool that suits a laptop can disrupt them.
• People. Control networks are usually run by control engineers, not by the IT department.

What is the Purdue model?

The Purdue model is a way of drawing an industrial network as stacked levels, from the machines at the bottom to the business systems at the top, so that traffic between levels can be controlled. It comes from the Purdue Enterprise Reference Architecture, from which the ISA-95 standard for connecting control systems to business systems grew. In the version NIST shows in Figure 16 of SP 800-82 Rev. 3, the levels are:

• Level 0: field devices, the sensors and actuators on the machines.
• Level 1: the controller network, where PLCs and similar controllers sit.
• Level 2: area control, with the HMI screens.
• Level 3: operations and control for the whole site.
• Level 4: business planning and logistics.
• Level 5: the enterprise network.

A demilitarized zone (DMZ), a buffer network with its own firewalls, separates the plant levels from the business levels. NIST recommends firewall rules that let only adjacent levels talk to each other, so that an office computer at Level 4 cannot reach a controller at Level 1 directly (Section 5.2.3.1). Real plants rarely match the diagram exactly, but it remains the usual starting point for network segmentation in OT.

What is OT security and which standards apply?

OT security is the protection of control systems against attacks and failures without getting in the way of safe operation; NIST states that any security measure that impairs safety is unacceptable. Two references dominate:

• ISA/IEC 62443 is a series of standards developed by the ISA99 committee together with a working group of the IEC’s Technical Committee 65. It sets requirements for securing industrial automation and control systems at every stage of their lifecycle and shares the responsibility among asset owners, integrators, product suppliers and service suppliers. The IEC 62443 entry explains how it divides a plant into zones and conduits.
• NIST SP 800-82 is free guidance on OT architectures, threats and countermeasures. Revision 3 dates from September 2023. NIST published a draft of Revision 4 on 21 September 2026, open for public comments until 30 November 2026.

In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) calls industrial control systems and OT the foundation of U.S. critical infrastructure and publishes guidance for their owners and suppliers. In the European Union, many operators of energy, water, transport and manufacturing plants fall under the NIS2 Directive, which requires them to manage cybersecurity risks.

What is IT/OT convergence and how does the industrial IoT fit in?

IT/OT convergence is the joining of control networks with office networks and the cloud, so that production data can feed business systems. NIST explains that OT used to be isolated and ran proprietary protocols, and that standard Ethernet, internet protocols and wireless devices are replacing them, which brings new capabilities but much less isolation from the outside world.

The industrial IoT is a large part of that change: sensors and gateways that send machine data to software for analysis, for example for predictive maintenance. NIST describes a three-tier architecture for industrial IoT, made of an edge tier, a platform tier and an enterprise tier (Section 2.3.8). Every connection that carries data out of the plant could also carry an attack in, so well-designed projects send data through a gateway or a DMZ instead of exposing controllers to the internet. Industrial IoT: a practical guide shows how such projects are put together.

Part of the IoT Glossary. Spotted an error or a missing term? Tell us.