OT security, and the contractors who can reach the plant.

Operational technology is hardware and software that monitors or controls physical equipment and processes. Where IT moves information, OT moves actuators, valves, breakers and motors. The consequences of failure are therefore physical: a stopped line, a spill, an outage, or an injury.

The terms overlap and are used loosely, so it is worth separating them:

• OT — the umbrella term for all technology that interacts with the physical process.
• ICS (industrial control systems) — the control layer within OT: PLCs, DCS, and the engineering workstations that program them.
• SCADA — supervisory control and data acquisition: the layer that gathers telemetry from geographically distributed sites and presents it to operators. Common in utilities, pipelines and rail, where the estate is spread across many locations.
• IIoT — newer connected sensors and gateways, frequently added to existing plant without passing through the controls that govern the rest of it.

The organising model most practitioners still reference is the Purdue model, which layers the environment from the physical process at Level 0 up through control and supervisory layers to enterprise IT at Levels 4 and 5. It is an idealisation rather than a description of any real site, but it remains useful because it makes the important question explicit: what is allowed to talk to what, and through which boundary?

Industrial plant is not maintained solely by its owner. Turbine manufacturers, control-system integrators, drive suppliers and specialist maintenance firms all need access to diagnose faults and apply updates, often urgently and often out of hours. That access is frequently:

• Standing rather than time-bound — provisioned once during commissioning and never reviewed.
• Broad rather than scoped — reaching a whole cell or site because scoping it precisely was harder at the time.
• Outside the corporate identity system — a vendor-supplied appliance or a modem installed by the integrator, which the IT organisation does not manage and may not know exists.
• Shared — one account used by whichever engineer is on shift at the supplier.

Assessed as a supplier relationship, this is the highest-consequence third-party access most organisations have. Assessed as an OT problem, it usually is not assessed at all, because the questionnaire went to the IT-facing SaaS vendors and the maintenance contract sat with engineering.

The practical implications for a supplier assurance programme are specific. Vendors with OT access belong in the highest tier regardless of contract value. Their own security posture — not just their contractual promises — is worth observing continuously, because a compromise at the integrator becomes access to your plant. And the contract needs incident notification fast enough to be useful when the consequence is physical.

The business case is real — production data in enterprise systems, remote diagnostics, predictive maintenance — and the connectivity to deliver it is typically added incrementally, by different teams, over years. The result is an environment where the boundary exists on the network diagram and not on the network.

Three things make convergence programmes work:

• Single accountability. Where IT owns the network and engineering owns the process, the boundary between them is owned by nobody. Someone has to be accountable for the whole path.
• Engineering-led change control. Security changes that risk process availability must go through the same rigour as any other plant change. A control imposed by IT that trips a line will not survive, and should not.
• One risk register. OT risk expressed only in engineering terms does not reach the board, and cyber risk expressed only in IT terms misses the safety consequence entirely.