Scope and boundaries
IT vs OT
Information Technology and Operational Technology solve different problems under different constraints. Treating them as one discipline produces controls that are ineffective in IT and unsafe in OT. This page states the distinction IT Atlas maintains throughout.
The short version
Information Technology
IT manages information and the systems that store, move and process it: servers, networks, cloud platforms, directories, endpoints, applications and data. Its priority order is confidentiality, integrity, then availability. Systems are replaced often, patched frequently, and monitored with agents and authenticated scanning. Identity is the primary control plane.
Operational Technology
OT monitors and controls physical processes: PLCs, DCS, SCADA, safety instrumented systems, sensors and actuators in plants, utilities, transport and buildings. Its priority order is safety and availability, then integrity, with confidentiality last. Equipment stays in service for decades, and a control action has physical consequences.
Side by side
| Dimension | Information Technology | Operational Technology |
|---|---|---|
| Primary objective | Protect and process information, confidentiality, then integrity, then availability | Keep a physical process running safely, safety and availability first, confidentiality last |
| Consequence of failure | Data loss, disclosure, financial and reputational harm, service outage | Physical harm, environmental release, equipment damage, production loss |
| Typical asset life | 3, 7 years for endpoints and servers; SaaS changes continuously | 10, 30 years; controllers still in service long after vendor support ends |
| Patching | Routine and frequent; monthly cycles with automated deployment are normal | Rare and scheduled around plant outages; vendor validation often required first |
| Change management | Change is expected; CI/CD and infrastructure as code are common | Change is exceptional; management of change processes involve engineering and safety review |
| Protocols | TCP/IP, HTTPS, DNS, Kerberos, SAML, OIDC, SMB, LDAP | Modbus, DNP3, PROFINET, EtherCAT, OPC UA, IEC 61850, CIP |
| Authentication | Per user identity with MFA, conditional access and token based SSO | Often shared or device level credentials; historically no authentication in the protocol at all |
| Availability tolerance | Planned maintenance windows and brief outages are usually acceptable | Unplanned stops are costly or hazardous; some processes cannot be stopped safely at all |
| Scanning and testing | Authenticated vulnerability scanning and penetration testing are standard | Active scanning can crash controllers; passive monitoring is the default |
| Encryption | Expected in transit and at rest | Often impossible on legacy protocols; determinism and latency budgets take precedence |
| Dominant frameworks | NIST CSF, CIS Controls, ISO 27001, ITIL, COBIT, MITRE ATT&CK Enterprise | IEC 62443, NIST SP 800-82, MITRE ATT&CK for ICS, Purdue reference model |
| Who owns it | IT and security functions, reporting to a CIO or CISO | Engineering, operations or plant management, sometimes with no IT involvement |
Where the two domains meet
Most real incidents at the boundary come from convenience shortcuts, not exotic attacks.
- The industrial DMZ: a segmented zone where OT data is published to IT systems, so no IT system ever initiates a session into the control network. Data historians, jump hosts and update repositories live here.
- Shared identity: OT engineers often need enterprise accounts, and IT identity compromise can therefore become an OT access path. Privileged access for OT should be brokered, time bound and separate from everyday IT admin accounts.
- Remote vendor access: equipment vendors frequently require remote support. Direct inbound tunnels into control networks are the single most common serious weakness; brokered, supervised, session recorded access is the correct pattern.
- Manufacturing and building systems on the corporate network: printers, HVAC, cameras, access control and lab equipment are often neither fully IT managed nor fully OT managed, and end up unpatched on flat networks.
- Backups and recovery: OT recovery depends on controller configuration, project files and firmware images, not just server backups, and those are frequently unprotected.
Practices that transfer, and practices that do not
Transfers well
- Asset inventory, because you cannot protect what you have not enumerated.
- Network segmentation and explicit, documented traffic flows.
- Least privilege, brokered privileged access and removal of shared credentials where the equipment supports it.
- Monitoring, logging and a tested incident response plan with clear authority.
- Backup and recovery discipline, with restores actually tested.
Does not transfer
- Automatic patching. In OT, updates need vendor validation and an outage window; forced reboots are unacceptable.
- Active vulnerability scanning. Legacy controllers can fault or stop under scan traffic; use passive discovery.
- Standard endpoint agents. Many control workstations cannot run them, and vendor support agreements may forbid them.
- Aggressive automated containment. Isolating a host in IT is routine; isolating a control system component can stop a process unsafely.
- Cloud first architecture. Latency, determinism and safety requirements keep control loops local.
Two separate atlases, on purpose
IT Atlas covers Information Technology only. Every article here assumes IT priorities, IT lifecycles and IT protocols. Where a topic has an OT counterpart, the difference is called out explicitly rather than blurred.
Operational Technology has its own reference platform: OT Atlas at otatlas.ai. The two sites are deliberately separate so that neither audience has to filter out guidance that does not apply to their environment.