Home / Cybersecurity / Operational technology
Operational Technology: Risks, Security & Compliance
Protect the technology that keeps your operation moving. Understand the risks to connected machinery, legacy controllers and building systems—and take practical steps that respect safety, uptime and your commercial obligations.
Beyond the office network
What is operational technology?
Operational technology (OT) monitors or controls the physical world. It includes programmable logic controllers (PLCs), industrial robots, manufacturing equipment, refrigeration controllers, conveyors, and the systems that supervise them. CCTV, physical access systems and building controls can also sit within this wider connected estate.
You do not need to operate a power station to have OT risk. A warehouse, food producer, cold store or commercial building may depend on equipment whose loss would stop production, spoil stock or make a site unsafe.
Start with the business consequence
Which process must keep running? What happens if its controls become unavailable, inaccurate or unsafe? Who owns the equipment, and who can connect to it?
These questions help operations, engineering and IT agree what needs protection first. NIST’s guide explains OT and its safety and reliability requirements.
Different priorities, shared responsibility
Why OT cannot simply be managed like IT
Safety and availability shape every change
An unplanned reboot can interrupt a production line or temperature-controlled process. Patches, endpoint tools and configuration changes need engineering review, vendor compatibility checks, a maintenance window and a recovery plan.
Legacy equipment has real constraints
Some devices cannot support modern authentication, encryption or security software. Others have limited password controls or unsupported operating systems. Check each device’s capabilities: these limitations do not apply to every OT product.
Where a controller cannot support multi-factor authentication (MFA), protect the route to it: named accounts, an MFA-protected access gateway, restricted permissions and monitored sessions. A device limitation calls for compensating controls, not unrestricted access. NCSC guidance: harden the OT boundary.
The paths into your operation
Internet exposure, remote access and ransomware
Directly exposed control interfaces, forgotten vendor connections and weak or shared credentials can create avoidable entry points. Connections between business IT and OT also matter: ransomware affecting identity, scheduling or other supporting systems can disrupt operations even without changing a PLC.
Removing unnecessary internet exposure is a valuable first step. It is not a complete security strategy: authorised remote access, laptops, removable media, internal connections and recovery arrangements also need attention.
- 01 · Control entryNamed users · MFA at the gateway · approved, time-limited remote sessions
- 02 · Enforce boundariesSeparate IT and OT · permit only required traffic · log and review access
- 03 · Protect the processControllers and machines · engineering change control · tested recovery
Documented incidents
What disruption looks like in practice
JLR: production and supply-chain disruption
On 16 September 2025, JLR confirmed an extension of its production pause while investigating a cyber incident. A government-industry statement on 19 September described significant effects on the wider automotive supply chain.
This illustrates operational dependence on digital systems. These statements do not establish that attackers compromised factory controllers or identify the initial entry route.
Remote manipulation of control interfaces
A joint advisory published by CISA on 1 May 2024 reported unauthorised remote changes to human-machine interfaces (HMIs) at US water and wastewater sites. Some incidents caused minor tank overflows; operators generally restored operations quickly using manual controls.
The advisory highlights exposed remote access and weak authentication. Its reported effects should not be inflated into claims of widespread catastrophic damage.
Compliance and commercial confidence
Separate legal duties from customer requirements
NIS2 is EU legislation
NIS2 is an EU directive implemented through Member States’ national laws. It does not automatically apply to every UK business. EU operations, the services provided, jurisdiction and national scope rules can matter; some non-EU service providers can be caught. Confirm your position rather than relying on a generic checklist.
Its supply-chain security provisions can also influence what regulated customers ask of suppliers. A contractual assurance request is different from being directly regulated. Read NIS2, including Articles 21 and 26.
Check the actual UK position
The UK’s NIS Regulations 2018 impose security and incident-reporting duties on in-scope operators of essential services and relevant digital service providers. Owning connected machinery does not by itself put every manufacturer in scope. Sector-specific duties and data-protection obligations may also be relevant.
As reviewed on 11 November 2026, the government’s Cyber Security and Resilience Bill materials describe proposed changes to the UK regime. Proposals must be distinguished from duties already in force and applicable commencement dates.
Your customer may need evidence even when legislation does not apply directly
Procurement questionnaires, supplier contracts and continuity requirements may ask how you protect production and maintain supply. Establish exactly what is required, who accepts the evidence and when it is due. A documented improvement plan is more useful than an unsupported declaration that everything is compliant.
This page provides general information, not a legal opinion or certification. Confirm legal scope with your adviser or competent regulator.Proportionate improvements
Reduce risk without replacing everything
Know your assets
Record devices, owners, critical processes, firmware, support status and connections. Begin with documentation and safe discovery methods agreed with engineering.
Segment the network
Separate business IT, OT and vendor access. Enforce necessary flows at security boundaries; consider finer segmentation where the process and equipment support it.
Control remote access
Remove unnecessary public exposure. Use approved gateways, named users, least privilege, MFA where supported and time-limited vendor access.
Manage change safely
Assess patches and hardening with the equipment supplier. Where change must wait, document the risk, additional controls, owner and review date.
Prepare for recovery
Protect controller configurations, engineering files and backups. Agree safe isolation, manual-operation limits and restoration procedures with operations.
Maintain the evidence
Review access and logs, rehearse incident responsibilities and keep an improvement register. Reassess when suppliers, connectivity or production processes change.
NCSC: understand and document OT connectivity. Priorities and technical designs must be validated for your site; avoid unapproved scanning or disruptive testing on live control systems.
Start with a conversation about your operation
Concerned about legacy equipment, supplier assurance or remote access? SIGAM can discuss the requirement, identify the specialist skills needed and agree a practical scope.
Related: Cybersecurity & ESET · Managed IT & Infrastructure