IT and OT — Similar Technology, Different Consequences

IT and OT often share computers, networks, and people. What changes is the relationship to the physical process, the consequences of failure, and how a change is validated.

An office workstation and an operator workstation might run the same operating system. Both need identity, backups, patching, and monitoring. That does not mean the same maintenance decision has the same consequences on each.

The most useful distinction is the job the system performs and what happens when it behaves incorrectly. Information technology (IT) commonly supports information processing and business services. Operational technology (OT) monitors or controls physical devices, processes, and events, including systems that manage those devices.

OT is broader than factory automation. Building controls, transportation, physical access, and environmental measurement can all be part of the picture. NIST's Guide to OT Security is a useful grounding for that broader definition. For industry examples, see the separate map of OT verticals.

Think in consequences, not stereotypes

Consider an update that requires a reboot. On a business application, the team might schedule a maintenance window, fail over, and verify transactions. On an operator workstation, the controller may continue running during the reboot—but the operator might lose visibility, alarms, or a way to make an authorized intervention.

That outcome depends on the design. Some systems have independent local controls, redundant stations, and tested failover. Others do not. “It is OT” is the start of the investigation, not a complete answer.

Question	Common IT context	OT context to investigate
What is the service?	Information, transactions, communication, business applications	A physical process or facility function, plus its control and visibility
What does failure affect?	Data, access, revenue, business continuity	Those same concerns, plus equipment, product quality, environment, physical services, and potentially people
What timing matters?	Application latency and business service commitments	Control timing, communication loss behavior, alarm delivery, process dynamics, and service commitments
What proves recovery?	Successful transactions and restored information services	Correct process behavior, trustworthy measurements, authorized control, and operational acceptance as well as restored applications
What complicates a change?	Dependencies, compatibility, rollback, staffing	All of those, plus vendor qualification, plant state, physical access, engineering tools, and appropriate opportunities to interrupt a process
What is backed up?	Data, applications, infrastructure configuration	Those items plus controller programs, HMI projects, device configurations, calibration context, engineering files, licenses, and recovery dependencies where applicable

These are prompts, not fixed properties of every installation. A hospital scheduling system can be business IT with serious safety dependencies. A modern industrial analytics service may run in the cloud. Criticality is not determined by the label or whether something uses Ethernet.

Security priorities are contextual

You may encounter the shorthand “IT is confidentiality first; OT is availability first.” It is memorable, but it is too blunt to be a policy.

Confidentiality still matters in OT: credentials, proprietary recipes, infrastructure details, and personal information can be sensitive. Integrity is essential when a measurement, setpoint, or logic change influences a physical outcome. Availability matters, but continuing to operate with untrustworthy information may be worse than a planned interruption.

Safety is an engineering objective and a consequence to consider, not a fourth letter that automatically solves tradeoffs. The appropriate response depends on hazards, equipment, process conditions, independent protections, and the people authorized to make decisions.

Patching is a change-management problem

“Never patch OT” leaves vulnerabilities in place. “Patch everything immediately” can ignore compatibility and operating conditions. A defensible approach asks:

Is the vulnerability relevant to the actual product, exposure, and use?
What is the risk of delaying versus changing now?
What testing and vendor guidance apply?
Can monitoring, restricted access, or another compensating measure reduce risk while preparing the change?
Is there an appropriate operating window and a tested way back?
How will the team verify communications, alarms, values, roles, and process behavior afterward?

A successful installer message answers only one of those questions. A rollback image may also omit a controller program, a changed instrument mapping, or a license needed to restart a service.

IT and OT have shared dependencies

Identity, time services, name resolution, virtualization, storage, networking, and remote access can support an OT environment. A controller might continue local operation while a shared identity outage prevents a user from signing in to an HMI. An HMI can be reachable while its process values are stale.

Map these relationships explicitly. Do not assume every controller depends on a domain controller or that every facility follows one reference architecture. The question is which dependencies this function actually needs, including dependencies that appear only during startup or recovery.

This is also why recovery involves more than bringing servers online. Incident response establishes what happened, what remains trustworthy, and how to contain a cyber event. Disaster recovery restores capabilities. Business continuity considers how the organization sustains essential functions while those efforts proceed. In OT, those activities must connect to process and facility decisions.

Try the distinction yourself

In the recovery decision explorer, a fictional pumping service experiences a failed update, power outage, or cyber incident. Choose recovery artifacts, restore dependencies, and compare “components are online” with “the service has been validated and released.” The times and outcomes are deliberately fictional.

Then use the observation worksheet to answer four questions: