OT Cybersecurity in 2026: 6 Practical Steps to Protect Industrial Systems
- hailey yap
- 6 days ago
- 6 min read
The short answer:Â OT cybersecurity protects the systems that monitor or control physical processes. Engineers can reduce risk by knowing every connected asset, removing unnecessary internet exposure, separating IT and OT networks, controlling remote access, testing backups and working closely with cybersecurity teams.
Factories, power systems, buildings, utilities and transport operations increasingly depend on connected sensors, programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, engineering workstations and remote support tools. This connectivity can improve visibility and productivity, but it also creates new paths into systems where availability and safety are critical.
The topic is especially timely. In June 2026, the US National Institute of Standards and Technology (NIST) released new guidance on operational technology backups and secure remote access to OT. In Malaysia, the Cyber Security Act 2024 (Act 854) has been in force since 26 August 2024 and establishes responsibilities relating to designated National Critical Information Infrastructure (NCII) sector leads and entities.
OT cybersecurity is therefore not only an IT concern. It is an engineering, reliability, safety and business-continuity concern.
What is OT cybersecurity?
Operational technology, or OT, includes programmable systems and devices that interact with the physical environment. Examples include PLCs, distributed control systems, SCADA platforms, building automation, process instrumentation and industrial safety systems.
IT cybersecurity usually prioritises the confidentiality, integrity and availability of information. OT cybersecurity must also account for physical consequences, process stability, equipment limitations, worker safety and the need to keep essential operations running. A control that is routine in an office network may require additional engineering review before it is introduced into a live plant.
This is why OT security decisions should involve the people who understand the process, not only the people who manage the network.
1. Build an accurate OT asset inventory
You cannot protect equipment you do not know is connected.
Start by identifying PLCs, human-machine interfaces, SCADA servers, engineering workstations, historians, network switches, wireless devices, remote-access gateways and vendor-maintained systems. Record the owner, location, software or firmware version, communication path, business function and operational criticality of each asset.
Do not stop at a list of devices. Map important dependencies: which workstation can change a controller, which server stores process history, which vendor can connect remotely and which operations would be affected if a component became unavailable.
The goal is a living engineering record that is updated whenever the system changes.
2. Remove unnecessary internet exposure and default credentials
In 2025, CISA and partner agencies urged critical-infrastructure operators to remove OT connections from the public internet and immediately replace default or easily guessed passwords. These are basic actions, but they close two of the simplest routes into industrial systems.
Ask three questions for every internet-facing OT component:
Does this asset genuinely need to be reachable from the public internet?
If remote connectivity is required, can it be placed behind a controlled access service rather than exposed directly?
Are all default accounts, passwords and unused services removed or disabled?
Any change to a production system should follow the organisation's safety, testing and change-management procedures. Reducing exposure must not create an unplanned operational interruption.
3. Separate IT and OT networks
A flat network allows a problem in one area to travel too easily into another. Segmenting business IT from industrial OT creates boundaries that can slow or contain an incident.
Use clearly defined network zones and permit only the communication that each process requires. Connections between zones should be controlled, documented and monitored. Highly critical systems may need additional separation from ordinary workstations, guest devices and general internet traffic.
The ISA/IEC 62443 series provides a useful lifecycle approach for industrial automation and control-system security. It also emphasises shared responsibility among asset owners, product suppliers, integrators and service providers.
Segmentation is not a one-time firewall project. Engineers and IT teams should review it whenever a new machine, sensor, cloud connection or vendor service is introduced.
4. Treat remote access as a controlled engineering activity
Remote access can shorten troubleshooting time, particularly when specialist support is not available on site. It can also become a high-impact entry point if accounts are shared, access remains permanently enabled or activity is not recorded.
A stronger remote-access process should include:
named accounts instead of shared credentials;
multi-factor authentication where the system architecture supports it;
access through a managed gateway or jump host;
approval and time limits for vendor sessions;
access limited to the specific systems required; and
logging and review of remote activity.
NIST's 2026 practice guide on OT remote access demonstrates that secure designs can be adapted to organisations with different operational needs and resource levels. The important principle is that convenience should not bypass visibility, authorisation or accountability.
5. Back up OT systems - and prove that recovery works
An OT backup plan should cover more than office files. Depending on the system, recovery may require controller logic, HMI projects, SCADA configurations, historian data, engineering files, network-device configurations, recipes, licences and vendor-specific installation media.
NIST's 2026 OT Backup Quick Start Guide recommends integrating backups into change management, creating them regularly, testing them and reviewing them during recovery exercises.
For engineers, the practical test is simple: if this controller, workstation or server failed today, do we have the correct files, tools, instructions and authorised people to restore it safely?
A backup that has never been tested is an assumption, not a recovery capability.
6. Build a joint engineering and cybersecurity culture
Engineers understand process behaviour, failure modes, maintenance windows and safety constraints. Cybersecurity professionals understand identity, networks, monitoring and digital incident response. OT resilience depends on both perspectives.
Create a shared response plan that answers practical questions:
Who can isolate an affected system?
Who has authority to stop or restart a process?
How will the team communicate if normal systems are unavailable?
Which vendor contacts and clean recovery files are required?
What evidence must be preserved after an incident?
Run short tabletop exercises using realistic scenarios, such as a compromised engineering workstation, an unexpected controller change or unavailable remote support. The objective is not to blame a team. It is to uncover unclear roles and unsafe assumptions before a real incident does.
What should engineers do first?
Begin with one critical process, not the entire organisation. Map its assets and connections, check for direct internet exposure, verify how vendors enter the environment and test whether its configuration can be restored. This small, evidence-based review will usually reveal the next priorities.
Engineers do not need to become penetration testers. They do need enough OT and cybersecurity knowledge to recognise risky design choices, ask better questions and coordinate changes safely.
At IK Academy, our goal is to build and inspire greater engineers through practical technical knowledge. Explore our IT and Manufacturing & Automation courses, view the latest training schedule, or talk to IK Academy about a programme for your technical team.
Frequently asked questions
What is the difference between OT security and IT security?
IT security protects information systems and data. OT security protects systems that monitor or control physical equipment and processes. OT decisions must give special attention to availability, safety, reliability and physical consequences.
What are examples of OT systems?
Common examples include PLCs, SCADA systems, distributed control systems, building automation, process instrumentation, industrial robots, engineering workstations and safety-related control systems.
Is IEC 62443 relevant only to oil and gas?
No. The ISA/IEC 62443 series applies across sectors that use industrial automation and control systems, including manufacturing, energy, building automation, transport, healthcare technology, chemicals and oil and gas.
What is the fastest way to reduce OT cyber risk?
Start by finding internet-exposed OT assets, removing unnecessary exposure, changing default credentials and tightly controlling remote access. These steps should be performed through approved engineering and change-management procedures.
How often should OT backups be tested?
Use a risk-based schedule and test again after significant system changes. NIST recommends regular backup creation and testing, integration with change management and review during recovery exercises.
Comments