Who Owns OT Security in Your Company?
Ask three leaders who owns operational technology (OT) security and you may get three different answers. IT says it belongs to engineering. Engineering says it belongs to IT. Operations assumes somebody's handling it.
If the answer takes more than ten seconds, that's the risk.
Why OT falls between the chairs
OT runs manufacturing lines, energy systems, water, transportation, and other essential services. It isn't office IT. It often runs legacy equipment that was never designed for today's threats; patching is limited, and sometimes not possible without stopping production. Availability and safety come first, and confidentiality comes a distant third.
IT teams know security but may not know the plant floor. Engineering teams know the process but usually don't own security tools or policy. The gap between them is exactly where nobody is accountable (and where attackers like to sit).
What an owner actually does
Giving OT security an owner isn't about a new title. It's about five jobs getting done:
Knows what's connected. You can't protect what you can't see. An accurate asset inventory comes first, followed by segmenting OT from IT to limit the attack surface.
Ranks risk by operational impact. Not every vulnerability matters equally. A weakness that could stop a production line outranks one that couldn't. Prioritize on likelihood and severity, not on CVE count.
Brings IT, engineering, and compliance to one table. Cross-functional teams are the only way OT security works. The owner makes that group real, with a standing meeting and decisions that stick.
Writes down the rules. Governance means policies, roles, and accountability people can actually find and follow. Frameworks like NIST and ISA/IEC 62443 are solid guides; you don't need to adopt every control on day one.
Plans for the bad day. An OT incident response plan has to include the people who run operations, not only the security team. Test it before you need it; a tabletop exercise is a cheap way to find out who calls whom.
Culture is part of the job
The owner also sets the tone. Operators need to feel comfortable reporting something odd on the plant floor without it turning into blame. From what I've seen, the best early warnings come from the people who know what "normal" sounds like on the line.
Where to start
If you can't name the owner today, start there. It can be an internal leader with the right support, or a fractional CISO who bridges IT and engineering until you're ready to hire. Either way, give the role a name, a mandate, and a seat with leadership.
If you'd like to talk through what ownership could look like in your environment, I offer a complimentary 30-minute discovery call for qualified organizations. Book a time here.
Dan Sorensen is a cybersecurity leader, Forbes Technology Council contributor, OWASP AI Exchange core team member, and fractional CISO.
Comments