What it covers. NIST guidance on securing operational technology such as industrial control systems, SCADA, building management and other systems that interact with the physical world. It explains typical OT architectures and threats, and shows how to apply a tailored security baseline while respecting safety, availability and performance needs.
In practice. Good practice starts with an OT asset inventory and network architecture that separates OT from enterprise IT, with controlled conduits and monitored remote access. Changes and patches are tested with operations and safety staff before deployment, and incident response plans cover physical processes and manual operation. Evidence includes zone diagrams, access logs for vendor connections and records of risk assessments that consider safety impact.
Common gaps. Common shortfalls are flat networks between IT and OT, unmanaged vendor remote access, unknown legacy devices and incident plans written only for IT systems.