Security for OT and industrial control systems

In traditional IT, the confidentiality of data comes first; in OT, the availability of the process, the integrity of the control system and the impact on functional safety dominate. Add to that fundamentally different life cycles: control systems often remain in service for more than 20 years – IEC 62443-2-1 therefore explicitly addresses the handling of legacy systems for which patches or modern protection mechanisms are not available and compensating measures must take effect. Updates can often only be installed during planned maintenance windows, and virus scanners or active scans can disrupt real-time processes. IT security concepts therefore cannot be transferred unchanged to production environments; NIST SP 800-82 Rev. 3 (2023) systematically describes the necessary adaptations.

The ISA/IEC 62443 series of standards is the international reference framework for the security of industrial automation and control systems (IACS) and distributes responsibility across three roles: asset owners (IEC 62443-2-1:2024 with the requirements for the security program, expanded in its second edition by a maturity model), service providers and integrators (IEC 62443-2-4:2023), and product suppliers (parts 4-1 and 4-2 on secure product development and component requirements). The core methodology is the decomposition of the plant into zones – groups of assets with comparable protection needs – and conduits as controlled communication paths between them (IEC 62443-3-2). For each zone, a target security level (SL-T) is defined on the basis of a risk assessment: the four levels SL 1 to SL 4 range from protection against casual violations to protection against attackers with extensive resources, IACS knowledge and high motivation. IEC 62443-3-3 provides the corresponding technical system requirements along seven foundational requirements; the technically achievable (SL-C) and actually achieved levels (SL-A) make the state of implementation measurable.

The Purdue model – originating from the Purdue Enterprise Reference Architecture (PERA) of the 1990s and adopted in ISA-95 – structures production environments into hierarchical levels: from the physical process with sensors and actuators (Level 0) through basic control such as PLCs and DCS (Level 1), supervisory control with HMI/SCADA (Level 2) and the site operations level with MES (Level 3) up to enterprise IT with ERP (Level 4/5). Between the production and enterprise networks, an industrial DMZ has become established, commonly referred to as "Level 3.5". NIST SP 800-82 uses the model as a reference for network segmentation and defense in depth. Cloud connectivity and Industrial IoT are increasingly breaking up the strict hierarchy; as a logical grid for segmentation and the analysis of data flows, however, the model remains the established starting point.

In "Industrial Control System Security: Top 10 Bedrohungen und Gegenmaßnahmen" (version 1.5, 2022), the German Federal Office for Information Security (BSI) counts intrusion via remote maintenance access among the most significant threats, along with control components connected to the internet. In practice, permanently active vendor and service provider access without multi-factor authentication, shared accounts and a lack of logging of remote maintenance sessions are common findings. The second core problem is flat, unsegmented networks: historically grown direct connections between office IT and production allow malware – such as ransomware – to spread unhindered all the way down to the control level. Effective countermeasures start at the conduits: dedicated remote maintenance gateways with per-session activation, jump servers in the industrial DMZ and consistent segmentation according to the zone model.

Without a complete asset inventory, zones cannot be meaningfully defined and risks cannot be assessed – it is the foundation of every OT security program. Traditional active network scans, however, are risky in OT: older controllers and field devices sometimes react to unexpected packets with malfunctions up to and including a complete standstill. Passive asset discovery instead analyzes mirrored network traffic (SPAN/mirror ports or network TAPs) and identifies devices, firmware versions, protocols and communication relationships without sending any packets into the production network itself. As a complement, targeted, protocol-compliant active queries of individual devices have become established practice – coordinated with the operations team and preferably during maintenance windows.

With the NIS 2 Directive (EU) 2022/2555, the manufacturing sector falls broadly under European cybersecurity law for the first time: Annex II covers, among others, the manufacture of medical devices, data processing equipment, electronic and optical products, electrical equipment, machinery as well as motor vehicles and other transport equipment – generally from 50 employees or more than 10 million euros in annual turnover and annual balance sheet total, mostly as "important entities". The risk management measures under Art. 21 (including risk analysis, incident handling, supply chain security) apply to all network and information systems used to provide the services – and thus also to OT and control systems in production. In Germany, the NIS 2 implementation act has been in force since December 2025; affected companies must register with the BSI under § 33 BSIG, and the statutory registration deadline has already expired. IEC 62443 offers a recognized framework for operationalizing the required measures in the OT environment.