Implement and Maintain Security Controls for Operational Technology (OT) Systems
Overview
This standard defines the competencies required to implement and maintain security controls across Operational Technology (OT) systems. It includes applying hardening measures, configuring network segmentation, managing access controls, implementing secure remote access, and maintaining system integrity in safety-critical environments. It also incorporates least-privilege principles, zero-trust segmentation, configuration baselining, and continuous monitoring to support secure and resilient industrial operations.
This standard is intended for OT security practitioners responsible for implementing, maintaining, and improving security controls in industrial and critical-infrastructure environments.
Performance criteria
You must be able to:
- Implement OT security controls to meet operational, safety, and compliance requirements.
- Apply hardening measures to OT devices, applications, and systems including enforcing least-privilege access.
- Configure OT network segmentation to limit unauthorised movement and reduce security risk.
- Manage OT access controls using appropriate authentication, authorisation, and vendor-access practices.
- Implement secure remote-access methods that align with operational constraints and safety requirements.
- Monitor OT systems to verify that security controls remain effective.
- Apply configuration- and change-control processes to maintain OT system integrity.
- Coordinate with engineering, safety, and operations teams to implement security improvements.
- Document OT security configurations and updates in line with organisational requirements.
- Review OT security controls to identify opportunities for improvement.
Knowledge and Understanding
You need to know and understand:
- Security controls used in OT environments including hardening, segmentation, access control, and monitoring.
- Zero-trust and least-privilege principles in OT and safety-critical systems.
- OT network architectures and segmentation patterns including DMZs, conduits, and firewalls.
- Methods for implementing and managing OT access controls.
- Secure remote-access methods appropriate for OT environments.
- Monitoring techniques including log analysis and anomaly detection.
- Configuration- and change-management requirements for OT systems.
- Collaboration practices when working with operations, engineering, and safety teams.
- Constraints associated with OT systems including legacy assets and limited patching opportunities.
- Indicators of control failure and operational impacts of misconfiguration.
- Regulatory and organisational requirements relevant to OT security controls including applicable standards.
Scope/range
Scope Performance
Scope Knowledge
Values
Behaviours
Skills
Glossary
Hardening
Reducing security risk by restricting services, ports, configurations, and permissions.
Segmentation
Separating networks or systems into zones to restrict access and reduce the impact of compromise.
DMZ (Demilitarised Zone)
A network area used to separate OT systems from IT networks and external access.
Conduit
A controlled communication path between network zones in OT architectures.
Least Privilege
Providing users or systems only the minimum level of access required to perform their function.
Zero Trust
A security model that assumes no implicit trust and continuously verifies users and devices.
MFA (Multi-Factor Authentication)
A login process requiring multiple authentication factors, such as a password and a token.
Jump Host / Jump Server
A secure intermediary used to control and monitor remote access to OT systems.
Vendor Remote Access
Controlled access provided to vendors for support, maintenance, or diagnostics.
Configuration Baseline
A defined and approved configuration state used as a reference for detecting unauthorised changes.
Change Control
A process for evaluating, authorising, and documenting modifications to systems or configurations.
Audit Trail
A chronological record of events, access, and changes that supports investigation and compliance.
Anomaly Monitoring
Detecting unexpected behaviours or deviations from normal OT operations.