What is OT security?
OT security is the information security of the systems that measure, control and regulate in a factory, a substation or a waterworks. They include programmable logic controllers (PLCs), supervisory systems such as SCADA, operator stations (HMIs), sensors and actuators, engineering workstations and suppliers' remote maintenance access. The German Federal Office for Information Security (BSI) covers process control and automation technology in IT-Grundschutz module IND.1 (Edition 2023); industrial security and OT security are largely used as synonyms.
Production networks are connected to ERP systems, cloud services and remote maintenance. According to BSI-CS 005, industrial control systems face the same attacks as office IT, even when they are only indirectly connected to the internet. The ten threats the BSI lists there, in no ranked order, include malware introduced via removable media, intrusion via remote maintenance access and internet-connected control components.
How does OT security differ from IT security?
In production, availability, process integrity and human safety come before the confidentiality of data. That leads to different rules for updates, anti-malware and monitoring.
| Criterion | IT (office and business IT) | OT (operational technology) |
|---|---|---|
| Primary protection goal | confidentiality and integrity of data | availability and integrity of the process, plus functional safety |
| Consequence of an incident | data leak, business interruption | additionally, danger to people, plant and environment |
| Updates | regular, including automatic | in maintenance windows and after vendor approval |
| Endpoint protection | anti-malware and EDR | limited, to the extent vendors approve it |
| Reference standards | ISO/IEC 27001 and 27002 | IEC 62443, complemented by ISO/IEC 27001 for the organization |
The Cyber Resilience Act recognizes the difference. Under recital 56, its requirements for automatic security updates do not apply to products for critical and industrial environments where an automatic update could disrupt operations. How functional safety and cybersecurity relate is covered in the comparison safety vs security. The organizational framework for both is an ISMS; how to set one up is described in the guide ISMS implementation.
IEC 62443: parts, zones and security levels
IEC 62443 is the international series of standards for the security of industrial automation and control systems (IACS).
| Part | Content | Aimed at |
|---|---|---|
| 2-1 | the asset owner's security program | asset owners |
| 3-2 | security risk assessment for system design, with zones and conduits | asset owners, integrators |
| 3-3 | system security requirements and security levels | integrators, system vendors |
| 4-1 | secure development lifecycle | component vendors |
| 4-2 | technical requirements for components | component vendors |
A zone groups assets with comparable security requirements, such as all controllers on one line. A conduit is the communication link between zones, with requirements of its own.
A security level describes the attacker a zone or conduit is protected against:
- SL 1: casual or accidental violation.
- SL 2: intentional attacks with simple means.
- SL 3: attacks with sophisticated means and IACS-specific knowledge.
- SL 4: additionally, extensive resources and high motivation.
The target level (SL-T) follows from the risk assessment, the capability level (SL-C) describes what a properly configured product can achieve, and the achieved level (SL-A) shows in operation.
Example: remote maintenance access as a conduit
Fictional example: the manufacturer of a packaging line maintains the controllers on line 3 remotely. The risk assessment sets SL-T 2 for the zone "line 3". The conduit runs from the manufacturer through a remote maintenance gateway in a separate network zone to the line 3 engineering workstation, never directly into the office network. It rests on an asset inventory that lists the controllers, the gateway and the access path with an owner.
| Test | Expected result | Evidence |
|---|---|---|
| connection attempt without approval from the shift supervisor | refused | gateway log |
| connection with approval and multi-factor authentication | session reaches only the line 3 engineering workstation | log with person, time, target |
| addressing a system in the office network from the session | no connection | firewall log |
| the approved time window expires | session is terminated | log with end time |
The test passes only if all four cases show the expected result. Repeat it after every change to the gateway or the firewall rules, and record the date, tester and configuration state.
Does NIS2 apply to manufacturers?
For many, yes. Annex 2 to the BSI Act (BSIG) lists manufacturing under no. 5: manufacturers of medical devices and in vitro diagnostics, and NACE divisions 26 to 30, including machinery and motor vehicles. Under § 28(2) no. 3 BSIG, such a company is an important entity if it has at least 50 employees or more than €10 million in both annual turnover and balance sheet total. Annex 1 covers energy and water, among others, where OT is the core of the business.
The NIS2 Implementation Act has been in force since December 6, 2025.
The risk management measures under § 30(1) BSIG cover the information technology systems, components and processes an entity uses to provide its services. For a manufacturer that includes controllers, production networks and remote maintenance access, to the extent it uses them for that purpose. Operators of energy supply networks and installations subject to §§ 5c to 5e of the German Energy Industry Act (EnWG) are in principle exempt from § 30 BSIG under § 28(5) BSIG.
What the CRA and the Machinery Regulation require of manufacturers
The CRA obliges manufacturers of products with digital elements, including manufacturers of connected machines, controllers and devices; NIS2 addresses the operator, as the comparison CRA vs NIS2 shows. Under Article 13(8) of Regulation (EU) 2024/2847, the support period reflects the expected time in use and is at least five years, unless the product is expected to be in use for less.
Since September 11, 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents under Article 14 through the single reporting platform. For manufacturers with their main establishment in Germany the BSI is the coordinating CSIRT, and ENISA is notified at the same time.
Under Article 69(3) this also covers products placed on the market before December 11, 2027; from that date, the essential requirements in Annex I apply as well. IEC 62443-4-1 and 4-2 describe the development process and component requirements that manufacturers can align this work with.
For machinery, the Machinery Regulation (EU) 2023/1230 applies from January 20, 2027. Under Annex III point 1.1.9, connecting another device or remote access must not lead to a hazardous situation. Under point 1.2.1(a), control systems must, where appropriate to the circumstances and risks, withstand foreseeable malicious attempts by third parties.
OT assets and catalogs in Rizzqo
Rizzqo holds a manufacturing process as a primary asset with confidentiality, integrity and availability ratings. Controllers, production networks and remote maintenance access sit beneath it as supporting assets, with category, subcategory and an assignable owner; from the process they inherit the confidentiality rating and the personal-data flag.
Through category and subcategory, the requirements of ISO/IEC 27001 and 27002 appear on them, and the owner finalizes each answer with name and timestamp. For manufacturers, the CRA, ISO/SAE 21434 with TARA and RL CySec-Rail are held as requirement catalogs. Rizzqo computes a downtime risk from likelihood as a percentage and impact in euros.