Demystifying OT System Ownership, Accountability, and Governance
Governance is the Achilles' Heel of OT Security
Digital transformation has redefined industrial operations. Industry 4.0 isn't a concept anymore—it's a living, breathing reality. Data-driven operations, remote connectivity, predictive analytics, and smart maintenance are now critical enablers of efficiency and resilience.
But while technology has evolved, governance models haven't kept up.
For the past two decades, I've led OT cybersecurity assessments across various sectors, including oil & gas, water utilities, and discrete manufacturing. The most consistent barrier to progress? A lack of clear system ownership and cybersecurity governance.
And when no one owns the risk, no one can prevent the breach.
Why Governance Is the Real Weak Spot in OT Security
When something goes wrong—be it a malware infection, an unauthorized remote access incident, or a ransomware attack—one question echoes across boardrooms and control rooms alike:
"Who was responsible?”
And too often, the answer is muddled, political, or flat-out unknown.
Unlike IT, where CISOs, CIOs, and network managers have clear charters, the OT space is murky. Plant managers prioritize uptime and safety. Control engineers focus on process continuity. IT security teams are brought in too late. Vendors manage their own islands of infrastructure.
This results in:
- Unpatched systems left exposed for years
- Unmonitored vendor sessions via insecure remote access
- Shadow assets and undocumented changes
- Political stalemates over who approves a firewall rule or an asset change
And ultimately, security paralysis.
Who Owns What? Untangling the Mess
In most environments, here's how ownership typically shakes out:
- IT owns: business applications, email, cloud, user management, enterprise firewalls
- OT owns: PLCs, DCS, SCADA, HMIs, historian databases, engineering workstations
- Vendors own: firmware updates, proprietary software, maintenance procedures
- Nobody owns: the integration layer—jump servers, remote access gateways, protocol translators, segmented zones
What's left is a no-man's land where everyone assumes someone else is in charge. That's where risk festers.
I've seen industrial facilities where:
- Temporary firewall exceptions became permanent
- Remote desktop sessions to OT were left wide open
- Control networks had internet access—yes, really
- The same admin password was used on every engineering workstation
This isn't negligence—it's a governance vacuum.
The Reality of "No OT Governance" Environments
When we assess organizations lacking OT governance, the symptoms are easy to spot:
- Project stalls: No one owns or authorizes the next step
- IT and OT conflict: IT sees OT as outdated; OT sees IT as reckless
- Inventory is incomplete: Asset lists are tribal knowledge, not documented
- Security is reactive: Incident response plans don't cover OT, or worse, don't exist
Consider a composite refinery scenario: legacy Windows systems support critical operations and remain unpatched for years because no role has clear authority to initiate modernization. The point is not the identity of a site; it is the governance gap that allows known exposure to persist.
The Case for an OT-Centric CISO
This is exactly why I advocate for an OT-centric CISO—or, at the very least, a dedicated OT cybersecurity leadership role.
You need someone who:
- Understands how plant operations work and why uptime matters
- Can speak both the language of control engineers and cybersecurity professionals
- Knows that rebooting a PLC isn't like rebooting a server—it could mean lost batches or even lives
- Has the authority to define policies, enforce controls, and align priorities
Your enterprise CISO may be brilliant, but if they've never walked a plant floor, they'll miss the nuances that define OT risk. And your engineering head may be excellent, but without cybersecurity depth, they'll overlook the threats hiding in plain sight.
The OT CISO isn't a luxury—it's a necessity.
Governance Isn't a RACI Chart. It's a Mindset Shift.
You can draw swimlanes, draft roles, or build a RACI matrix. But none of that matters without cultural alignment.
True OT cybersecurity governance means:
- Clarity – Every system, policy, and access has an accountable owner
- Collaboration – OT, IT, and security teams move together, not in silos
- Continuity – Policies evolve alongside operations, not after a breach
- Consequence – Someone owns the decision, and the risk that comes with it
Governance must be lived, not just documented.
Final Thoughts: Ownership is Security
As technology becomes more interconnected and threats grow more targeted, the question isn't whether you'll be attacked. It's whether you're prepared.
And preparation starts with ownership.
If no one owns the system, no one secures it. If no one owns the risk, everyone shares the damage.
In the next chapter, I'll explore how to operationalize governance—how to define policies, roles, and performance metrics that are effective within industrial environments.
But for now, I'll leave you with one question:
Do you know who owns OT cybersecurity in your organization?