Cybersecurity
Security Awareness Training That Actually Changes Behaviour
Annual slide decks do not change behaviour. A modern awareness programme is continuous, role-based and measured by how quickly people report threats — not by completion rates.
Key takeaways
- Safety and availability come first in OT; security controls must respect both.
- Passive asset discovery is the safe starting point for visibility.
- Segment IT from OT and control remote access tightly.
- NCA OTCC builds on the ECC for operational technology environments.
Why OT is different
Operational technology — PLCs, SCADA, DCS and safety systems — runs physical processes in energy, utilities, manufacturing and transport. Systems may run for decades, patches may require plant shutdowns and active scanning can crash fragile devices. Priorities are safety first, then availability, then confidentiality.
The rising threat
IT/OT convergence, remote vendor access and connected sensors have widened the attack surface. Ransomware that reaches the OT network, or forces precautionary shutdowns of IT systems the plant depends on, can halt production.
A practical security programme
- Asset visibility through passive network monitoring that identifies devices, firmware and communications without disrupting them.
- Zones and conduits — segment the network by function and criticality and control traffic between zones.
- Secure remote access with MFA, approval workflows, session recording and time-limited vendor access.
- OT-aware monitoring that understands industrial protocols and detects unusual commands.
- Vulnerability management that prioritises by exposure and compensating controls, aligned with maintenance windows.
- Backup and recovery of controller logic, configurations and engineering workstations.
- Incident response playbooks written jointly with operations and safety engineers.
NCA OTCC and the ECC
The NCA Operational Technology Cybersecurity Controls (OTCC) extend the Essential Cybersecurity Controls to industrial environments, addressing governance, defence, resilience and third-party risk for OT. Organizations operating critical infrastructure should assess against the current published edition and map each control to evidence.
Where to start
| Step | Outcome |
|---|---|
| Passive discovery | Accurate OT asset inventory |
| Architecture review | Segmentation and remote access gaps identified |
| Quick wins | Remote access secured, IT/OT firewall rules tightened |
| Monitoring | OT-aware detection connected to the SOC |
| Programme | Roadmap aligned to OTCC and maintenance cycles |
Building the OT security team
OT security needs people who understand both industrial processes and cybersecurity. Pair control engineers with security analysts, provide cross-training and include OT expertise in the SOC. Clear escalation to plant operations is essential during incidents.
How NAZZTEC helps
We perform passive OT assessments, design segmentation and secure remote access, align programmes to NCA OTCC and connect OT monitoring to 24x7 operations.
Next step: talk to our Industry Solutions and Cybersecurity Services teams about OT assessments.
Frequently asked questions
Can we use our IT vulnerability scanner in OT?
Not without care. Active scanning can disrupt some controllers; passive monitoring and vendor-approved methods are safer.
Who should own OT security?
Shared ownership works best: the CISO sets standards, while operations engineering owns implementation within safety constraints.
How do we handle vendor remote access?
Through a dedicated secure remote access solution with MFA, approval, time limits and session recording — never permanent VPN accounts.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
