Governance controls define how the programme is run, including assessments, maturity evaluation, policy, and incident planning. Defense controls protect the environment directly through asset visibility, vulnerability management, and threat detection. Both are necessary, but they solve different problems. Governance establishes oversight and accountability, while defense provides the technical evidence that the OT environment is being monitored and protected.
How governance controls and defense controls differ in OTCC-1:2022
Governance controls are programme-level controls. They define how the OT security effort is directed, measured, and reviewed, so the organisation can show ownership, maturity, policy intent, and incident planning. Defense controls are operational controls. They are the technical and procedural safeguards that keep the OT environment visible, monitored, and harder to compromise.
The difference is mainly about purpose and evidence. Governance answers whether the programme is being run responsibly. Defense answers whether the environment is being actively protected. In practice, governance sets the rules and accountability model, while defense produces the operational signals, such as asset coverage, vulnerability status, and threat detection, that show the controls are working.
That separation matters because a mature policy without defensive coverage can still leave the OT environment exposed, while a strong defensive toolset without governance can drift, overlap, or go unowned. OTCC-1:2022 treats them as complementary layers, not substitutes, because one establishes oversight and the other establishes protection.
What each control type is trying to prove
Governance controls are designed to prove that the programme exists as a managed capability. They typically answer questions about who is accountable, how often the environment is assessed, how maturity is evaluated, what policy governs decisions, and how incident readiness is planned. They are about stewardship, decision rights, and repeatable oversight.
Defense controls are designed to prove that the OT environment is being actively observed and defended. They typically answer questions about whether assets are discovered, whether vulnerabilities are tracked, and whether threats are detected in time to matter. A good defense control leaves evidence in the form of inventory coverage, monitoring outputs, alerts, findings, and remediation activity.
Viewed another way, governance is about the operating model and defense is about the operating reality. The first tells you whether the organisation has set the right expectations. The second tells you whether the environment is behaving as expected under those rules.
How to read the two control families together
OT teams should treat governance controls as the decision framework for the programme and defense controls as the implementation layer that validates it. If governance says the organisation will review risk, then defense should surface the technical facts needed for that review. If governance says the team will plan for incidents, then defense should provide the visibility needed to detect, triage, and contain them.
That means the two families should be checked together during assessments. A governance gap often shows up as weak ownership, inconsistent review, or unclear policy. A defense gap often shows up as blind spots in assets, delayed vulnerability treatment, or weak detection coverage. When both are present, the programme has no reliable way to prove either intention or protection.
For a broader control baseline, teams often map these ideas to NIST Cybersecurity Framework 2.0, especially where governance and protective capabilities need to be tied together in one operating model. They also align naturally with CIS Controls v8, which separates governance-oriented management activity from operational safeguards such as inventory, logging, and vulnerability management.
Risk and Threat Considerations
The main risk is treating governance as proof of protection. In OT, a documented process can coexist with weak visibility, stale inventories, or undetected exposure, so the organisation may believe it is controlled when the defensive layer is incomplete. The opposite risk also exists: useful defensive telemetry can exist without clear ownership, which makes gaps harder to prioritise and sustain.
Failure mechanism: Governance produces policy, reviews, and incident plans, but defense controls are underbuilt, under-monitored, or not tied to the same risk decisions, leaving the OT environment with oversight but limited practical protection.
Impact: The programme can appear mature on paper while attackers, faults, or misconfigurations remain easier to miss, easier to exploit, and harder to contain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.PO-01 — Policies, Processes, and Procedures | Governance controls in OTCC-1:2022 define programme policy and oversight. |
| ID.RA-01 — Asset vulnerabilities are identified and documented | Defense controls in OTCC-1:2022 include vulnerability management and asset visibility. | |
| DE.CM-01 — Networks and network services are monitored to find potentially adverse events | Defense controls emphasise threat detection and monitoring of the OT environment. | |
| Recommendation — Use GV.PO-01 to formalise OT governance policies and review them on a set cadence. Use ID.RA-01 to document OT asset vulnerabilities and keep the inventory current. Use DE.CM-01 to monitor OT networks and services for adverse events. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Defense controls rely on asset visibility as a core protective capability. |
| CIS-7 — Continuous Vulnerability Management | Defense controls include vulnerability management as an active protection function. | |
| Recommendation — Use CIS-1 to maintain an accurate OT asset inventory and reduce blind spots. Use CIS-7 to track, prioritise, and remediate OT vulnerabilities continuously. | ||
Practitioner Guidance
What to verify: Confirm that every governance control has a matching operational evidence source. If the programme requires asset awareness, vulnerability handling, or threat detection, you should be able to show where those signals come from and who reviews them.
Decision rule: If a control only changes policy or reporting, classify it as governance; if it changes monitoring, exposure reduction, or detection capability, classify it as defense. When a control does both, assess it against the primary outcome it is meant to prove.
Practitioner takeaway: The practical test is whether the control changes how the OT programme is governed or how the environment is defended, and mature programmes need both, with clear evidence for each.
Related resources from NHI Mgmt Group
- What is the difference between human IAM controls and NHI governance?
- What is the difference between attack surface management and NHI governance?
- What is the difference between role-based access and API key governance for NHI security?
- What is the difference between reviewing human access and reviewing NHIs?