Site-by-site OT security does not scale across multiple facilities

At a glance

What this is: This is a TXOne Networks analysis of why managing OT security separately at each site creates compounding operational and governance overhead.

Why it matters: It matters because fragmented OT security operations increase inconsistency, slow policy change, and make audit evidence hard to produce for teams that also have to protect industrial uptime.

By the numbers:

• 47% of organizations cite gaps in OT security skillsets and resources.
• 67% of organizations struggle with unified IT/OT visibility.
• 33% of security incidents occur at IT/OT integration points.

Context

OT security becomes harder to run when each facility behaves like a separate program. The basic issue is governance fragmentation: policies, reporting, and approvals are being managed locally when the risk is shared across the enterprise.

In industrial environments, that fragmentation creates operational drag as much as security risk. Teams must coordinate changes across locations, reconcile inconsistent controls, and prove compliance without disrupting production.

This is a classic multi-site operating model problem, and the article shows that the challenge is typical rather than exceptional for small OT teams supporting several facilities.

Key questions

Q: What breaks when OT security is managed separately at each site?

A: Site-by-site OT security breaks consistency. Every new facility adds another policy set, another console, and another coordination path, so enforcement diverges and audit evidence becomes harder to produce. The practical failure is not one missed setting but a control model that cannot keep pace with operational growth.

Q: Why does fragmented OT governance increase operational risk?

A: Fragmented governance increases risk because policy changes take longer, exceptions live in email and spreadsheets, and local decisions are not visible enterprise-wide. In OT, that delay matters because security controls must respect production constraints while still staying consistent across sites.

Q: How can teams tell whether their OT security programme is scaling properly?

A: A scaling OT programme should make policy changes, evidence collection, and exception handling simpler as sites are added. If each new site increases manual coordination, reporting effort, and inconsistency, the programme is not scaling. That is the clearest sign that governance has fallen behind the operating model.

Q: Should OT teams prioritize central policy management or local operational approval?

A: They should do both. Central policy management keeps the security baseline consistent, while local approval workflows ensure changes fit plant-specific operational constraints. The mistake is choosing one at the expense of the other, because OT security fails when governance and production are treated as competing goals.

Technical breakdown

Why site-by-site policy management breaks at scale

Site-by-site management creates a control plane problem. Each site accumulates its own policies, console configuration, exception handling, and reporting workflow, so the security team is forced to replicate decisions manually instead of governing them once. In OT, that duplication is especially costly because policy changes often need local validation against production constraints. The result is not just inefficiency. It is divergence, where the same control means different things in different plants, making governance and audit evidence inconsistent.

Practical implication: centralize policy ownership so one change can be governed consistently across all sites.

Why unified IT/OT visibility is the prerequisite for operational control

Unified IT/OT visibility means security teams can see assets, policy status, and incident context across both domains in one operational view. Without it, the IT team and OT team each hold partial truth, and neither can reliably assess drift, exposure, or change impact. In practice, this slows approvals, weakens prioritization, and makes compliance evidence a manual compilation exercise. Visibility is therefore not a dashboard problem alone; it is the prerequisite for coordinated decision-making across hybrid industrial environments.

Practical implication: establish a single operational view before expecting consistent enforcement or reporting.

How audit burden becomes a security risk in OT programmes

When evidence must be collected site by site, audit preparation consumes the same people who are supposed to maintain controls. That creates a governance loop where reporting competes with remediation, and unresolved findings remain open longer than they should. The article’s point is that the burden is structural, not procedural. If evidence gathering depends on spreadsheets and email chains, then the programme cannot scale without adding manual risk back into the process.

Practical implication: automate compliance reporting so audit work does not displace control maintenance.

Threat narrative

Attacker objective: The objective is not a single exploit but the degradation of security consistency until operational gaps and compliance delays become normal.

1. Entry occurs through operational fragmentation, where each site uses its own tools, policies, and coordination path, creating inconsistent security coverage from the start.
2. Escalation happens as policy changes, approvals, and evidence collection move into spreadsheets and email chains, increasing the chance of drift and missed updates.
3. Impact is cumulative governance failure, with delayed audits, inconsistent enforcement, and security findings left unaddressed across multiple facilities.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Site-level OT governance creates hidden identity-like control sprawl: when every facility has its own console, policy set, and approval path, the programme behaves like a collection of unmanaged local authorities. That is not just an operational inconvenience. It is a governance failure because the same control objective is being enforced through different administrative realities. Practitioners should treat multi-site OT operations as a central policy problem, not a local tooling problem.

Unified visibility is the control that makes enforcement meaningful: fragmented IT/OT tooling prevents teams from seeing policy drift early enough to act on it. The article shows that without a shared operational picture, policy changes become slow, evidence becomes manual, and exceptions persist longer than they should. That is why visibility belongs at the centre of OT governance, not as an afterthought to reporting.

Compliance debt is the named concept this article exposes: each unmanaged site adds future audit work, future evidence gathering, and future reconciliation effort. Over time, the organisation accumulates a backlog of control evidence it cannot produce quickly, which is a governance liability in its own right. The practical conclusion is that scaling OT security requires reducing the cost of proof, not just deploying more controls.

Central policy with local approval is the right operating model: the article correctly points away from pure centralisation and toward governed delegation. Local teams need approval rights because production context matters, but the policy baseline still needs to be single-sourced. That balance is what keeps security from colliding with operations while still preserving enterprise consistency.

OT programmes fail when reporting is treated as a separate workstream: audit preparation that takes weeks is a symptom of the same fragmentation that slows remediation. If compliance evidence is assembled manually after the fact, the security function is operating reactively. Practitioners should align reporting, policy distribution, and exception handling as one control loop.

What this signals

Compliance debt is the operational consequence of site-by-site OT governance: every manual evidence request, every spreadsheet reconciliation, and every delayed policy update adds to a backlog that eventually constrains the programme itself. Practitioners should treat audit preparation time as a control signal, not just a reporting nuisance.

Multi-site OT security needs a single control plane with local approval: the right balance is enterprise policy consistency and plant-level operational review. That operating model reduces drift without ignoring the realities of production change management.

OT security teams should expect governance load to rise faster than headcount unless reporting and policy distribution are automated: once manual coordination becomes the default, the programme starts consuming the very people needed to maintain it.

For practitioners

• Centralize policy ownership across all sites Define one authoritative policy set for OT security and propagate changes from a single control point so facilities do not drift into different security baselines.
• Create site-level approval workflows Allow local operations teams to review and approve changes before deployment so plant constraints are respected without fragmenting the baseline.
• Replace spreadsheet-based coordination Move policy changes, exceptions, and rollout status into a shared workflow that removes email chains as the primary coordination mechanism.
• Unify compliance reporting Build reporting from live security data so audit evidence can be produced as a query instead of a manual aggregation exercise.
• Track OT skill and resource gaps explicitly Use resourcing reviews to quantify whether the team can support additional sites without degrading policy maintenance or audit readiness.

Key takeaways

• Site-by-site OT security creates compounding governance overhead because each facility adds more policy drift, more coordination, and more audit work.
• The core issue is not whether individual sites can be protected, but whether the programme can maintain consistent control across all of them.
• Centralized policy management, local approval workflows, and unified compliance reporting are the operating model changes that prevent scaling from becoming fragmentation.

Key terms

• OT security governance: The set of policies, approvals, reporting processes, and responsibilities used to manage security in operational technology environments. It matters because industrial security is often constrained by uptime and safety requirements, so governance must keep controls consistent without disrupting production.
• Unified IT/OT visibility: A shared operational view that brings IT and OT assets, policy status, and security events into one picture. It reduces blind spots between teams and makes it easier to coordinate changes, investigate issues, and produce evidence across the whole environment.
• Compliance Proof Debt: Compliance proof debt is the gap that forms when an organisation can state its control objectives but cannot readily produce evidence that those controls worked over time. In CUI environments, the debt grows when access, data movement, and remediation records are fragmented across teams and tools.
• Policy Drift Detection: Policy drift detection is the process of identifying when an access policy no longer matches the intended rule or the current business context. It helps teams catch unauthorized changes, stale permissions, and exceptions that have quietly become the new normal, so governance stays aligned with actual identity and app usage.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners strengthen access governance across modern identity and operational environments.