When cybersecurity and OT governance stay separate, organisations usually end up with inconsistent policies, weak monitoring, and gaps in incident response. Attackers can move from IT systems into production environments, where compromise may halt output or alter physical processes. The practical result is lower resilience, slower recovery, and greater exposure to safety and business disruption.
Why Separate Cybersecurity and OT Governance Breaks Down in Manufacturing
Manufacturing environments depend on a shared operating picture: the same asset, process, and change decisions must be visible to both cyber defenders and OT owners. When those groups work in parallel rather than together, policy exceptions, access decisions, and maintenance windows can be approved in one domain without the other understanding the operational impact. That is where blind spots begin.
The issue is not only technical inconsistency. A plant can have strong IT security rules and still leave production exposed if OT governance does not translate them into controls that respect uptime, safety, and control-system constraints. Conversely, OT teams can preserve availability while unintentionally leaving weak monitoring, weak authentication, or stale remote access paths in place. The NIST SP 800-82 Rev 3, OT Security Guide is useful here because it frames OT protection around architecture, segmentation, and control-system realities rather than generic enterprise assumptions.
In practice, integrated governance means one decision path for risk acceptance, change management, incident handling, and asset ownership. Without that, the organisation tends to discover problems only after an outage, a safety event, or a failed recovery attempt. The result is not just weaker security posture, but slower operational decision-making when time matters most.
How the Gap Shows Up in Operations and Recovery
The most visible symptom is inconsistent control enforcement. Cyber teams may require logging, patch approval, or remote-access approval while OT teams keep legacy exceptions active because the plant cannot tolerate disruption. Over time, those exceptions become normalised, and the environment drifts away from a defensible baseline. CISA Industrial Control Systems guidance is relevant because it reflects how these environments actually operate, including segmentation, monitoring, and operational constraints.
Recovery is often where the separation becomes obvious. If incident response is designed only around corporate IT, responders may not know which PLCs, historians, engineering workstations, or remote-support paths are safe to isolate first. If OT governance is isolated, responders may protect production continuity while failing to preserve evidence or contain lateral movement. The gap slows containment, extends downtime, and can force teams to choose between incomplete visibility and unsafe restoration.
There is also a compounding effect during change management. A small configuration change, vendor update, or new remote support arrangement can alter both cyber exposure and process behaviour. When the governance model is split, nobody owns the full consequence chain, so risk accumulates in places that are hard to see until the system is stressed.
Why Attackers Benefit from Split Governance
Separated governance gives adversaries a predictable path: compromise the less monitored IT side, then move toward production through shared credentials, trusted remote access, or weakly segmented integration points. In manufacturing, that path can lead to process disruption, data tampering, or unsafe operational states rather than just data theft. The attack does not need to be sophisticated to be damaging; it only needs one trust boundary to be unmanaged.
Attackers also benefit from the fact that OT environments often prioritise uptime, which can delay patching, account cleanup, and remote-access removal. If those decisions are not jointly governed, stale access and long-lived exceptions may remain in place well after they stop being justified. For threat awareness and active-exploitation context, the CISA Known Exploited Vulnerabilities Catalog and CISA cyber threat advisories help teams prioritise what is being actively abused rather than what is merely theoretical.
Risk and Threat Considerations
The main risk of non-integrated governance is that a cyber incident becomes an operational incident. In manufacturing, that can mean unsafe process states, extended outage, quality loss, or recovery actions that are technically secure but operationally unusable. The threat surface also widens because attackers can exploit the weakest governance boundary, not just the weakest technical control.
Failure mechanism: Separate governance creates inconsistent ownership of access, segmentation, monitoring, and recovery, so trusted paths and exceptions remain active without joint review.
Impact: Compromise can spread from enterprise systems into production, response can stall at the IT/OT boundary, and business disruption can include halted output or altered physical processes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Split governance often leaves accounts and remote access uncoordinated across IT and OT. |
| AU-6 — Audit Review, Analysis, and Reporting | Joint monitoring is needed when IT and OT incidents must be correlated across domains. | |
| CP-2 — Contingency Plan | Recovery planning must account for manufacturing continuity and safe restoration steps. | |
| Recommendation — Unify account ownership and review for any access that can reach production systems. Correlate IT and OT logs so cross-domain activity is detectable during response. Test recovery procedures that preserve both service continuity and production safety. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The question is about governance integration and how risk is managed across domains. |
| PR.AA-05 — Identity Management, Authentication, and Access Control | Separate governance commonly leaves access paths and authentication inconsistent across environments. | |
| RS.CO-02 — Incident Reporting | Incident handling breaks when IT and OT teams do not share escalation and reporting paths. | |
| Recommendation — Define one shared risk strategy for IT and OT decisions that affect manufacturing. Apply consistent access control to remote and privileged paths that touch OT assets. Establish one incident reporting path for events that can affect production systems. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Manufacturing exposure often persists through unmanaged access and exceptions between teams. |
| CIS-17 — Incident Response Management | The core failure mode is delayed or fragmented incident handling across IT and OT. | |
| Recommendation — Centralise control over access paths that can reach operational technology. Run joint incident response playbooks for plant-impacting cyber events. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Integrated governance is required to manage who can reach systems that affect production. |
| A.5.30 — ICT readiness for business continuity | Manufacturing resilience depends on recovery planning that reflects operational dependencies. | |
| Recommendation — Align access control decisions across IT and OT environments. Plan continuity and restoration around production-critical OT dependencies. | ||
Practitioner Guidance
What to prioritise: Start with the governance joins, not the tools. Clarify who owns remote access, change approval, incident triage, and recovery decisions for every system that can affect production. If an asset or account can influence both IT and OT, it needs a single accountable decision path.
What to verify: Confirm that alerting, escalation, and change records cover both sides of the environment, including vendor access and temporary exceptions. The control is not real if one team can approve access or restore a system without the other seeing the change.
Practitioner takeaway: The goal is not to force IT and OT to use identical controls, but to ensure they make one coherent risk decision for every path that can reach production.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
