What should teams do first when OT systems cannot tolerate downtime?

Start With the OT Process, Then Draw the Security Boundary Around It

When downtime is unacceptable, the first job is not to “secure everything” at once. It is to identify which assets keep the process safe and available, then separate those from lower-value systems, engineering workstations, remote support paths, and anything that can be delayed, mirrored, or observed without touching production traffic.

That distinction matters because OT environments usually fail in two different ways: the process is interrupted, or the wrong change reaches the wrong control path. An NIST Cybersecurity Framework 2.0 style identify and protect approach helps teams treat critical functions, dependencies, and recovery constraints as the starting point for control design, not an afterthought.

The practical output should be a short list of critical assets, a map of highest-risk connections, and clear rules for what can be monitored, segmented, or mediated without affecting operations. For OT, a measured boundary is usually safer than an aggressive change programme.

Use Compensating Controls That Preserve Operation

Once the critical path is known, the next step is to reduce exposure without forcing production downtime. Passive monitoring, segmentation, jump servers, tightly controlled maintenance windows, and rollback plans are the usual first-line controls because they improve visibility and constrain access while leaving the control loop intact.

That sequence aligns well with the guidance in NIST SP 800-82 Rev 3, OT Security Guide, which treats segmentation, monitored access, and OT-aware baselines as core design choices rather than optional extras. It also matches the operational reality that some systems cannot be patched, restarted, or re-imaged on a normal IT schedule.

For teams supporting remote vendors or integrators, access should be brokered through controlled entry points instead of direct connectivity into plant networks. NHIMG’s OT Third-Party and Integrator Access Guide covers that brokered model, which is often the safest way to keep support available while limiting blast radius.

Rollback planning is part of the control, not a postscript. If a change cannot be reversed quickly and safely, it is not ready for a no-downtime OT environment.

What “First” Means in a Plant or Control Network

The first decision is usually an operational one: confirm what must stay up, what can be observed passively, and what can be touched only during a narrow maintenance window. That order prevents teams from starting with tools or product choices before they understand the process constraint that defines success.

For many environments, the best starting point is an OT risk review that focuses on the highest-risk connections, not the entire asset estate. NHIMG’s Top 10 OT Security Risks is useful for that triage because it frames the common exposure patterns that usually matter first: exposed control assets, remote access paths, flat networks, and legacy dependencies.

If the environment supports it, teams should also align the first wave of work to a defined patching or maintenance process rather than ad hoc changes. The OT Patch Management Guide is a good fit here because it centres outage planning, compensating controls, and maintenance discipline, which are exactly the issues that dominate no-downtime operations.

Practitioner Guidance

What to prioritise: Start with the systems whose failure would stop production or create a safety issue, then work outward to the supporting network paths. If you cannot rank assets by operational criticality, you are not ready to choose controls.

What to verify: Confirm which traffic can be observed passively, which administrative paths are already in use, and which maintenance actions truly require interruption. In OT, a control is only useful if it fits the plant’s operating rhythm and does not depend on a reboot to become effective.

Decision rule: If a change can be mediated through a jump host, segmentation boundary, or scheduled maintenance window, do that before considering a direct in-band change to production equipment. If it cannot be mediated safely, treat it as a higher-risk exception and require explicit operational approval.

Practitioner takeaway: The first move in no-downtime OT is to reduce uncertainty around the process boundary, because once the critical path is clear, the safest controls are usually the ones that add visibility and containment without touching live operation.

Related resources from NHI Mgmt Group

• How should organisations design cyber resilience for critical workloads that cannot tolerate downtime?
• What fails first when legacy OT cannot be patched or replaced?
• How should security teams reduce privileged access risk in OT without causing downtime?
• Why do IoT and ot environments create different security risks from standard IT systems?