OT and Critical Infrastructure Briefing for Boards

When the systems that run a plant, a grid, a pipeline or a water works are attacked, the loss is measured in safety incidents and days of lost production, not in records, and the board owns that risk whether or not it has ever been briefed on it. This briefing is for directors, chief executives, chief operating officers and CISOs of organisations that run operational technology (OT): manufacturers, utilities, energy, transport, water and other operators of essential services. It covers what is different about OT risk, why nation state actors are inside these networks now, what regulation expects of the board, the questions to put to management and the answers that should worry you. It stays at board level. The capability levels are in the OT Security Maturity Model and the engineering detail in the OT Security Guide.

The risk in one paragraph

OT is the equipment and software that physically moves, heats, mixes, pumps and switches things: control systems, safety systems, sensors and the engineering workstations that configure them. Much of it was built to run for decades and was never designed to resist a hostile network. Today it is connected, through the business network, through vendor remote access and sometimes straight to the internet. An attacker who reaches it can stop production, damage equipment or, in the worst case, create unsafe conditions. More often the damage is indirect: an attack on ordinary IT systems, such as finance, scheduling or the domain, forces the operator to shut down physical operations because it can no longer run them safely or bill for them. The scale of the harm is set by three things the board can ask about: how easily an attacker can cross from IT into OT, how long the business can operate without its digital systems, and how quickly it can restore a trusted state.

Why this is a board-level issue now

State actors are pre-positioned for disruption, not espionage. In joint advisory AA24-038A (February 2024, updated March 2024), CISA, NSA, FBI, the Department of Energy, EPA, TSA and partner agencies in Australia, Canada, the UK and New Zealand assessed with high confidence that the PRC-linked group Volt Typhoon is pre-positioning on IT networks to enable lateral movement to OT assets to disrupt functions, across communications, energy, transportation and water. The agencies reported dwell times of at least five years in some networks. See the Volt Typhoon Threat Actor Profile.
Identity is the bridge into OT. The same advisory describes the group stealing administrator credentials, dumping the Active Directory database, and testing default OT vendor passwords on domain-joined OT assets. From a virtualisation server next to OT assets it could have reached saved remote access session profiles for critical systems.
An IT incident can stop physical operations for weeks. Jaguar Land Rover shut its network on 31 August 2025 and only began a phased restart of production on 8 October 2025; the UK government announced a £1.5 billion loan guarantee on 28 September 2025 to support the company and its suppliers. See the Jaguar Land Rover cyberattack analysis.
Regulators now name the management body. Under NIS2 Article 20, management bodies of essential and important entities must approve the cybersecurity risk-management measures, oversee their implementation, follow training and can be held liable for infringements. In the UK, the NIS Regulations 2018 apply to operators of essential services, with the NCSC Cyber Assessment Framework as the usual benchmark.
Sector rules carry their own deadlines. North American bulk electric system owners face mandatory NERC CIP standards, US pipelines and rail operators face TSA Security Directives first issued after the 2021 Colonial Pipeline incident, and the US water sector has EPA requirements. The full picture is in the Critical Infrastructure Regulation Map.

What makes OT risk different from IT risk

Directors who have been briefed on IT security often assume the same answers apply on the plant floor. Several do not, and the differences change what the board should expect to hear.

Topic	Typical IT position	OT reality the board should understand
Top priority	Confidentiality of data	Safety of people and equipment, then availability, then integrity of control
Patching	Monthly, often automatic	Only in planned outages, often after vendor approval; some systems cannot be patched at all and must be isolated instead
Asset life	3 to 5 years	Often decades, far longer than IT; unsupported operating systems are common and replacement means capital projects
Response to an attack	Isolate and reimage	Isolation can itself stop production or trigger a safety shutdown; decisions need operations engineers in the room
Who holds access	Employees through the corporate directory	Integrators, equipment vendors and maintenance contractors, often through shared or default accounts
Ownership	CIO and CISO	Split between engineering, operations, IT and security, so gaps fall between them

The most important board-level consequence is ownership. If no single executive is accountable for OT cyber risk end to end, the board will receive partial answers from whoever it asks.

Safety, downtime and the cost of a stop

Boards should ask for OT exposure in the same terms as other operational risk: harm to people, days of lost output and cost per day. The table below is a framing management can complete for each critical site or service.

Exposure	What drives it	Question to put to management
Safety	Whether safety instrumented systems are independent of the control network and of IT	Can a cyber attack on our control systems disable the systems that keep people safe?
Lost production or service	Dependence of operations on IT systems such as scheduling, quality, logistics and billing	If corporate IT went down tonight, how long could each site keep running, and do we know because we tested it?
Recovery time	Availability of trusted backups of controller logic and configurations, spare hardware, vendor support	How long to restore a site to a known good state, and who outside the company do we depend on to do it?
Downstream harm	Customers, communities or suppliers who depend on our output	Who is harmed if we stop, and what are our obligations to them and to the regulator?
Equipment damage	Whether control logic can be changed without detection	Would we know if someone changed a setpoint or a controller programme?

CISA, FBI, EPA and the Department of Energy list the ability to operate OT systems manually as one of five primary mitigations for OT. Manual operation is the board's real backstop: a site that can run safely by hand for a week turns a catastrophe into a costly inconvenience.

The nation state threat in plain terms

Most organisations will meet ransomware criminals long before they meet a state actor, and the controls that stop both overlap heavily. The difference is intent and patience. Criminal groups want a fast payment and usually hit IT, which then forces an OT shutdown. State actors such as Volt Typhoon aim to be quietly present so that they can disrupt at a time of their choosing, and they avoid tools that would trigger alarms by using legitimate administrator accounts and built-in system tools. Attackers have also targeted internet-exposed controllers protected only by default passwords, as the 2023 campaign against Unitronics controllers in the US water sector showed. The board's practical takeaways are:

Assume entry through the edge and the directory: internet-facing VPNs, firewalls and routers, then administrator credentials. CISA's advice in AA24-038A is that if compromise is suspected, assume full domain compromise.
Long dwell time defeats short log retention: the advisory recommends centralised logging so investigations can reach back over long periods. Ask how far back the organisation can look.
Unsupported technology is a standing invitation: the March 2024 update to the advisory added guidance to replace end-of-life devices, or isolate and monitor them until replaced.

Threat detail and techniques are in the Top 10 OT Security Risks.

Regulation and personal accountability

Regime	Who it covers	What it means for the board
NIS2 Directive (EU) 2022/2555	Essential and important entities, including energy, transport, water, manufacturing of critical products	Management body approves and oversees risk measures and follows training (Article 20); early warning within 24 hours and notification within 72 hours of a significant incident; fines for essential entities of at least EUR 10 million or 2% of worldwide turnover, whichever is higher
UK NIS Regulations 2018	Operators of essential services in energy, transport, water, health and digital infrastructure	Cyber Assessment Framework as the usual benchmark; penalties up to £17 million for the most serious contraventions; reform proposed in the Cyber Security and Resilience Bill
NERC CIP	Owners and operators of the North American bulk electric system	Mandatory, auditable standards from CIP-002 onwards, including supply chain, remote access and internal network monitoring
TSA Security Directives	Designated US pipeline and rail operators	Required segmentation, access control, monitoring and tested incident and recovery plans
US SEC disclosure rules	US listed companies	Form 8-K Item 1.05 generally within four business days of a materiality determination; annual description of board oversight of cyber risk (Regulation S-K Item 106)

Directors should ask legal to maintain a single map of which regimes apply to which sites and which incident clocks start first. The NIS2 Management Liability Executive Briefing covers personal exposure in detail.

Five questions for the board to ask

Who is the single executive accountable for OT cyber risk across every site? A credible answer names one person, with authority over engineering and security budgets, not a committee.
Can anything on the internet reach our control systems, and how do vendors get in? Expect a definite answer, backed by an external scan, and a list of every remote access route with phishing-resistant MFA, named users and session recording.
If corporate IT were encrypted tonight, which sites would stop and for how long? Look for tested figures and a manual operation plan exercised in the last year.
Could an attacker who controls our domain administrator accounts also control the plant? The right answer is no, because OT runs on separate identities, separate administration and a segmented network.
Would we know if someone changed a controller programme or a setpoint, and how far back can we investigate? Expect OT network monitoring, change detection on controller logic and log retention measured in months, not days.

Red flags in management answers

"OT is air-gapped": ask for the evidence. Remote access for vendors, data historians and patch servers usually mean it is not.
"Engineering owns that": if security and engineering each think the other owns OT cyber risk, nobody does.
"We cannot patch, so there is nothing we can do": unpatched systems can be isolated, monitored and given compensating controls; CISA's advice is replace or isolate and monitor.
"The vendor manages remote access": shared vendor accounts and always-on connections are a common route in. The operator still owns the risk.
"We have never had an incident": with no OT network monitoring, the organisation would not know. Volt Typhoon stayed undetected for years in some victims.
"Our IT incident plan covers it": an IT plan that does not involve operations, safety and engineering will make the wrong isolation decisions on the day.

What good looks like

Area	Good practice
Governance	One accountable executive, OT on the enterprise risk register with safety and downtime exposure, board review at least annually
Exposure	No OT connections to the public internet; default passwords changed; an up-to-date inventory of OT assets and connections
Access	Segmented IT and OT, separate OT identities and administration, vendor remote access brokered, time-limited and recorded
Visibility	OT network monitoring and centralised logs with long retention, reviewed by people who understand the process
Recovery	Offline copies of controller logic and configurations, tested restores, and a manual operation capability exercised regularly
Supply chain	Security requirements in procurement and integrator contracts, including secure defaults and support lifetimes

The OT Security Maturity Model turns this into five levels for self-assessment.

Where to invest first

Remove exposure: take OT off the public internet and change default passwords. These are the first two primary mitigations from CISA, FBI, EPA and DOE, and they are cheap.
Control remote and privileged access: broker every vendor and engineer connection, require phishing-resistant MFA and remove shared accounts. See the Energy Sector Identity and OT Access Guide and the Critical Infrastructure Identity Security Guide.
Segment IT from OT: so that a domain compromise does not become a plant compromise.
Prove recoverability: offline backups of controller logic, spare parts strategy and rehearsed manual operation.
See what happens inside OT: passive OT network monitoring and log retention long enough to investigate a patient attacker. See the OT Security Assessment Guide for how to baseline.

Metrics to track

Number of OT assets reachable from the internet (target zero) and date of the last external verification.
Percentage of vendor and engineer remote access routes brokered, with phishing-resistant MFA and session recording.
Number of shared or default accounts remaining on OT systems, and the trend.
Percentage of critical sites with a manual operation exercise in the last 12 months.
Percentage of critical controllers with a tested offline backup of logic and configuration.
Log retention for OT and boundary systems, in days, against the agreed target.

A 90-day plan

Days 1 to 30: name the accountable executive; commission an external check for internet-exposed OT; ask each site for its list of remote access routes and shared accounts; confirm which regulatory regimes apply and which incident clocks start first.
Days 31 to 60: close internet exposure and default passwords found; agree a remote access standard with vendors; complete the safety and downtime exposure table for the top critical sites; check that controller backups exist offline for those sites.
Days 61 to 90: run an executive tabletop in which an IT ransomware incident forces a decision on whether to keep a site running; include operations, safety, legal and communications; report results and actions to the board and set a 12-month target using the OT Security Maturity Model.

Common failure patterns

Shared directory between IT and OT: one domain for both, so stolen administrator credentials open the plant as well as the office, the path Volt Typhoon used.
Vendor access left on: permanent remote connections with shared logins, owned by nobody and never reviewed.
Shutdown by dependency: OT itself is untouched, but production stops because scheduling, quality, logistics or billing systems in IT are down, as happened at Colonial Pipeline in 2021 and at Jaguar Land Rover in 2025.
Isolation decided by IT alone: network isolation during an incident that trips a process or a safety shutdown because operations were not consulted.
Manual operation assumed, never tested: the staff who knew how to run the site by hand have retired, and procedures are out of date.
Logs too short: retention of a few weeks when the attacker has been present for years.

Lessons from incidents

The Jaguar Land Rover incident is the clearest recent case of an IT attack becoming an operational and national economic event: more than five weeks without production, effects across the UK supply chain and state support for the company and its suppliers. Its lessons for an OT operator's board are about identity and recovery, not exotic attacks: owners and expiry dates on third-party accounts (a separate March 2025 intrusion at JLR reportedly used old, still valid supplier credentials), strong identity checks before password and MFA resets (the initial access route of the August 2025 attack has not been disclosed), monitoring for stolen credentials and a plan for shutting down and restarting operations safely. The full analysis is in the Jaguar Land Rover cyberattack analysis.

Practitioner checklist

Name one executive accountable for OT cyber risk and record it in the board's terms of reference.
Put OT safety and downtime exposure on the enterprise risk register, in days and money per critical site.
Verify externally, at least quarterly, that no OT asset is reachable from the internet.
Maintain a register of every remote access route into OT with owner, users, MFA and recording status.
Separate OT identities and administration from the corporate domain.
Hold offline, tested backups of controller logic and configurations for critical sites.
Exercise manual operation and a joint IT and OT incident scenario each year, with actions tracked to closure.
Keep a legal map of applicable regimes and incident clocks, and report the six metrics above quarterly.

Standards and references

How NHI Mgmt Group can help

We provide independent identity and non-human identity risk assessments and board briefings, with a focus on the privileged, vendor and machine accounts that bridge IT and OT. Our NHI Foundation Level Training Course helps security and engineering teams govern service accounts, shared accounts and credentials. Contact us to arrange a briefing.

OT and Critical Infrastructure Executive Briefing: Safety, Downtime, Threats and Board Oversight Questions