7 Critical Controls For World-Class OT / ICS Cybersecurity

Operational Technology (OT) security is not IT security with different acronyms, it's a fundamentally different discipline where the priority is protecting people, physical assets, and the environment, not just data. In this article, ICS/OT security researcher Abu Saleh Md. Zakaria builds on the SANS Institute's Five Critical Controls for ICS/OT environments, adding two controls he considers essential but frequently overlooked: OT-specific incident response planning and third-party risk management.

The article walks through all seven controls in practical detail, defensible architecture (device-level, network-level, and documentation controls), visibility and monitoring (including a look at platforms like Nozomi Networks, Claroty, and Dragos), secure remote access, risk-based vulnerability management, physical security (including the real-world risks vendor engineering laptops introduce to a plant), and a full third-party risk management framework with actionable mitigation checklists.

Drawing on hands-on experience securing smart grids, water systems, aviation, telecom, and banking infrastructure, this is a field-level guide for anyone responsible for defending critical industrial environments, not a theoretical overview.