Annex
Operational Technology Security Overview Annex
This annex provides the conceptual foundation for the library's Operational Technology (OT) security content. It defines OT scope, distinguishes OT from IT, introduces the dominant reference frameworks (IEC 62443 and NIST SP 800-82), and explains the zone-and-conduit model that underpins OT network architecture.
- Type
- Annex
- Version
- 1.0.6
- Date
- 2026-10-27
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Operations: Operational Technology
- Review frequency
- Annual and upon material change to IEC 62443 or NIST SP 800-82
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope and definitions
- 3. Primary reference frameworks
- 4. The zone-and-conduit model
- 5. OT-specific risk considerations
- 6. Cross-domain relationships
- 7. Frequently asked questions
- 8. Framework alignment
Frameworks it maps to
- IEC 62443-1-1
- IEC 62443-2-1
- IEC 62443-3-2
- IEC 62443-3-3
- NIST SP 800-82 Rev. 3
- NIST SP 800-53 Rev. 5
- ISO/IEC 27001:2022
- ISO/IEC 27019:2024
- IEC 61511 / IEC 61508
- NERC CIP
Related documents
- operations/
ot/ sourceREADME.md (opens in a new tab) - operations/
README.md (opens in a new tab) source - Network Security and Segmentation Standardoperations
- Information Security Policysecurity
- Security Incident Response Proceduresecurity
- Energy and Utilities Sector Requirements Annexcompliance
- Logistics Sector GRC Requirements Annexcompliance
- Canonical Citations Registergovernance
- Glossary and Acronym Indexgovernance
Next
All Documents