OT Cybersecurity Best Practices: A UK Guide for Manufacturers and Utilities

Last updated: 1 July 2026

TL;DR: The core OT cybersecurity best practices are asset visibility, network segmentation, secure remote access, patch and vulnerability management, identity and access control, secure-by-design hardware, continuous monitoring, an OT-specific incident response plan, and staff training. Treat operational technology as a distinct discipline from IT, buy devices that are defensible by design, and layer these controls so a single failure never stops production. Here is how to apply each one on a real site.

Operational technology runs the physical world: pumps, valves, PLCs, drives, meters and the sensors that watch them. Securing it is not the same job as securing an office network, because a wrong move can halt a process or trip a safety system. This guide sets out the OT cybersecurity best practices that matter most in 2026, from the view of a UK supplier that ships the hardware. Each section opens with a plain answer, then goes deeper.

• What is OT cybersecurity?
• Why does OT cybersecurity matter now?
• What are the OT cybersecurity best practices?
• How do you secure LoRaWAN and edge devices in OT?
• What UK regulations govern OT security?
• OT cybersecurity checklist
• Frequently asked questions

What is OT cybersecurity?

OT cybersecurity is the practice of protecting the operational technology that monitors and controls physical processes, including industrial control systems, SCADA, PLCs, sensors and the networks that link them. It differs from IT security because its first priority is availability and safety, not confidentiality. A patch that is routine on a laptop can stop a production line, so OT security balances protection against uptime.

The distinction is practical, not academic. IT protects data; OT protects a physical process that can hurt people or halt output if it fails. That is why good practice leans on segmentation, monitoring and defensible hardware rather than the constant patching that defines IT hygiene. When the two converge, the OT side sets the tempo because the cost of getting it wrong is measured in downtime, not inconvenience.

Why does OT cybersecurity matter now?

Because attackers have industrial systems firmly in their sights, and a breach now stops production rather than just email. Connected sensors, remote access and IT-OT convergence have widened the attack surface as the value of disrupting a plant has become obvious to criminal and state-backed groups alike. OT security has moved from a niche concern to a board-level risk.

The threat data is stark. Dragos recorded 1,693 ransomware attacks against industrial organisations in 2024, an 87% year-on-year rise, and found manufacturing to be the most-targeted sector by a wide margin. The operational impact is landing too: the SANS 2025 survey found 22% of organisations reported an OT cybersecurity incident in the past year, and 35% of businesses cite cybersecurity as a major challenge to implementing new IIoT, per N-iX.

What makes these numbers frightening is the gap between breach and discovery. According to Dragos, attackers can sit undetected inside OT networks for weeks, quietly mapping a process before they act, which is why comprehensive visibility matters so much: teams that can see every asset and every flow contain incidents far faster than those working blind. In real terms a single intrusion can mean a stopped line, spoiled product, missed deliveries and a safety review before restart, so the cost lands on the balance sheet long before any ransom is discussed. Prevention alone is not enough; you have to detect and respond inside your own network.

What are the OT cybersecurity best practices?

The nine OT cybersecurity best practices below form a defence-in-depth programme. No single control is sufficient, but layered together they mean one failure never becomes a plant-wide outage. Work through them in order: visibility comes first.

1. Build a complete asset inventory. You cannot defend an asset you do not know exists. Discover and record every PLC, RTU, HMI, sensor, gateway and switch, including firmware versions and communication paths. Passive tools that read Modbus, DNP3, EtherNet/IP and OPC UA traffic build this picture without probing fragile devices. Good looks like a living inventory, not last year’s spreadsheet.

2. Segment the network. Flat networks let an intrusion spread from the office to the plant floor in minutes. Split IT from OT and divide OT into zones and conduits following the Purdue model or IEC 62443, with firewalls or data diodes between levels and a demilitarised zone at the boundary. Good looks like a compromised laptop that physically cannot reach a safety PLC.

3. Lock down remote access. Remote maintenance is the single most abused entry point into OT. Replace always-on VPNs and shared credentials with brokered, time-limited sessions, multi-factor authentication and full session recording. Grant vendor access only for the window it is needed and revoke it automatically. Good looks like every connection logged, scoped to one asset and closed when the job ends.

4. Manage patches and vulnerabilities the OT way. You cannot patch a running turbine controller like a laptop. Track known vulnerabilities against your inventory, prioritise by exploitability and exposure, and schedule fixes into planned maintenance windows. Where a patch is impossible, apply virtual patching at the firewall. Good looks like a risk-ranked backlog tied to real change windows, not blind auto-updates.

5. Enforce strong identity and access control. Shared operator logins and default passwords are still endemic in OT. Give every user a unique identity, apply least privilege and role-based access, and change every default credential before a device goes live. Add multi-factor authentication to engineering workstations. Good looks like knowing exactly who changed a setpoint, and when, from an audit trail.

6. Buy secure-by-design hardware. Security you specify at purchase is cheaper than security you bolt on later. Favour devices with secure boot, signed and encrypted firmware, encrypted transport such as TLS, and a published vulnerability disclosure policy. Ask vendors about default-password policy and support lifespan before price. Good looks like a fleet defensible out of the box.

7. Monitor continuously. Most OT breaches are found late because nobody is watching the traffic. Deploy OT-aware intrusion detection that understands industrial protocols and baselines normal process behaviour, then alerts on anomalies like an unexpected write to a controller. Feed events to a SOC that knows OT. Good looks like an alert the moment a device talks to something new.

8. Prepare an OT-specific incident response plan. An IT playbook that says isolate and wipe can be dangerous when the asset controls a physical process. Write a plan that names OT roles, defines safe-shutdown and manual-fallback procedures, and rehearses them so operators and security staff act together under pressure. Good looks like a tabletop exercise run yearly and updated after each one.

9. Train the people on the line. Engineers and operators are the last line of defence and the most common way in. Train them to spot phishing, to refuse unknown USB drives, and to follow change-control on the plant floor. Make reporting a suspicious event easy and blame-free. Good looks like an operator who queries an unexpected remote session.

How do you secure LoRaWAN and edge devices in OT?

Secure LoRaWAN and edge devices by provisioning unique keys per device, using AES-128 session encryption, disabling unused radios and interfaces, segmenting gateway traffic away from control networks, and monitoring join requests for anomalies. Treat each low-power sensor as a small computer on your network, not a passive probe.

LoRaWAN is the workhorse of industrial sensing, and its security model is strong when configured properly. Give every device its own root keys rather than reusing one key across a fleet, so a single compromised sensor cannot expose the rest. Rely on the protocol’s AES-128 session keys to encrypt payloads end to end, and disable any radio, USB or debug interface a device does not need in the field.

Route gateway backhaul through its own segment so a sensor network cannot bridge into the control zone, and watch the join requests: a flood of them, or joins from a device ID you never provisioned, is an early sign of tampering. This edge-first discipline is Indiott’s differentiator, set out on our OT cybersecurity page, because a sensor estate is only as trustworthy as the way it is keyed, segmented and watched.

What UK regulations govern OT security?

UK OT security is shaped chiefly by the Product Security and Telecommunications Infrastructure regime (PSTI), which sets minimum security for connectable products, and the Network and Information Systems Regulations (NIS), which place duties on operators of essential services in sectors like energy, water and transport. EU rules such as the Cyber Resilience Act and NIS2 also matter for anyone selling into or operating across Europe. Regulation is now a hard filter on which devices you can legally deploy.

Under NIS, operators of essential services must do more than buy secure kit. They have to take appropriate and proportionate measures to manage risk to their networks and systems, put processes in place to detect and handle incidents, and report significant incidents to their regulator within tight deadlines. In practice the very controls above, asset visibility, segmentation, monitoring and a tested response plan, become legal expectations rather than good ideas. The direction of travel is wider coverage: the forthcoming Cyber Security and Resilience Bill is set to widen scope to around 1,000 more organisations, pulling managed service providers and more of the supply chain into the regime.

The practical effect is that security debt is being pushed up the supply chain, onto the vendor. Given that Dragos logged an 87% jump in industrial ransomware in a single year, regulators are demanding provable baselines: no default passwords, a disclosure policy and defined support periods. For buyers this simplifies diligence. Choose hardware from vendors who already meet these regimes and you inherit compliance rather than retrofitting it.

OT cybersecurity checklist

Use this checklist to turn the OT cybersecurity best practices above into an action plan you can put in front of a team this quarter.

• Maintain a live inventory of every OT asset, firmware version and communication path.
• Segment IT from OT, and divide OT into zones with firewalls or data diodes between levels.
• Replace always-on remote access with brokered, time-limited, recorded sessions and MFA.
• Risk-rank vulnerabilities against your inventory and patch within planned maintenance windows.
• Give every user a unique identity, apply least privilege and change all default credentials.
• Specify secure boot, signed firmware and encrypted transport when you buy new hardware.
• Deploy OT-aware monitoring that understands industrial protocols and alerts on anomalies.
• Provision unique keys per device, encrypt LoRaWAN payloads and segment gateway traffic.
• Write and rehearse an OT-specific incident response plan with safe-shutdown procedures.
• Train operators and engineers to spot phishing, refuse unknown USBs and report early.

Want the checklist translated into working hardware? Explore our solutions to see the defensible sensors, gateways and routers behind each use case, browse our brands page, or request a quote and we will spec a secure system for your site. As UK industrial IoT specialists, we ship kit that is defensible by design.

These controls are not a one-off project but an ongoing programme: revisit the checklist each time you add assets, onboard a vendor or face a new regulation, and your defence stays as current as the threat.

Frequently asked questions

What is the difference between IT and OT security?

IT security protects data and prioritises confidentiality, so constant patching is routine. OT security protects a physical process and prioritises availability and safety, so segmentation, monitoring and defensible hardware matter more than aggressive patching that could stop a line. The two disciplines converge, but OT sets the tempo because downtime, not data loss, is the biggest risk.

What are the most important OT cybersecurity best practices?

The most important are a complete asset inventory, network segmentation, locked-down remote access and continuous OT-aware monitoring. Visibility comes first because you cannot defend what you cannot see, and remote access is the most abused entry point. Layer these with secure hardware, strong identity, OT patching, an incident response plan and staff training for defence in depth.

Why is OT cybersecurity so hard?

Because availability and safety come first, so you cannot patch or reboot devices freely, and much OT equipment was designed for decades of service without the internet in mind. Legacy protocols, long asset lifespans and IT-OT convergence widen the attack surface. Dragos logged 1,693 industrial ransomware attacks in 2024, an 87% rise, so the threat is growing faster than many estates can adapt.

How do I secure legacy OT devices that cannot be patched?

Wrap them in compensating controls. Segment them into tightly firewalled zones, apply virtual patching at the network boundary, restrict and record any remote access, and monitor their traffic for anomalies. Unique credentials and disabled services help too. The aim is to isolate the device so a known vulnerability cannot be reached, even when the firmware cannot be fixed.

What UK regulations apply to OT security?

The main ones are the Product Security and Telecommunications Infrastructure regime (PSTI) for connectable products and the NIS Regulations for operators of essential services. The forthcoming Cyber Security and Resilience Bill widens scope to around 1,000 more organisations. Vendors selling into Europe must also weigh the EU Cyber Resilience Act and NIS2, which raise baselines for manufacturers and operators alike.