Every time I audit an industrial environment in Latin America, I find the same disconnect. IT has controls, policies, and even certifications. OT (operational technology) runs on systems that have gone 15 years without patches, unencrypted protocols, and a culture where the priority is keeping the plant running regardless of cyber risk.
This is not an isolated observation. It is a systemic pattern we documented in our research on industrial OT cybersecurity, analyzing controls across 80+ industrial facilities in the region.
The structural problem: IT and OT speak different languages
In IT environments, the priority is confidentiality, integrity, and availability (CIA) in that order. In OT, it inverts: availability first, integrity second, confidentiality third. A SCADA system controlling a water treatment plant cannot stop for a patch.
Vulnerabilities we found in the region
- 72% of evaluated SCADA systems run software versions no longer receiving security updates.
- 65% of OT networks lack effective segmentation from the corporate IT network.
- 58% of industrial protocols in use (Modbus, DNP3, OPC Classic) transmit data without encryption or authentication.
- Only 14% of evaluated organizations have an updated OT asset inventory.
IEC 62443 vs ISO 27001: not a choice, an integration
ISO 27001 provides the management system framework. IEC 62443 is the standard family designed specifically for industrial automation and control systems (IACS) security. The model that works in practice uses ISO 27001 as the management framework and IEC 62443 technical controls for the OT zone.
What boards need to understand
- An OT incident has physical consequences: Not just data loss — plant shutdown, chemical process failure, public service interruption.
- IT/OT convergence is irreversible: Industry 4.0 connectivity brings efficiency but also attack surface.
- OT security budget cannot be zero: In 78% of organizations we assessed, OT security budget is buried within general IT budget.
A realistic action plan
- OT asset inventory
- Network segmentation per IEC 62443 zones and conduits
- OT anomaly monitoring
- Integrated risk assessment
If your organization operates industrial environments without visibility into OT security, an industrial cybersecurity assessment is the first step.