8 OT security best practices for industrial environments in 2026

A practitioner reference grounded in IEC 62443, NIST SP 800-82 Rev 3 and the 2025 SANS State of ICS/OT Cybersecurity Survey. For plant security leads, OT engineers and industrial CISOs. Updated April 2026.

OT security in 2026 is no longer optional. The 2025 SANS State of ICS/OT Cybersecurity Survey found 22% of organizations experienced an OT cyber incident in the past year. 40% of those incidents disrupted operations. Nearly 20% took more than a month to fully remediate.Half of all incidents began with unauthorized external or remote access. Secure remote access, asset visibility and segmentation are the controls with the largest gap between need and current capability.The eight practices below are the ones that consistently hold up in production OT environments. They map to IEC 62443, NIST SP 800-82 Rev 3 and the SANS Five ICS Cybersecurity Critical Controls. Each one acknowledges the OT constraint it respects (uptime, safety, OEM certification, brownfield reality) so engineers can actually implement them without breaking production.Acronis provides the foundation for two of the eight practices. Practice 5 (compensating controls for unpatchable systems) and Practice 6 (image-based backup with operator-led recovery) are where Acronis Cyber Protect for OT delivers directly. The other six practices are vendor-neutral and reference the OT-specialist tools that own those categories.

Industrial cybersecurity has reached an inflection point. Three forces are reshaping plant security simultaneously.

The 2025 SANS State of ICS/OT Cybersecurity Survey, based on 330 industrial cybersecurity professionals, reported that 22% of organizations experienced an OT cyber incident in the past year. 40% of those incidents disrupted operations. Nearly 20% took over a month to fully remediate. Ransomware accounted for almost 38% of OT incidents, with the Dragos 2026 OT Cybersecurity Year in Review reporting a 49% annual increase in ransomware groups targeting industrial organizations in 2025, affecting 3,300 companies.

IT and OT convergence, increased remote access for vendors and contractors, IIoT deployment and the steady accumulation of legacy systems running unsupported operating systems all expand the OT attack surface. The same SANS survey found that half of all OT incidents originated from unauthorized external access. Only 12.6% of organizations report full visibility across the ICS Cyber Kill Chain.

NIS 2 in the EU, expanded NERC CIP requirements in North America, Australia's SOCI Act, Singapore's Cybersecurity Code of Practice and Saudi Arabia's OTCC-1:2022 are all pushing critical-infrastructure operators toward similar baseline controls: documented patch management, business continuity, incident reporting, secure remote access and operator-led recovery. The plants that adopt these practices proactively are the plants that pass audits.

What this article is and is not

This is a practices reference written for engineers. It is not a vendor ranking. Each practice acknowledges the category leaders that own it. Acronis Cyber Protect for OT is referenced in two practices (compensating controls and backup-and-recovery) where it directly delivers the capability. The other six practices reference OT network monitoring, segmentation, secure remote access and asset visibility platforms in the categories they own.

For a vendor-comparison view of OT backup and recovery specifically, see /blog/posts/best-ot-backup-and-recovery-solutions/.

Five filters were applied. Each practice had to meet all five.

1. Alignment with IEC 62443 security levels and NIST SP 800-82 Rev 3 guidance. Each practice maps to specific clauses in the major frameworks, so adopting them directly supports compliance posture.
2. Practicality in real production environments. No impact on process latency or control-loop determinism. No requirements that contradict OEM-certified configurations.
3. Applicability to brownfield plants. Long-lifecycle equipment, legacy operating systems and existing OEM commitments are the rule, not the exception. Practices that only work for greenfield construction were excluded.
4. Proven effectiveness in reducing MTTR or MTTD. Concrete operational outcomes, not aspirational maturity.
5. Validated in current industry data. 2025 SANS State of ICS/OT Cybersecurity Survey, Dragos 2026 OT Cybersecurity Year in Review, IEC 62443 family, NIST SP 800-82 Rev 3, CISA ICS advisories.

You cannot protect what you cannot see. The 2025 SANS State of ICS/OT Cybersecurity Survey found asset inventory and visibility was the #1 technology investment area in 2025 (50% of respondents) and remains the top priority for 2026 to 2027 (54%). Organizations with comprehensive asset visibility were 3.7 times more likely to achieve full visibility across the ICS Cyber Kill Chain.

Maintain a verified inventory of every PC-based asset, every PLC, every RTU, every IED, every HMI, every SCADA server, every historian, every engineering workstation, every jump server and every embedded industrial device on the OT network. Each entry includes operating system version, firmware version, OEM application, hardware model, network address, last-touched date and current patch level.

Many plants discover during inventory that the air gap they assumed they had includes Bluetooth, Wi-Fi or cellular paths they had not documented. The asset inventory is the foundation that makes every other practice in this article possible.

Passive OT asset discovery is a well-defined category. Leading platforms include Claroty xDome, Nozomi Networks Guardian, Armis, Tenable OT Security, Forescout and Microsoft Defender for IoT. These platforms use passive network monitoring to identify industrial assets without disrupting production. Active scanning tools are typically inappropriate for OT because they can disrupt control-loop timing.

1. Treating the inventory as a one-time project rather than a continuous capability. The inventory needs to update as assets are added, retired or moved.
2. Excluding embedded devices. PLCs, RTUs, smart sensors and field devices are part of the inventory, not just the Windows endpoints.
3. Relying solely on IT-style discovery tools. They miss OT-specific protocol details and can disrupt processes.

Network segmentation reduces the blast radius of any successful compromise. An attacker who reaches Level 4 should not be able to traverse straight to Level 2. The Purdue Reference Architecture and IEC 62443-3-2 zones-and-conduits model are the established framework for implementing this in industrial environments.

Map the OT network onto Purdue Model levels: Level 0 (process), Level 1 (basic control), Level 2 (area supervisory control), Level 3 (site operations), Level 3.5 (IT/OT DMZ), Levels 4 and 5 (site and enterprise business). Apply IEC 62443-3-2 zones for each functional grouping and conduits for each communication path between zones. Specify the protocols and destinations each conduit allows. Default-deny everything else.

Where bidirectional communication is unnecessary (for example, sending historian data out to corporate analytics with no need for inbound traffic), use unidirectional gateways or data diodes that enforce one-way data movement at the hardware level.

OT-aware network segmentation is delivered by industrial firewalls (Fortinet FortiGate Rugged, Cisco Cyber Vision, Palo Alto Networks, Check Point), unidirectional gateways (Waterfall Security, OPSWAT NetWall, Owl Cyber Defense) and OT-aware microsegmentation platforms (Claroty, Elisity, Illumio). The right architecture combines several of these by Purdue level and risk profile.

1. Designing segmentation on paper but allowing engineering or vendor traffic to bypass it for convenience. The exception becomes the rule.
2. Failing to monitor the segmentation. Firewalls without continuous review of allowed traffic drift toward over-permissive over time.
3. Treating segmentation as a one-time project. New assets, new vendors and new use cases require ongoing zone and conduit management.

The 2025 SANS State of ICS/OT Cybersecurity Survey found that half of all OT incidents originated from unauthorized external or remote access. The same survey reported that fewer than 15% of organizations have advanced controls like session recording or ICS-aware access management in place. Remote access is the largest gap between attacker reality and defender capability in current OT.

Every external connection into the OT network (vendor maintenance, OEM service, contractor access, employee remote operations) is treated as a privileged session that requires explicit authorization, multi-factor authentication, time-bounded access, session recording and audit logging. Standing access for vendors is replaced with just-in-time access. Shared passwords for remote access tools (the TeamViewer-on-an-HMI pattern that enabled Oldsmar 2021) are eliminated.

Where remote access uses industrial protocols (Modbus, OPC, EtherNet/IP), the access platform should understand those protocols and enforce protocol-level policy, not just network-level access.

OT secure remote access is its own product category. Leading platforms include Claroty xDome Secure Access, Cyolo, Dispel, CyberArk for ICS and the OT-specific modules of CrowdStrike Falcon for OT. These platforms differ from generic IT VPN and remote-access tools in that they understand industrial protocols and enforce least-privilege access at the asset level.

1. Allowing standing remote-access accounts for OEM service vendors. These accounts are attractive targets and rarely get the same security attention as employee accounts.
2. Using IT VPNs without OT-specific session controls. A VPN that works for corporate access does not enforce the protocol-level policies OT needs.
3. Failing to record or review remote-access sessions. Without recordings, post-incident investigation is difficult and accountability is weak.

Generic IT security monitoring does not understand industrial protocols (Modbus, DNP3, OPC, EtherNet/IP, PROFINET, BACnet, IEC 61850). A Modbus write command from an unauthorized source looks identical to a legitimate one on the wire unless the monitoring platform understands what "legitimate" means for that specific process. The 2025 SANS survey reported that only 12.6% of organizations have full ICS Kill Chain visibility.

Deploy passive OT network monitoring sensors at strategic points across the Purdue Model, with deepest coverage at Levels 2 and 3 where most attacker activity occurs. The platform should perform protocol-level deep packet inspection, baseline normal industrial process behavior and alert on deviations. Detection should be tuned to the specific operational role of each asset, not just generic anomaly thresholds.

Pair detection with response procedures. Detection without prepared response just creates an alert queue. The 2025 SANS data showed nearly 50% of OT incidents are now detected within 24 hours and 60% are contained within 48 hours of detection, both meaningful improvements driven by investment in OT-specific monitoring.

OT-aware network detection and response is its own well-defined category. Leading platforms include Dragos Platform, Claroty xDome, Nozomi Networks Guardian, Tenable OT Security, Forescout and Microsoft Defender for IoT. These platforms differ from generic IT NDR by including industrial protocol parsers, ICS-specific threat intelligence and process-aware behavioral baselines.

1. Deploying sensors only at the IT/OT boundary. Most attacker activity inside OT happens at Levels 2 and 3 and will not be visible from the boundary.
2. Generating alert volumes that the OT team cannot triage. Tune the platform during pilot to reduce false positives before broad rollout.
3. Treating monitoring as a substitute for prevention. Detection without prevention just gives faster confirmation of compromise.

Many OT endpoints will never be patched again. Windows XP, Server 2003, Windows 7, certain Linux kernel versions and embedded firmware on legacy automation devices have all reached end of support. The OEM-certified application requires that exact configuration. The realistic protection model is not to patch, but to compensate. NIST SP 800-82 Rev 3 explicitly endorses this approach for industrial control systems.

For each unpatchable system, deploy a layered set of compensating controls:

1. Network segmentation per Practice 2. Limit the attack surface the unpatchable system presents to the rest of the environment.
2. Behavioral anti-ransomware that runs offline. Detect ransomware behavior, anomalous process activity and unauthorized encryption based on what processes do, not on signatures of known attacks. Behavioral engines do not depend on OS patches.
3. Application allowlisting. Restrict the unpatchable endpoint to running only the OEM-approved application set.
4. Aggressive removable-media controls. USB malware is now the dominant air-gap crossing vector, per the Honeywell 2024 USB Threat Report which found that more than 50% of malware on USB drives is now purpose-built for removable media propagation.
5. Strict change control. Every change to an unpatchable endpoint is approved, documented and reversible.

This is also where the Windows 10 end-of-support reality lands. Windows 10 reached end of support on October 14, 2025. For OT endpoints that cannot afford Microsoft Extended Security Updates (ESU) at scale and cannot migrate to Windows 11 on the OEM's validated cadence, compensating controls become the protection model.

Acronis Cyber Protect for OT delivers two of the core compensating controls on a single agent. Acronis Active Protection is the offline-capable behavioral anti-ransomware engine that continues to detect ransomware behavior on unpatchable systems without cloud signature updates. The platform supports Windows XP SP1 through Windows 11 and Linux kernels 2.6.9 through 5.19, covering the operating systems other endpoint protection tools cannot install on.

For network segmentation, removable-media controls and application allowlisting, the right architecture pairs Acronis with the OT-specialist platforms in Practices 2 and 4.

1. Treating compensating controls as a temporary measure. For some endpoints, compensating controls are the permanent protection model.
2. Applying generic IT EDR to legacy OT endpoints. Most IT EDR platforms do not install on Windows XP, Server 2003 or older Linux kernels.
3. Forgetting Windows 10. The October 2025 EOS shifted Windows 10 OT endpoints into the compensating-control category for any plant that cannot afford ESU at scale.

Sophos State of Ransomware 2024 found that 93% of ransomware attacks on manufacturing organizations attempted to compromise backup systems specifically. Backup is no longer the last line of defense. It is the primary attack target. The protection model has to assume the backup itself will be attacked. The 2025 SANS survey also reported that nearly 20% of OT incidents took more than a month to fully remediate, and the difference between hours and weeks is almost entirely a function of backup and recovery capability.

For every PC-based asset in the OT environment (HMI, SCADA server, engineering workstation, historian, jump server), maintain image-based backups with the following properties:

1. Image-based, not file-based. A full system image restores the operating system, drivers, applications and data. File-based backup leaves rebuilds taking hours per system.
2. Operator-led one-click recovery. A plant operator on shift can restore a failed system without waiting for an IT engineer to arrive on-site. The single largest determinant of MTTR.
3. Dissimilar-hardware restore capability. The original PC running a 12-year-old HMI may have failed and the exact model may no longer be manufactured. The image needs to restore to different hardware.
4. Backup integrity scanning before restoration. Restoring a poisoned image into a clean plant reinfects it. Pre-restoral malware scanning prevents this.
5. Immutable storage for at least one backup copy. Ransomware that encrypts backups needs to find a copy it cannot modify.
6. Air-gap-compatible deployment. Backup operations should not require cloud connectivity that the OT network does not have.

Mature OT programs run quarterly tabletop exercises plus annual live restore drills with safety validation. The 2025 SANS survey found only 32% of organizations conduct annual recovery testing, but the organizations that do cut financial losses in half compared to peers without preparedness exercises.

Acronis Cyber Protect for OT delivers all six properties on a single agent. One-Click Recovery enables operator-led restoration. Universal Restore handles dissimilar hardware. Backup scanning with pre-restoral remediation prevents reinfection. Immutable storage and air-gap-compatible deployment are native. The platform supports the legacy operating systems (Windows XP through 11, Linux 2.6.9 through 5.19) that cover most brownfield OT.

For a vendor-comparison view of OT backup and recovery specifically, see /blog/posts/best-ot-backup-and-recovery-solutions/.

1. Backing up files but not full system images. Operating system, drivers and OEM application configuration are not in a file backup.
2. Relying on enterprise IT backup tools that do not support legacy operating systems or operator-led recovery.
3. Storing all backups in one logical location that ransomware can reach. Immutable copies and air-gap-compatible storage are essential.
4. Never testing the restore. Backups that have not been restored in a recovery exercise are theoretical, not real.

OT cybersecurity programs that operate in isolation from the broader enterprise BIA, incident response and business continuity functions consistently lose ground. Regulators, insurers and boards increasingly expect OT to be a first-class participant in enterprise risk management, not a separate program. The 2025 SANS survey reported that nearly 80% of organizations updated incident response plans in 2025, with regulatory changes and threat intelligence as the leading drivers.

Set explicit RTO and RPO targets for each Purdue level and each critical OT system. A two-hour RTO for a single HMI is achievable with the right backup platform. A two-week RTO for an entire SCADA tier is what plants get when they have not planned for incident scale.

Document site-level playbooks for each facility. The 2025 SANS survey reported that only 31.2% of organizations have these. A playbook covers commissioning state, safety validation and calibration checks specific to each plant. Generic enterprise IR plans do not address the OT-specific recovery steps engineers actually need.

Involve plant engineers and field technicians in tabletop exercises. The 2025 SANS data showed that organizations rated as fully prepared for cyber threats were seven times more likely to engage field technicians in exercises than peers. Exercises that involve only the security team test only the security team.

1. OT and IT incident response running as separate programs with no shared playbook for incidents that cross the IT/OT boundary.
2. Setting aspirational RTO and RPO targets without testing whether the current backup and recovery capability can actually meet them.
3. Treating tabletop exercises as a compliance checkbox rather than an operational rehearsal.

Multiple regulatory frameworks now apply to industrial environments simultaneously: NIS 2 in the EU (in force October 2024), NERC CIP in North America, the EU Cyber Resilience Act, DORA, OTCC-1:2022 in Saudi Arabia, SOCI in Australia, Singapore's Cybersecurity Code of Practice and others. The 2025 SANS survey reported that 58% of respondents have at least one facility subject to mandatory cybersecurity compliance, and 26% of those reported a possible audit violation.

Adopt an OT-specific framework as the technical baseline (IEC 62443 is the dominant choice globally, often paired with NIST SP 800-82 Rev 3 for context). Map regulatory requirements onto that baseline rather than implementing each regulation as a separate program. The same backup and recovery capability that satisfies IEC 62443-3-3 SR 7.4 also satisfies NIS 2 Article 21 business continuity requirements and NERC CIP-009 recovery plan requirements. Build once, comply many times.

In supplier procurement, increasingly require IEC 62443-4-1 certification for security products. The certification covers the supplier's secure product development lifecycle and provides audit-ready evidence in industrial procurement. Acronis is one of a small number of suppliers in the OT data protection category with this certification.

1. Implementing each regulation as a separate program rather than mapping them all onto one technical baseline.
2. Treating compliance as the security goal rather than as the audit-ready expression of a stronger underlying program.
3. Overlooking the supplier-side certification dimension. Procurement contracts increasingly cite IEC 62443-4-1 directly.

The eight practices reinforce each other. Practice 1 (asset inventory) is the foundation that makes Practices 2 (segmentation), 4 (monitoring) and 5 (compensating controls) possible. Practice 6 (backup and recovery) is the safety net that makes everything else implementable, because if any of the other practices fail, recovery is the determining variable. Practice 7 (BIA integration) and Practice 8 (compliance alignment) are the management discipline that keeps the technical practices funded and operating year over year.

Plants that try to implement only one or two of these practices in isolation typically find that the gaps cancel out the gains. Plants that implement all eight on a multi-year roadmap, with measurable progress against each, consistently outperform peers on incident frequency, MTTR and audit posture.

Where Acronis Cyber Protect for OT directly deliversPractice 5 (compensating controls for unpatchable systems) and Practice 6 (image-based backup with operator-led recovery) are the two practices where Acronis Cyber Protect for OT directly delivers the capability. The single-agent design combines anti-ransomware, antivirus, EDR, vulnerability assessment, patch management and image-based backup, supporting Windows XP SP1 through Windows 11 and Linux kernels 2.6.9 through 5.19.For the other six practices, pair Acronis with the OT-specialist platforms that own those categories. The right architecture is not one vendor for everything. It is the right vendor for each layer.Learn more: /products/cyber-protect-ot/Manufacturing industry page: /industries/backup/manufacturing/Analyst recognition: /blog/posts/leading-analyst-firms-reveal-how-acronis-cyber-protect-fortifies-ot-cybersecurity-resilience/

OT security best practices are a set of technical and organizational controls that protect industrial environments from cyber threats while respecting OT-specific constraints (uptime, safety, OEM certification, brownfield reality). The eight practices in this article (asset inventory, network segmentation, secure remote access, threat monitoring, compensating controls, backup and recovery, BIA integration and compliance alignment) cover the technical baseline that holds up consistently in production OT environments.

OT security best practices are organized around availability and safety as the primary engineering priorities, with confidentiality and integrity supporting those goals (the AIC model). IT security operates under the CIA model where confidentiality leads. OT practices also have to accommodate legacy operating systems, OEM certification cycles, scheduled production windows, regulatory validation and continuous-process operation. Generic IT controls applied directly to OT often break production or create safety risk.

NIST SP 800-82 Rev 3 (September 2023) is the US federal guide to OT security and is widely adopted globally as a practitioner reference. It provides the technical baseline for asset inventory, network segmentation, compensating controls for legacy systems and incident response in industrial environments. The eight practices in this article all map to specific clauses in SP 800-82 Rev 3.

IEC 62443 is the international standard for industrial automation and control system security. Each of the eight practices maps to IEC 62443 clauses: Practice 1 supports IEC 62443-3-3 SR 5.1 (asset inventory implicit in zones-and-conduits); Practice 2 directly implements IEC 62443-3-2 zones and conduits; Practice 5 supports IEC 62443-3-3 SR 3.2 (malicious code protection); Practice 6 supports IEC 62443-3-3 SR 7.3 (data backup integrity) and SR 7.4 (system recovery and reconstitution). Adopting these practices directly supports IEC 62443 compliance.

The 2025 SANS State of ICS/OT Cybersecurity Survey identified three areas with the largest gap between need and current capability: secure remote access (Practice 3), asset visibility (Practice 1) and OT-aware network monitoring (Practice 4). Half of all OT incidents originated from unauthorized external or remote access, and only 12.6% of organizations have full visibility across the ICS Cyber Kill Chain. These three practices are where additional investment delivers the largest immediate risk reduction.

Acronis Cyber Protect for OT directly delivers Practice 5 (compensating controls via offline-capable behavioral anti-ransomware that runs on legacy operating systems) and Practice 6 (image-based backup with operator-led one-click recovery, dissimilar-hardware restore, backup scanning before restoration and air-gap-compatible deployment). For the other six practices, the right architecture pairs Acronis with the OT-specialist platforms that own those categories: passive asset discovery, network segmentation, secure remote access and OT-aware threat detection.

Yes. Each practice was selected specifically because it can be implemented without impact on process latency, control-loop determinism or OEM-certified configurations. Practice 6 (backup) can be deployed with hot backup that requires no system reboot. Practice 4 (monitoring) uses passive sensors that do not generate active traffic. Practice 2 (segmentation) is implemented during planned maintenance windows. The implementation timeline is typically multi-year, not multi-week, so practices can be sequenced around plant operations.

NIS 2 Article 21 requires essential and important entities to implement appropriate technical and organizational measures including risk analysis, incident handling, business continuity and the security of network and information systems. Practices 1 (inventory), 2 (segmentation), 4 (monitoring), 6 (backup and recovery) and 7 (incident response) are core technical controls supporting Article 21. Practice 8 (compliance alignment) is where regulatory mapping happens. The supplier-side IEC 62443-4-1 certification that Acronis holds is increasingly cited as audit-ready evidence in NIS 2 documentation.

Start with Practice 1 (asset inventory) because every other practice depends on it. Then Practice 6 (backup and recovery) because it is the safety net that makes everything else implementable and because backup is the primary attack target in current ransomware campaigns. After that, prioritize based on which gap your plant has the most exposure on: Practice 3 (remote access) if vendor and contractor access is poorly controlled; Practice 4 (monitoring) if visibility into Levels 2 and 3 is limited; Practice 5 (compensating controls) if you have significant unpatchable legacy systems. Practices 2, 7 and 8 can typically run in parallel with the others.