# Operational Technology (OT) | Secureframe

> OT vs IT differences, where OT appears in the defense industrial base (SCADA, PLCs, HMIs), and how OT fits into CMMC scoping and NIST SP 800-82 guidance.

canonical: https://secureframe.com/glossary/operational-technology

Operational technology is the hardware and software that controls physical processes: assembly lines, pumps, turbines, HVAC, weapons platforms. OT differs from IT because downtime can mean physical harm. For defense contractors, OT shows up when manufacturing systems, test stands, or facility controls touch CUI or connect to CUI-handling networks.

### What OT Actually Looks Like

If you walk through a factory, the OT is everywhere you see a control panel. PLCs running a CNC machine. A SCADA system reading flow sensors. An HMI on a shop-floor computer showing production status. The building's BMS controlling HVAC. All of it is OT.

### IT vs OT Priorities

IT tends to prioritize confidentiality, then integrity, then availability. OT flips this. If a PLC goes offline during a production run, you lose product or damage equipment. So OT teams have long patch cycles, run legacy operating systems, and avoid changes that could introduce instability. This is why OT networks often look insecure to an IT auditor.

### Why OT Matters to CMMC

If an OT system processes, stores, or transmits CUI, it is in scope for CMMC Level 2. A CNC machine that receives technical drawings with distribution statements B through F handles CTI, which is CUI. That machine and the network it sits on are assessment scope.

### Controls That Apply to OT

- **NIST SP 800-82 Rev 3 (Guide to Oper**ational Technology Security): The reference for securing ICS, SCADA, and DCS environments.
- **IEC 62443:** International standard for industrial automation and control system security.
- **NIST SP 800-171: St**ill applies when CUI is involved. Network segmentation, access control, and audit requirements do not get a free pass because a system is OT.

### Practical Scoping Tactics

Most defense contractors isolate OT from IT with a firewall and a DMZ. Technical data arrives in the IT enclave, gets staged for the shop floor, and crosses into OT through a one-way data diode or a file transfer appliance that logs and scans what crosses. The OT network itself runs a minimal set of vendor-supported software, patched on the manufacturer's cadence.