The first problem is that OT is a diverse category of networks that in some cases have evolved over decades. There is no typical OT network, and the risk is that this leads managers to see their network as a special case.

A second issue is how OT networks are connected, or not, to the networks that run office IT systems. This includes the people who run OT. OT is highly specialized and the teams looking after these networks are often separate or even physically remote from the main IT team.

OT networks themselves are almost always deliberately isolated from other IT systems, but not always completely so. One difference the guidelines note is how the data OT operators should protect is very different from other networks. For OT, sensitive data is anything that gives attackers special knowledge of its operation, for example voltage or pressure levels, or the location of specialized controllers.