A company's new IT-focused cybersecurity tools don't work with its legacy operational technology systems. The CSO must choose: change the security policies or replace the old OT equipment. Bridging IT and OT requires both teams to align on requirements and decisions.
I was just at a company last week where I had a chance to talk to the person that was in charge of cybersecurity for the entire organization, and they were trying to catch up after the fact because they had selected partners that implemented and gone in a certain direction, and they found out that the systems that OT had in place weren't compatible with the direction that they had gone on the cybersecurity. Hmm. And so because there was that disconnect between IT and OT, now they were having to decide, okay, do we adapt the new cybersecurity policies that we just put in place to account for the legacy OT systems, or do we now have to go and replace those legacy OT systems with something else that will adhere to the cybersecurity policy? And so There has to be that communication there, and there has to be an understanding from both sides of what those requirements are, what the different options are, and how to best go about structuring that.
