Cyber-physical systems security, sometimes shortened to CPS security, protects systems where software senses and controls physical processes: pumps, grid equipment, building controls, vehicles, medical devices. It differs from IT security because a failure can hurt people or equipment, so safety and availability usually outrank confidentiality.
What counts as a cyber-physical system?
NIST's guide to operational technology, SP 800-82 Revision 3, describes OT as programmable systems and devices that interact with the physical environment, or manage devices that do. It lists industrial control systems, building automation, transportation systems, physical access control, and environment monitoring and measurement systems as examples. "Cyber-physical" is the wider term, and OT covers most of what security teams meet in factories and utilities.
NIST's planning note on that publication records that an initial public draft of Revision 4 exists, with comments due 30 November 2026. If you build a program on this guidance, check which revision is current.
Why do IT habits not carry over?
Patching. In an office, you patch on a cycle and reboot. A controller that runs a production line may be unable to stop for months. SP 800-82 frames its guidance around the "unique performance, reliability, and safety requirements" of OT.
Lifespan. Plant equipment may run for decades, long after the vendor stops support. Where an update does not exist, you protect the device by other means.
Protocols. Many industrial protocols were designed for isolated networks and carry no authentication.
Visibility. Scanning an IT host is routine. A scan that startles a fragile controller can halt a process.
Priorities. The order of concern flips. Availability and safety come first, with integrity close behind.
What does protection look like?
Constructed example: a water treatment site has a control network that was once isolated. Over time, a remote vendor link and a reporting server joined it to the office network. A phishing email on an office laptop is now one hop from the control network. The fixes are structural. Put a firewalled boundary between the two, allow only the specific flows needed, require multifactor login on the vendor link, and keep a current inventory.
CISA publishes Cross-Sector Cybersecurity Performance Goals, a baseline of practical outcomes for critical infrastructure operators, including asset inventory, changing default passwords and network segmentation.
Who should be in the room?
Security teams cannot do this alone. Operators know which changes are safe at what times, engineers know the process limits, and vendors know the equipment. A joint group that meets regularly, with authority to approve changes, beats a security policy written without them. Include safety staff too. A change that looks harmless on a network diagram may affect a safety system, and they will know. Agree one shared vocabulary of terms, so "outage", "incident" and "event" mean the same to everybody on a bad night.
How is CPS security different from a compliance exercise?
Passing an audit does not prove a plant is safe. Standards set a floor, and the real work is understanding your own process: which valve, if forced open, causes harm, and which network path could reach its controller. Start from consequences. Ask what the worst credible outcome is for each system, then work backwards to the controls that make it unlikely. That order keeps effort on the systems where a failure matters most.
How to check or apply this
- Build an asset inventory of every controller, sensor network and gateway. Use passive monitoring where active scanning is risky.
- Map the connections between your control networks and everything else, including vendor remote access and cloud links.
- Segment the control network and filter flows at the boundary.
- Remove or secure remote access: multifactor login, named accounts, session logging.
- Change default credentials on every device that has them.
- Keep an offline backup of controller configurations and test restoring one.
- Write a response plan that includes the operators, who know how to put the process in a safe state.
- Track vendor end-of-support dates and plan compensating controls for devices that cannot be updated.
Quick check
Is OT security the same as ICS security?
ICS is one kind of OT. NIST's guide lists industrial control systems alongside building automation, transportation and physical access control systems.
Why not just patch quickly?
Updates can disrupt a running process or need vendor testing first. The decision weighs safety and uptime against the risk of the flaw, and may call for compensating controls.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA, Cross-Sector Cybersecurity Performance Goals
- NIST, Cyber-physical systems
Last reviewed: 18 October 2026.
