Patch OT by ranking fixes by exposure and known exploitation, testing each update before it reaches production, scheduling it in a maintenance window, and using compensating controls when you cannot patch yet. Start with internet facing and DMZ devices, as CISA's Siemens S7 alert advises.
Why OT patching is different
NIST describes OT security as balancing performance, reliability and safety needs. A restart that is trivial on an office server may interrupt a process. The ISA/IEC 62443 series has a part, 2-3, dedicated to patch management, which shows how central the topic is.
Step 1: know what you have
You cannot match advisories to assets without an inventory with manufacturer, model, operating system and firmware version. CISA's inventory guidance treats firmware and software version as medium priority fields, and the high priority list includes manufacturer, model and ports and services.
Step 2: rank
Use a few simple factors:
- Exposure. Is the device reachable from the internet or a DMZ? CISA's S7 alert puts these first.
- Exploitation. Is the flaw on CISA's Known Exploited Vulnerabilities catalog? The inventory guidance names KEV as authoritative input, alongside frameworks such as SSVC.
- Criticality. High criticality assets get the strictest measures.
- Attacker access needed. Does the flaw need network reach, credentials or user action?
Click through it at your own pace, or open it full screen.
Step 3: test
The S7 alert tells owners to test updates before deploying. The AA22-103A advisory notes its mitigations are not verified in every environment. Use a spare controller, a simulator or a staging line where possible. Check that logic, communications and recovery work after the update.
Step 4: schedule
Agree windows with operations. Take a backup of controller logic and configuration first, and verify firmware against known good copies. Keep a rollback plan.
Step 5: when you cannot patch yet
CISA's alerts repeatedly offer compensating controls: block the relevant port at the perimeter, restrict engineering access by allowlist, require MFA for remote access, monitor for unexpected writes or logic changes, and use segmentation. Record the decision, the control used and a review date.
Track it
Keep a simple register: advisory, affected assets, decision, compensating control, planned date and owner. Review it weekly.
Quick check
Should we patch everything as soon as a fix appears?
No. Rank by exposure and exploitation, test first and schedule in a window. Prioritise internet facing and DMZ devices.
What if the vendor has not validated the update?
Use compensating controls such as segmentation and access restrictions, and ask the vendor for a timeline.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA, Foundations for OT Cybersecurity: Asset Inventory Guidance
- CISA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A
- CISA, APT Cyber Tools Targeting ICS/SCADA Devices, AA22-103A
- ISA, ISA/IEC 62443 Series of Standards
Last reviewed: 19 October 2026.
