Beyond IT/OT Convergence: Why True Collaboration is the Key to Operational Resilience

Visit us on LinkedIn: Hillstrong Group Security

Author’s LinkedIn: Chuck Tommey

The Rise of IT/OT Convergence

The convergence of Information Technology (IT) and Operational Technology (OT) is a rapidly accelerating trend in industrial environments. The promise of convergence is enticing—integrated networks, cost savings, and streamlined management. However, while IT/OT convergence simplifies system integration and enhances visibility, it does not inherently strengthen cybersecurity or operational resilience. Without true collaboration, convergence can actually introduce new risks, leaving organizations vulnerable to cyber threats.

Cybersecurity in OT environments must be more than an add-on to IT security policies. Every cybersecurity initiative must directly enhance the mission of the organization—whether that mission is delivering power, managing water treatment facilities, or ensuring manufacturing continuity. This requires a mission-focused, risk-based approach as this is the best way to test how any cybersecurity initiative will affect organizational readiness. This is where IT/OT collaboration that goes beyond technology convergence and fosters genuine teamwork between the two disciplines becomes the critical enabler.

Why Convergence Alone is Not Enough:

While IT/OT convergence should bring significant benefits—such as improved data sharing, network visibility, lower tool count, and less training—it also presents unique security and collaboration challenges that cannot be solved through technology alone:

• Increased Attack Surface – More connected systems mean more potential entry points for attackers.

• Cultural & Process Differences – IT and OT operate under different priorities: IT values data confidentiality, while OT prioritizes safety and uptime.

• Patching & Change Management Conflicts – IT enforces frequent updates, whereas OT environments require stability and careful change control, often with regulatory implications.

• Legacy System Security Gaps – Many OT systems were designed without cybersecurity in mind and cannot be easily upgraded.

These challenges illustrate why convergence is just the first step—the real work lies in building collaboration between IT and OT teams to address these risks in a way that supports operational resilience.

The Power of True IT/OT Collaboration:

IT and OT must work together to establish a cybersecurity strategy that supports security and business operations. True collaboration means:

• Joint Risk Assessments – Both teams working together to identify and prioritize security risks based on operational impact.

• Co-Designed Security Strategies – Policies tailored to OT environments rather than applying IT security measures without modification.

• Mutual Understanding & Respect – IT understands the constraints of OT, and OT recognizes the importance of cybersecurity.

Without collaboration, IT-driven security initiatives may be seen as disruptive or unrealistic, while OT’s focus on operational continuity may unintentionally neglect cybersecurity risks. The key is balancing both perspectives.

Building a Secure and Resilient IT/OT Partnership:

1. Establishing an OT-Specific GRC Program

A well-structured Governance, Risk, and Compliance (GRC) program tailored for OT provides a foundation for collaboration. Traditional IT GRC frameworks do not address OT’s unique requirements, which is why standards, frameworks, and maturity models like IEC 6244, NIST CSF 2.0, and CMMI are crucial.

An OT-specific GRC program:

• Defines roles and responsibilities for IT and OT in cybersecurity.

• Ensures risk-based decision-making that prioritizes safety and uptime.

• Establishes compliance frameworks that meet regulatory and operational needs.

With a structured governance model, IT and OT teams can align security priorities without disrupting operations.

2. Developing a Joint Risk Management Strategy

Cybersecurity risks must be assessed in the context of operational impact. Instead of treating all vulnerabilities equally, IT and OT should collaborate to:

• Identify mission-critical systems and prioritize protections accordingly.

• Establish compensating controls when security patches are not feasible.

• Implement layered security controls that minimize risk without causing downtime and provide quick, non-disruptive mitigation opportunities.

• Scrutinize for indirect dependencies of OT processes on IT or other business functions.

3. Aligning Cybersecurity with the Organization’s Mission

Cybersecurity should be an enabler of operational resilience, not an obstacle. To ensure security initiatives support the organization’s mission, IT and OT must:

• Integrate cybersecurity into business continuity planning.

• Ensure security measures enhance, rather than hinder, uptime and productivity.

• Use cybersecurity frameworks (IEC 62443, NIST CSF 2.0) to align security with operational goals.

When security is viewed through the lens of mission success, IT and OT teams are more likely to work together effectively.

4. Strengthening Incident Response Collaboration

IT and OT must be aligned before a cyber incident occurs. Effective incident response planning includes:

• Defining IT/OT-specific response protocols.

• Running joint tabletop exercises and simulations.

• Ensuring clear communication pathways between IT and OT teams.

By preparing together, IT and OT can respond more efficiently to cybersecurity threats while minimizing operational impact.

Conclusion: Convergence is Just the Beginning

IT/OT convergence is an important step toward modernizing industrial environments, but it is not a cybersecurity solution on its own. Organizations must foster deep collaboration between IT and OT to truly enhance security and operational resilience.

• Technology alone cannot solve IT/OT security challenges—collaboration is essential.

• An OT-specific GRC program provides a foundation for well-functioning IT/OT relationships.

• Every cybersecurity initiative must enhance—not hinder—the organization’s mission.

By moving beyond convergence and investing in true IT/OT collaboration, organizations can build a cybersecurity strategy that strengthens both security and operational resilience.