Elective E1 Operational Technology
What you will be able to do
- Recognize operational technology and explain why safety and availability come first.
- Draw an OT boundary and categorize with physical consequences in mind.
- Write alternative safeguard statements for controls OT devices cannot meet.
- Plan safe assessment, monitoring, change, and incident response for OT.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. What Makes Operational Technology Different · 35 min Completed
- 2. Categorizing and Scoping OT · 40 min Completed
- 3. Applying Controls in OT · 45 min Completed
- 4. Assessing and Monitoring OT Safely · 35 min Completed
Practice and quiz
- Practical exercise: SentinelBAS Vendor Remote Access and Safe Assessment
- Module quiz (10 questions, pass mark 80 percent)
Overview
This elective is for ISSOs who meet systems that control the physical world: building automation, laboratory environments, access control, utilities, and industrial processes. It uses the fictional SentinelBAS, the building automation and access platform at a high-containment biological laboratory that you met in Modules 2 and 3.
It is not needed for the capstone. It needs Module 3, since it builds on baselines and tailoring.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | What Makes Operational Technology Different | 35 min | Adapted |
| 2 | Categorizing and Scoping OT | 40 min | Adapted |
| 3 | Applying Controls in OT | 45 min | Adapted |
| 4 | Assessing and Monitoring OT Safely | 35 min | Adapted |
What is binding here, and what is guidance
| Source cited in this elective | Kind | Why it has that status |
|---|---|---|
| FISMA | Binding statute | OT used by or for an agency is generally a federal information system |
| FIPS 199 | Binding standard | Categorization, including physical harm to individuals and assets |
| CISA BOD 26-04 | Binding on federal civilian agencies | Applies to vulnerable assets, including OT; how is set by agency policy |
| OMB M-26-14 | Binding policy | Logging coverage includes OT |
| NIST SP 800-82 Rev. 3 and its OT overlay | Guidance | The main federal OT security guide |
| NIST SP 800-53, 800-53A, 800-53B, 800-137 | Guidance, required in practice | As in earlier modules |
| ISA/IEC 62443 | Industry consensus standard | Widely used; not a federal requirement |
| Agency facility safety procedures | Binding within the agency | Safety review and maintenance windows |
Module summary
- OT monitors or controls physical processes. Safety and availability come first.
- Old devices, insecure protocols, real-time operation, and vendor dependence make standard IT practice risky.
- Draw the boundary to include controllers and the connections that reach them; list every crossing.
- Categorize on physical consequences; High brings the High baseline and the OT overlay, and needs a transition plan.
- When a device cannot meet a control, meet its purpose another way and state the residual risk honestly.
- Segment into zones and conduits; control vendor remote access session by session.
- Assess and monitor passively wherever possible, under rules of engagement agreed with engineers and safety staff.
What comes next
The other elective, E2 GRC Engineering, needs Module 5.
Last reviewed 2026-11-13. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.