he special nature of OT environments and control systems requires additional care and attention when performing patching and vulnerability remediation that is not required when working in IT systems. Operations play a critical role and must have final say for starting all patching activities if there is an possible impact determined by a change impact analysis.
In control systems and OT environments, special care and consideration must be
provided to ensure critical defects and vulnerabilities are remediated in an a safe
and controlled manner. Systems Administrators for OT environments must understand
the nature of their patching, as well as the scope of impact in relation to the
business processes. In order to achieve a high level of cohesion with business users
and still meet IT/OT requirements for security and patch management, administrators
must have a high degree of understanding and respect for operations, scope of impact
for requested changes and an in-depth knowledge of system configuration and
functionality.
Change impact assessments are a critical part of OT system maintenance and are often minimal in scope for IT environments. Since there are often fewer operational intricacies playing a role in IT systems, less care and consideration is given to the deployment of patches or fixes. They are often deployed at a pre-scheduled time with little concern for the current state of the state of the Gas or Electric transmission and distribution grid, weather, and ongoing operations