You inherit a plant network full of PLCs. Your IT vulnerability scanner and patch cycle are ready to go — how do you adapt them for OT?

The trap in this question is treating an OT network like a bigger office LAN. Industrial controllers interact with the physical world, so a scan or patch that would be routine on a laptop can stop a pump or a production line.

What NIST says

NIST SP 800-82r3 frames OT security around its unique performance, reliability, and safety requirements. Its guidance is specific:

• Patching: updates cannot always be applied promptly; they need thorough testing by vendor and owner, outages scheduled days or weeks ahead, and sometimes revalidation. Patches should be tested on a sandbox first and applied in scheduled maintenance windows, with a recovery plan.
• Active scanning: organisations should consider whether tools that scan actively may harm OT systems, and test them on offline systems before deployment.
• Monitoring: running network monitoring in a passive, learning mode (SPAN ports or taps) is a sensible first step.
• Unpatchable devices: use compensating controls, for example bump-in-the-wire devices in front of them.

Why the distractors fail

Scanning everything tonight ignores the testing guidance. Refusing to secure OT at all is defeatist: passive monitoring, segmentation, and planned patching all work. Scanning at peak hours maximises the damage if a fragile device falls over.

What interviewers want

A senior answer shows you adapt methods to the environment: discover passively, test first, change in windows, and compensate where you cannot patch.