What is the difference between IT and OT? An explanation for building owners and managers

IT and OT in one sentence

IT is about data. OT is about things that heat, cool, move, open and close.

By IT we mean everything an organisation uses to store, process and send data: laptops, servers, the office network, Wi-Fi, email and the cloud. If IT fails, people cannot work.

By OT we mean the technology that monitors and controls the physical world. In a building, that is the climate system, the lighting, the lifts, the access gates and the charging points. In a factory or distribution centre, it also includes the production lines, pumps, cold stores and sorting systems. If OT fails, the building gets cold, doors do not open or a lift stops.

The difference between IT and OT in a table

The most important difference is in the third row. With IT, the biggest risk is that data leaks. With OT, the biggest risk is that an installation stops or starts doing the wrong thing. That is why you cannot simply secure OT in the same way as IT. You can restart a computer for an update. You cannot always do that with a cooling system or a lift.

Which OT is there in a building?

Almost every office, retail building or commercial building has more OT than the owner thinks. The most common systems:

• The building management system (also called BMS). This is the central system that controls heating, cooling, ventilation and often lighting.
• Lighting and sun shading that respond automatically to time, light or occupancy.
• Lifts and escalators.
• Access control: card readers, smart locks, barriers and access gates.
• Cameras and the recorder that stores the footage.
• The fire alarm and evacuation system.
• Energy: smart meters, charging points, solar panel inverters and batteries.
• In logistics and industry: cold stores, sorting systems, dock doors and production lines.

You will also often hear the term IoT, the Internet of Things. These are smart devices that send data over a network. Much of the OT in buildings is now also IoT. How secure those devices are is explained in How secure is the smart building?

Why IT and OT are coming together

OT used to be a world of its own. The climate system had its own cables and its own control box in the plant room. None of it was connected to the internet.

That has changed. The installer wants to solve faults remotely. The owner wants to see energy use in a dashboard. The tenant wants to set the temperature or book a meeting room with an app. So OT is more and more often connected to the network, and often to the same network as the computers. This is called IT/OT convergence: the two worlds are growing together.

That brings real benefits. A building that controls itself well uses less energy. Faults are spotted and fixed faster. In the Netherlands, a building automation system is even mandatory for large non-residential buildings with a heating or cooling system of more than 290 kW. From 2030, this also applies from 70 kW. So more buildings will have OT connected to the network.

Why that is a risk

For years, OT was built for a closed world. Now that it is connected to the network, a few weak spots come to light:

• Old protocols. Many OT devices speak a language without encryption and without a password. Anyone on the network can listen in or send commands.
• Few updates. An installation must not stop, and the supplier often has to be involved. As a result, outdated software sometimes runs for years.
• Remote access. Installers and suppliers log in from outside. Every connection they use is also a possible way in for others.
• Divided management. The IT partner manages the computers, the installer the climate system and facility services the access gates. Nobody sees the whole picture.

A well-known example comes from the United States. In 2013, attackers got into the retailer Target using the login details of its heating and air conditioning supplier. From there, they reached the checkout systems and stole the details of tens of millions of payment cards. The lesson: a party with access for the installations also has a route into your network.

With OT, the consequences of an attack are also physical. It is not only about data. It is about a building that no longer heats up, doors that no longer open or a cold store that fails.

What the IT-Label and the Security Audit do

The IT-Label assesses the digital infrastructure of a building: the connection, the cabling, the Wi-Fi and the technical room. The IT-Label does check whether smart building systems are present, such as climate, access and cameras, but it does not assess how secure that OT is. The inspector does check whether the building management system is connected to the IT network. That is an important signal: it means IT and OT are linked, and you need to know how that is arranged.

Do you want to know whether the building systems are properly separated from your office network? We examine that in the Security Audit. An auditor checks on site whether your network is separated from guests, other tenants and the building systems, such as access and climate. You receive a report with the risks and advice on how to segregate the networks.

Five questions for every owner and manager

1. Which OT is in my building, and is there an overview of it?
2. Who manages each system: the installer, facility services or the IT partner?
3. Is the building management system connected to the office network or to the internet?
4. Who can log in remotely, and how is that access secured?
5. When were the systems last updated?

Don't know the answer to some of these questions? That is very common, but it is a risk. Start with the free IT-Label Self-Scan. In a few minutes you will see how well you know your building and where the points for attention are.

A series on IT and OT

This is the first part of a series on IT and OT in buildings. A new part is published every Wednesday, covering topics such as the systems in your building, cybersecurity law, mandatory building automation and network segregation. You will find all terms and parts on the page IT and OT in buildings. Don't want to miss a part? Sign up for the newsletter.

Frequently asked questions

What do IT and OT stand for?

IT stands for Information Technology. It is about digital data, computers and networks. OT stands for Operational Technology. It is the hardware and software that control physical processes, such as climate, lifts and machines.

What is the main difference between IT and OT?

IT is about data, OT is about physical processes. That is why the priorities differ too. With IT, the most important thing is that data stays confidential. With OT, the most important thing is that the installation keeps running and is safe for people.

Is a building management system IT or OT?

A building management system is OT, because it controls heating, cooling, ventilation and lighting. But it runs on computers and is often connected to the network. That is why it also affects IT.

What is IT/OT convergence?

It is IT and OT growing together. Installations that used to stand alone are connected to the network, so they can be managed remotely and share data. That brings convenience and energy savings, but it also calls for good security.

Is OT the same as IoT?

Not quite. IoT, the Internet of Things, covers all smart devices that send data over a network. OT is all technology that controls physical processes, even when it is not connected to a network. In modern buildings, the two overlap more and more.

Does the IT-Label also measure OT?

Partly. The IT-Label assesses the digital infrastructure of a building and checks whether smart building systems are present, but not how secure that OT is. The inspector does check whether the building management system is connected to the IT network. Whether the networks are properly segregated is something we examine in the Security Audit. You also receive advice.