Coordinating IT, OT, and Physical Teams Under Fire
The converged incident fails at the seam between teams, not inside any one team's domain. The IT responders and the facilities engineers are both competent; they speak different languages, hold different priorities, carry different tools, and answer to different chains of command. The IT instinct is to isolate and rebuild fast; the operational-technology instinct is to protect safety and keep the process running, and neither instinct is wrong because they are tuned to different consequences. Coordination is the discipline of closing that seam under pressure, and you cannot negotiate a command structure while the cooling loop is drifting. Impose one commander, one channel, one timeline, one rehearsed relationship across the seam, and build all of it before the seam is tested.
Knowledge check
Why does a containment decision on a compromised industrial controller create tension between IT and operational-technology teams?
Show the answer
Because IT wants to isolate the controller immediately to stop the adversary, while operational technology must protect safety and process stability and often cannot simply cut or reboot a running controller without risking equipment or people, so the decision requires a pre-agreed joint policy on who decides.