Unified Command Across the IT and OT Divide

The incident that spans IT and operational technology fails at the seam between the two teams, not in either team's domain. Both are competent. They speak different languages, hold different priorities, carry different tools, and answer to different chains of command. Coordination is the discipline of closing that seam under pressure. Establish it before the incident, because you cannot negotiate a command structure while the cooling loop is drifting.

Understand the divide, because it is real and it is rational. The IT team optimizes for confidentiality, integrity, and availability, in roughly that order, and its instinct under threat is to patch fast, isolate aggressively, and restore from clean images. The operational-technology team optimizes for safety and availability above all -- a controller that runs the power train or the chilled-water loop cannot simply be rebooted to apply a patch, and an aggressive isolation that IT considers routine can, on the process side, trip equipment or endanger people. Neither instinct is wrong. They are tuned to different consequences. The IT responder who kills a segment to stop lateral movement may not know that the segment carries the heartbeat that keeps a pump from cavitating. The operational-technology engineer who refuses to touch a running controller may not grasp that the same controller is the adversary's foothold. Coordination exists to make those two truths meet.

Impose one command structure over both. Unified command means a single incident commander owns the response, with two domain deputies reporting up -- an IT lead and an operational-technology lead -- each authoritative in their own world and each obligated to surface constraints the commander must weigh. The commander does not need to be the deepest technical expert; the commander needs to run the process, force the decisions, and hold the timeline. The model borrows directly from established emergency-management doctrine, where a single commander coordinates fire, medical, and hazardous-materials specialists who would otherwise each run their own response. Adopt the doctrine wholesale: one commander, clear deputies, defined authorities, a common operating picture that both worlds can read.

The hardest coordination problems are the decisions that cross the seam. Containment is the sharpest. When the adversary sits on a controller, IT wants it isolated now and operational technology wants it left running until a safe shutdown can be staged. Resolve this in advance with a joint containment policy that classifies systems by safety criticality and pre-agrees the decision path: which systems may be isolated on an analyst's authority, which require the operational-technology deputy's sign-off, and which require a stop-work authority and a safety engineer in the room. The point is not to pre-decide every case -- you cannot -- but to pre-decide who decides, so the argument happens in a policy meeting instead of during the incident.

Communication is the other failure point, and it is mundane. The two teams use different alerting tools, different naming, different shift patterns, and often different physical locations. In an incident they must share one channel, one timeline, and one vocabulary. Build the shared vocabulary before you need it: a translation layer where isolate the segment is paired with and here is what that does to the process, and where an operational-technology term such as setpoint or interlock is understood by the IT responders making decisions about it. Run the joint out-of-band channel as the single source of truth, and give the commander a common operating picture that shows both the network state and the plant state on one board.

Rehearse the seam specifically. The IT team drills IT incidents; the operational-technology team drills process upsets; the seam between them is usually rehearsed never. The converged tabletop is where the two teams first meet under simulated pressure, and it always surfaces the same class of finding -- nobody owns the handoff, the tools do not interoperate, the authorities are ambiguous, the vocabularies collide. Surface those in a conference room and fix them with policy, joint tooling, and a standing relationship between the leads. The organizations that manage a converged incident are not the ones with better tools in either domain. They are the ones that built one command structure, one channel, and one rehearsed relationship across the seam before the seam was tested.