Skip to content
OT AssociatesPURE PLAY OT SECURITY
← The OT Field Guide
06

Accountability lives at the asset

Bring governance down to the individual asset: every control has a named owner, live evidence and a review cadence.

5 min readInteractive figureISA/IEC 62443-2-1ISO/IEC 27001
Interactive figure
Where does accountability actually sit?
Policy OT-07

“All control systems shall be hardened.”

Owner
Head of Engineering
Status
Compliant

Approved once, owned in name by one senior person for 1,284 assets. The audit passes. Nobody can tell you whether PLC-201 still has its default password.

Zoom from the plant to a single controller.

Zoom from the whole plant to a single controller and see who owns what.

Why plant-level governance fails

A policy that says "all control systems shall be hardened" is approved once and owned by no one. Audits find it compliant on paper while individual controllers run default passwords, because no single person was ever accountable for that controller.

Micro Governance

Micro Governance, the methodology our leadership originated and productised in OTMATIX, binds each control to the asset classes it genuinely applies to, then to each asset. Every asset has an accountable owner and a day-to-day custodian. Every control on it carries evidence with an expiry date and a review cadence.

Governance then survives audits and staff turnover, because it lives in the system of record rather than in spreadsheets and people’s heads.

Takeaways
  1. 01Bind controls to the assets they truly apply to.
  2. 02Name an owner and a custodian for every asset.
  3. 03Evidence expires; review cadences keep it alive.