Navigating IT/OT governance: overcoming barriers to achieve proactive compliance

Many organizations have formalized their approach to cybersecurity compliance. But having a program in place is different from implementing its requirements consistently across operational environments.  

Claroty’s The Global State of Operational Security 2026found that 75% of respondents have a structured or proactive approach to managing cybersecurity compliance requirements for critical infrastructure. Yet 38% cited keeping up with evolving regulations, mandates, and frameworks as a challenge.

Compliance frameworks set expectations but putting them into practice is more complicated. For CIOs and CISOs, that means determining who is responsible for implementation, how to manage risks when conventional controls are not feasible, and how to adapt as requirements and environments change.   

Set clear ownership across IT and operations

Information technology (IT) and security teams define policies and controls, while operations teams understand how equipment supports production, facilities or care delivery, and the consequences of changing or taking a system offline. When these responsibilities are split, requirements and implementation can become disconnected, leaving gaps that attackers can exploit.

A security team can set a control without understanding how it affects a particular process. Operations teams may recognize that the control cannot be applied as written, but the lack of authority to approve an exception or decide what risk is acceptable. Without a clear path to a decision, the gap can remain open.  

In the survey, 29% identified IT/OT alignment challenges, including gaps in skills, ownership, or collaboration between IT security and operational technology (OT) teams, as the single biggest operational barrier to achieving full compliance across their organization’s cyber-physical systems (CPS).  

Leaders need to assign decision rights, not simply ask teams to collaborate. For each requirement, they must determine who interprets it, who implements and verifies the relevant controls, who can approve an exception, and who has the authority to accept the associated risk. Because approving an exception and accepting risk are separate decisions, organizations should establish clear accountability for each and involve the appropriate decisionmakers before an exception is approved. A defined process for resolving conflicts between security requirements and operational needs ensures that constraints lead to a decision rather than an unresolved gap. 

Adapt controls to operational realities

Twenty-six percent of surveyed organizations identified legacy systems that cannot be easily patched or updated as the single biggest operational barrier to achieving full compliance across their organization’s CPS.  

A uniform cybersecurity compliance checklist cannot account for the technical limits and business consequences of every operational system. Some equipment relies on older or proprietary technology. Other systems can only be taken offline during narrow maintenance windows. Updating a production controller also carries different consequences from updating a standard IT system, such as an employee’s laptop.  

When a system cannot be updated as planned, organizations still need to manage the risk. Prioritization should account for the asset’s role in critical operations, its exposure to threats, and the potential consequences of compromise. Teams should assess vulnerabilities and unmet requirements to determine the most effective response while minimizing disruption to operations. Depending on the risk, that could mean remediation, restricting access, or applying compensating controls. Additional safeguards include segmenting networks to limit the spread of an attack, strengthening authentication, or monitoring unexpected changes.  

When remediation is not immediately feasible or a required control cannot be fully implemented, organizations must document how they are managing the remaining risk. Record why the control cannot be applied, what compensating measures are in place, and who is accountable for the risk. Set a review date to reassess whether the exception is still necessary, and that the safeguards remain effective. Apply the same approach to third-party connections, establishing clear requirements for who can access operational systems and what that access allows.  

Maintain visibility as environments change

Operational environments and compliance obligations change as organizations add devices, modify configurations, onboard suppliers, and face new or revised requirements. A completed assessment captures conditions at a particular point in time and can quickly become outdated.

CIOs and CISOs should integrate compliance oversight into existing security and operational processes. An accurate inventory of connected assets and the processes they support gives leaders visibility into how systems are exposed, what they connect to, and which controls apply. This visibility helps leaders to identify changes that could affect compliance and focus attention on the gaps that pose the greatest risk to critical operations.  

Regular reassessment helps organizations determine whether controls remain effective as assets, configurations, suppliers, and requirements change.  

Effective operational compliance requires clear accountability, controls that reflect the realities of operational systems, and ongoing oversight. The goal is to ensure compliance requirements translate into security practices that protect critical operations, not simply to demonstrate compliance during an audit.