Today, most organizations use more than one type of technology: Traditional IT helps employees and runs business applications. Cloud services add infrastructure outside the company. Operational technology manages physical processes and equipment. Artificial intelligence and other new technologies bring new abilities, dependencies, and ways to access systems.
While all these environments support the same organization, they don’t always handle risk in the same way. A security control that works well in an office setting might cause problems elsewhere. Fixing a vulnerability right away on an Internet-facing system may be necessary, but the same fix could disrupt a critical physical process elsewhere. This means security leaders must keep enterprise governance consistent, yet also recognize that not every environment should be secured in the same way.
Your mindset is to have a single view of enterprise risk, using security methods that fit each environment.
One Enterprise Doesn’t Mean One Security Model
Standardization matters: Shared identity practices, risk methods, incident procedures, security principles, and governance make operations more consistent and enterprise risk easier to manage. But one approach can’t fit every environment as IT, OT, cloud, and newer technologies each have different needs, constraints, and operating conditions. For example:
- Corporate IT usually focuses on confidentiality, integrity, availability, user productivity, and protecting business information.
- OT environments often focus more on availability, safety, predictable operation, and keeping physical processes running. Some systems run for years or have maintenance windows that make quick changes hard.
- Cloud changes who’s responsible for what. Organizations still own their risk, but control responsibilities are shared with the cloud provider, depending on the service.
- New technologies bring more challenges: AI, automation, connected devices, and new platforms can move faster than governance processes can keep up.
The approach here isn’t to create four separate security programs, but to have one security strategy that considers these different needs.
Risk Context Should Drive the Control
Security teams often aim for consistency as using the same configuration, patching goals, authentication rules, or monitoring standards across the organization is easier to manage. But risk is rarely that simple – take a critical vulnerability, for example:
- If it’s on an Internet-facing cloud workload, you might need to fix it quickly because the risk is high and updates can be made with little business impact.
- The same vulnerability in an OT environment needs more thought: Can you safely take the equipment offline? Does the vendor support the patch? Will the change affect a physical process? Is it possible for someone to exploit it from the current network setup? Are there other controls you can use until the next maintenance window?
The vulnerability itself hasn’t changed, but the situation has – and risk-based security considers both. This doesn’t mean lowering standards when it’s hard to fix something; instead, it means choosing controls based on exposure, impact, business needs, and available options to reduce risk, rather than simply following a rule without considering context.
IT and OT Convergence Changes the Risk Conversation
The line between information technology (IT) and operational technology (OT) is getting thinner, with industrial systems now relying more on standard networking, remote management, cloud services, vendor connections, analytics, and enterprise identity tools, and at the same time, business systems are using more data from operational environments. While this increased connectivity brings value, it also creates new dependencies:
- If a problem starts in corporate IT, it can affect operations when both areas share identity, network, management, or supplier links.
- An incident in OT can lead to more than just data loss – it can impact service availability, equipment, safety, or even physical operations.
For leaders, the key question isn’t whether IT and OT should have the same controls – they should not. Instead, leaders need to know where these systems connect, which dependencies cross those lines, and how risks are managed across both areas. This is especially important for critical infrastructure, where cyber and operational risks can become the same business challenge.
Cloud Changes Responsibility, Not Accountability
When organizations move to the cloud, security works differently: Infrastructure, platforms, applications, identities, data, and security tools can be spread across several providers and internal teams. The shared responsibility model clarifies which party manages which controls, but it doesn’t shift accountability for business outcomes. For example, a provider might secure its infrastructure, while the customer is still responsible for things like user identities, settings, data protection, and application security, depending on the service.
As companies use more SaaS and managed services, this distinction becomes even more important: Even if the organization manages less of the technology directly, leaders still need to understand the risks involved. They should know:
- Where important data is stored?
- How access is controlled?
- What dependencies exist?
- How services are monitored?
- What to do during an outage?
- How to leave or recover from a provider?
Cloud changes who does the work, but it doesn’t remove the organization’s responsibility to understand and manage risk.
Emerging Technology Tests Existing Governance
Artificial intelligence presents a familiar challenge: New technology often arrives in organizations before governance can catch up. Employees use AI tools to boost productivity. SaaS providers add AI features to their products. Development teams build models and connect APIs to applications. Business units look for new ways to automate tasks.
While this technology is new, many governance questions remain the same:
- What information does the service use?
- Who can access it?
- What decisions does it affect?
- What outside dependencies are involved?
- How is usage tracked?
- Who is responsible for the results?
- What if the service fails or acts unexpectedly?
Good governance doesn’t mean predicting every new technology; instead, it means having a decision process that can assess new tools as they come. Having this approach is more practical than creating a new governance model every time technology changes.
Visibility Becomes an Enterprise Capability
As technology environments become more complex, it gets harder to know exactly what needs protection: Relying only on traditional asset inventories is no longer enough as organizations now need to see across all their endpoints, servers, industrial devices, cloud workloads, SaaS apps, identities, APIs, external services, third-party connections, and AI tools.
So instead of just asking, “What assets do we own?” it’s more helpful to ask, “What does the business depend on?” This approach links technical details to the bigger business picture, since a system matters more when leaders understand the key service it provides, the data it handles, what it relies on, and what could happen if it goes down or is breached.
Having this mindset also enables teams to set priorities more effectively, because security teams usually have limited resources, and a clear view of the enterprise helps them focus on the risks with the biggest impact, rather than treating every issue the same.
Common Governance Creates the Connection
Even though environments differ, they still need a shared governance approach. Without it, organizations might end up with separate security programs that use different terminology, risk methodologies, escalation paths, and accountability structures. Having a common governance layer sets clear expectations for everyone:
- Risk ownership and acceptance
- Identity and privileged access
- Asset and dependency visibility
- Security monitoring and escalation
- Incident management
- Third-party risk
- Architecture and change review
- Resilience and recovery
- Exception management
- Executive reporting
While each environment’s implementation will be different, your organization’s governance objective should stay the same. For instance, the enterprise standard may require critical vulnerabilities to be addressed based on risk:
- IT teams might use automated patching
- Cloud teams could redeploy workloads from secure images
- OT teams may isolate affected assets, limit access, increase monitoring, and plan vendor-supported fixes during scheduled maintenance
The actions may vary, but the risk mitigation target stays the same, and this approach enables organizations to stay consistent without forcing every environment to use controls that don’t fit their operating requirements.
Security Leadership Connects the Risk
As technology spreads across more areas, security leaders now work with many different teams:
- IT knows enterprise technology
- Operations handles physical processes
- Cloud teams manage platform architecture
- Engineering focuses on specialized systems
- Legal and privacy teams look after obligations
- Procurement manages supplier relationships
- Business leaders know which services and outcomes need protection
Security brings all these views together to manage risk, with the goal not to be the top technical expert in every field, but to ensure risks aren’t overlooked as they cross teams:
- A cloud risk shouldn’t be seen as only the provider’s problem
- An OT risk shouldn’t be left to operations alone
- An AI risk shouldn’t be just the business unit’s concern
While each risk may have different owners and management approaches, the material exposure should always be part of the same enterprise risk discussion.
Practical Questions for Executives
- Which IT, OT, cloud, third-party, and new technology environments support our most important business services?
- How are these environments interconnected?
- Are we using the same risk approach for all of them?
- Where have we changed security controls to meet operational needs?
- Are those changes based on documented risk decisions?
- Do we know our responsibilities when cloud providers or other third parties run the technology?
- Could a problem in one area affect another?
- Do our monitoring and incident processes give us enough visibility across all technology areas?
- Are new technologies coming into the organization faster than our governance can keep up?
- Can leadership see the full picture of enterprise cyber risk, or only separate technical reports?
From a CISO’s Seat
- Begin by identifying the business services your organization relies on, then map out the technology environments that support them.
- Set shared risk principles before creating controls for specific environments.
- Don’t apply IT security practices to OT systems without first considering how they might affect operations and safety.
- Use cloud responsibility models to guide controls, but remember that business accountability remains with you.
- Whenever possible, include new technologies in your existing governance instead of building separate processes for each one.
- Look for dependencies between IT, OT, cloud, third parties, and business services, since these links often matter more than organizational boundaries.
- When you need to make security exceptions, record them as risk decisions, assign owners, add compensating controls, and set review dates.
- For executive reporting, focus on overall enterprise exposure and business impact, not just separate technology areas.
Executive Takeaways
- IT, OT, cloud, and new technologies all support the same business, but each faces different challenges.
- Good governance doesn’t mean using the same security controls everywhere. Instead, controls should fit the specific risks in each area.
- As IT and OT systems come together, new dependencies appear, so it’s important to see across old organizational lines.
- Cloud providers help manage controls, but your organization is still responsible for its own business risks.
- Even when a technology is new, it should follow the same governance process.
- When looking at the whole enterprise, focus on both business needs and technical assets.
- Security leaders add value by linking risks across all environments, not by letting them stay separate.
The Bottom Line
Today’s businesses use a mix of connected technologies, each with its own needs, owners, and risks if something fails.
Securing everything the same way can cause issues, but treating each part separately brings its own challenges. A better way is to find a balance: Set up a common governance, know how each system works, adjust controls based on risk, and keep an overall view of how everything is connected. As technology keeps changing, the organization still needs a clear, unified picture of its risks.
References
- National Institute of Standards and Technology (NIST), Cybersecurity Framework (CSF) 2.0.
- National Institute of Standards and Technology (NIST), SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security.
- National Institute of Standards and Technology (NIST), SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View.
- National Institute of Standards and Technology (NIST), SP 800-207, Zero Trust Architecture.
- National Institute of Standards and Technology (NIST), AI Risk Management Framework (AI RMF 1.0).
- ISO/IEC 27001:2022, Information Security, Cybersecurity and Privacy Protection, Information Security Management Systems, Requirements.