Acronym · Safety & Security
OT (Operational Technology)
Operational technology (OT): the hardware and software that monitors and controls physical equipment and processes, such as fab tools, facility systems and industrial plants.
OT security differs from IT security because availability and safety usually come first and systems stay in service for many years.
- Also known as
- Operational technology
- Type
- Acronym
- Domain
- Safety & Security, Security architecture
Overview
OT (operational technology) is the hardware and software that monitors and controls physical equipment and processes, such as fab tools, cleanroom and utility systems, building automation and industrial plants. It differs from information technology (IT), which handles data and business systems, because a fault in OT can stop production or harm people and equipment. In semiconductor manufacturing, OT includes the computers inside process tools, which now have a dedicated cybersecurity standard of their own.
How it works
OT includes industrial control systems such as programmable logic controllers (PLCs), distributed control systems and SCADA software, as well as the embedded computers that run process tools, facility monitoring systems for gases, chemicals and ultrapure water, and the networks that connect them. These systems read sensors and drive actuators in real time, so they are judged first on availability, timing and safety, with confidentiality usually ranked after them.
For many years OT ran on bespoke, isolated networks. As factories connected tools to manufacturing execution systems, data analytics and remote support, OT came to rely on the same operating systems and networks as IT, a trend often called IT and OT convergence. That brought IT-style threats, such as malware, into environments where security fixes can be hard to apply, for example on legacy systems or where a vendor controls the software.
NIST's guide to OT security (SP 800-82) and the ISA/IEC 62443 series describe how to manage these risks, for example by separating networks, controlling remote access and building security into products from the start. For fabs specifically, SEMI E187 sets baseline cybersecurity requirements for fab equipment computers, covering operating system support, network security, endpoint protection and security monitoring.
Examples
- A fab requiring new process tools to meet SEMI E187 before they connect to the production network.
- Network segmentation that separates tool controllers from the office network, with a monitored connection between them.
- A facilities control system watching gas cabinets, exhaust and ultrapure water plants around the clock.
- An equipment supplier following ISA/IEC 62443-4-1 practices for secure product development of tool software.
- A legacy tool computer on an old operating system, protected by network isolation because it cannot easily be patched.
Why it matters
A single malware incident on tool computers can halt a fab, so OT security engineers, equipment engineers, facilities teams and equipment suppliers share responsibility for it. SEMI E187 gives chip makers a common set of baseline requirements to ask of equipment suppliers and integrators.
In the chip lifecycle, OT matters most at fab construction and tool installation, through volume production where uptime is everything, and at tool upgrades or end of life, when old controllers and operating systems must be replaced or isolated.
It matters most to: Fab Equipment Engineer, Fab Facilities and Ultrapure Utilities Engineer, OT / Fab Cybersecurity Engineer, Supply Chain Security Engineer, Systems Engineer, Semiconductor Equipment
Common confusions
- Not the same as IT
- IT manages data, business applications and office networks, where confidentiality often comes first. OT controls physical processes, where availability and safety usually come first.
- Not the same as overtime or occupational therapy
- Outside engineering, OT commonly means overtime or occupational therapy; in fab and plant documents it means operational technology.
- Not the same as IIoT
- The industrial Internet of Things describes connected sensors and devices that feed data to analytics. Many IIoT devices sit within OT environments, but OT also includes long-established controllers that were never designed for connectivity.
Related standards
- ISA/IEC 62443 (security for industrial automation and control systems)
- SEMI E187 (cybersecurity of fab equipment)
Sources
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security (opens in a new tab), NIST Computer Security Resource Center, 2026-10-22
- ISA/IEC 62443 Series of Standards (opens in a new tab), International Society of Automation (ISA), 2026-10-22
- SEMI E187: Specification for Cybersecurity of Fab Equipment (opens in a new tab), SEMI, 2026-10-22
- Operational technology (Wikipedia) (opens in a new tab), Wikimedia Foundation, 2026-10-22
Related terms
Part of the Safety & Security glossary, with every term in the topic and the lifecycles, tools and standards that use them.
Where it appears on the Hub
Used on 12 pages of the Hub. In each group, the pages that mention it most come first.
Lifecycle stages and gates
Suggest an improvement
Suggest an improvement to this entry
A clearer definition, an example, a correction or a source an editor can check. Editors review every suggestion before the entry changes.
Last reviewed . Written by The Semiconductor Hub editorial team. The full glossary