• Minimal collaboration exists between IT and OT teams in BCM activities, duplicating effort and resources and jeopardizing overall continuity quality.
• OT and BCP lack the rigor and thoroughness of their IT counterpart, which is aligned to industry best practices and comply with regulations and standards.
• Dependencies between IT and OT capabilities are discovered during the execution of a BCP or DR, leading to delays in resuming business processes.

• IT and OT are on separate teams with different priorities and reporting lines; processes and tools are siloed, and growing institutional knowledge is a barrier to collaboration.
• IT and OT teams are unfamiliar with their counterpart’s business requirements (i.e. real-time operational need for OT and regulatory compliance for IT).
• BCP roles and responsibilities between IT and OT are not documented or communicated appropriately to the stakeholders involved.

• Define Boundaries and Map IT/OT Dependencies: Outline IT and OT capability interdependencies, define clear ownership and areas where joint efforts are critical.
• Identify IT/OT Technology and Processes: Jointly prioritize interdependent technologies and business processes providing an input to the creation of the BCP and disaster recovery.
• Establish a Governance Model to Manage IT/OT: Develop a jointly owned governance model, providing strategic guidance to sustain the BCM and other converged processes.

• IT and OT BCM are developed and executed separately without engaging the respective parties, duplicating effort and leaving organizations unable fully leverage inter-departmental strengths.
• Varying approaches to developing, executing and maintaining BCM leads to gaps in meeting regulatory standards/compliance (i.e. NERC CIP-008/9 for cyber incident, ISO22301 for plan testing).

• Operational and technical differences between IT and OT domains create a knowledge gap and a point of friction for the two teams to collaborate on BCM and other business processes.
• Departmental priorities between IT and OT (i.e. back-office business processes availability vs. operations availability) causing fragmented execution of BCM across the enterprise.

• Definition and boundary of IT and OT are increasingly being blurred with varying opinions across the organization of IT/OT applications, ownership, roles, and responsibilities.
• Unclear delineation between IT and OT poses as a roadblock to identifying the interdependencies within BCM in addition to other business processes (cyber security, strategy & innovation, governance).

IT and OT organizations maybe arranged in a variety of ways – for example OT reporting into Operations and IT into Finance. Separate organizational constructs creates a barrier for collaboration due to competing priorities, resources, budget, etc.

IT and OT overlaps are generally known but are not documented and communicated well across the organization. Often this leads to a reactive approach to conflict resolution when IT and OT intersects and is evaluated on a case-by-case basis.

IT and OT have contrasting foundational operating environments; understanding the intricacies of the respective domains is a challenge. Additionally, OT technology tends to trail that of IT with obsolete OT equipment still operational and knowledge residing with few individuals.

As with organization constructs, priorities between IT and OT can vastly differ. Without a common, “guiding star” vision to align both teams, individuals will feel less empowered to collaborate, change will be impeded, and leadership accountability misplaced.

• Vast amounts of OT institutional knowledge often hinders resources and decision-making; identifying the right stakeholders and bringing everyone along the journey will increase success.
• Legacy OT technology poses a challenge as only a select few individuals understand the operability of the system; organizations should anticipate additional initiatives branching from the BCM.

• Establish and align on a common definition of IT and OT across people, process, and technology; understand this definition will change as result of innovation.
• Align on the common object of a joint BCM – enabling the organization to optimize business continuity by leveraging the strengths of IT and OT, minimizing the impact of disruptions.

• Democratizing knowledge between IT and OT teams takes time. Ensure the organization has a plan to cross-train resources (i.e. embedding resources, training plan, knowledge base) to understand the joint BCP.
• BCP is a singular business process where IT and OT convergence occurs. Foundational areas such as governance, roles, and responsibilities should span beyond BCP to cover other processes.

Establish a common definition and boundaries of IT/OT applications for your organization by referencing industry best practices.

Highlight the applications where IT and OT involvement is required and identify the roles and responsibilities for both respective teams.

Based on the dependencies identified, initiate the development of the IT/OT BCM by leveraging Info-Tech’s BCM methodology.

Create a governance structure and associated processes to enable the sustainment of the BCM and other converging processes.

IT/OT Stakeholder Mapping

IT/OT Definition & Boundary Mapping

IT/OT Application Heatmap and Ownership

IT/OT Business Processes Identification

IT Disaster Recovery Plan

IT/OT Business Continuity Plan

IT/OT BCM Governance Structure

Document Maintenance Processes

Maximize the skills between IT and OT teams
Given the converging landscape of IT and OT, BCM planning should be done collaboratively, relying on the expertise each side can offer.

Start on common ground
Begin with the foundations and remove ambiguity between IT and OT.

Instill collaboration
Align IT and OT teams on a common objective to better serve the organization.

Future-proof convergence
Start with a singular business process and expand convergence.

1.1 IT/OT Stakeholder Mapping
Ensure the right decision-makers and audience are in participation.

1.2 IT/OT Boundary Definition
Establish a common understanding of IT and OT’s definition & boundaries.

2.1 IT/OT Application Heat-Map & Ownership Assignment
Highlight IT/OT apps and their respective owners.

2.2 IT/OT Business Processes Identification
Identify the processes enabled by IT/OT apps.

3.1 IT Disaster Recovery Plan
Document recovery workflows for IT/OT applications.

3.2 IT/OT Business Continuity Plan
Document workarounds to IT/OT business processes.

4.1 IT/OT Governance Structure
Governing structure to sustain BCP and other converging processes.

4.2 BCM Maintenance Processes
Document & implement BCP maintenance practices.

Defined IT and OT application and capability boundaries across the organization.

Catalog of IT and OT capabilities and where convergence occurs with clear ownership.

Joint recovery and continuity plans accounting for IT/OT technology and processes.

Means to sustain and maintain converged BCM, with the potential to scale across other processes.

IT Disaster Recovery Plan
A plan to restore IT application and infrastructure services following a disruption

This blueprint supports the creation of the IT DRP by identifying IT/OT applications

Download IT DRP Tool

BCP for Each Business Unit
A set of plans to resume business processes for each business unit.

This blueprint supports the creation of a BCP for the IT/OT “business unit” by identifying dependent business processes

Download Overall BCP Tool

Crisis Management Plan

A plan to manage a wide range of crises, from health and safety incidents to business disruptions to reputational damage.

Download Crisis Management Best Practices

• Including OT in your Business Continuity Management Plan will:
  • Expand and improve risk visibility by including OT technology as part of the IT Disaster Recovery Plan.
  • Provide a full picture of the interdependencies IT has across OT processes to expand convergence across other business processes.
  • Increase the strategic value of IT by supporting/enabling core utility operations.

• Organizations with an integrated IT/OT BCM will:
  • Improve overall risk posture and ability to contain cross-domain threats and recover more holistically.
  • Lower response times and limit the cascading effects of an disruption.
  • Improve collaboration between IT and OT teams, removing barriers and leading to greater operational efficiencies (i.e. quicker response, integrated strategy & roadmap).
  • Meet growing regulatory compliance for utilities to have OT business continuity planning.

Phase 1: Level-Set & Align

• IT/OT Stakeholder Mapping
• IT/OT Boundary Definition

1 week

• Boundary & definition research
• Ideate, iterate, align

1 Day

• Predefined template
• Utility centric boundary definition

Phase 2: Identify Dependencies

• IT/OT Application Heatmap
• Application Ownership

1-2 weeks

• Template creation
• Assign applications to ISA95

1 Day

• Example of converged applications

Phase 3: Develop IT DR and IT/OT BCP

• IT Disaster Recovery Plan
• IT/OT BCP

1-2 weeks

• Creation of BIA logic & scoring

1 Day

• Defined BIA logic and scoring for utility & workflow example

Phase 4: Sustain

• IT/OT Governance Structure

1-2 weeks

• Define governance best practice for IT/OT

1 Day

• Proposed governance groups and responsibilities

In March of 2025, Nova Scotia Power (NSP), submitted “IT-OT Cyber Security Control Implementation Phase 1” to the Utility and Review Board (UARB) for approval. In the plan, NSP acknowledges the increase in frequency and sophistication of cyber threats and also the importance in “securing NS Power’s OT environment responsible for controlling physical processes or operations.”

NSP had all the correct intentions of protecting their OT environment; however, as the Halifax Examiner wrote “the focus was almost entirely on OT…but customer information was not central to the plan’s concern.” Following the submission of the plan to UARB, NSP was a victim of a ransomware attack where 280,000 customers’ information – including names, SINs, phone numbers, addresses, and banking information – has been compromised. NSP has declined to meet the financial demands of the perpetrators.

The impacts of this breech are still unknown at the time of this publication: however, a few early indicators point to the following:

• NSP is offering a five-year free credit monitoring subscription to all current and past customers – estimated cost could be in the millions.
• NSP’s customer billing portal was taken offline for the first month after the attack was discovered, preventing customers from making payments. After the resumption of the billing portal, NSP resorted to usage estimation based on previous years.
• NSP’s reputation and customer satisfaction has plunged and the company could be the subject of a class-action lawsuit.

• Cybersecurity is an area where IT and OT convergence is critical and must be evaluated in concert between the two teams. Both IT and OT domains are equally as important and should be given the same attention.
• The billing process was exposed as a weakness from the attack. Each business process needs a robust plan to ensure normal business operations can resume efficiently.

On July 19, 2024, a routine update from CrowdStrike disrupted organizations globally across various sectors, including utilities. Deemed as one of the largest IT outages in history, it cost Fortune 500 companies $500 billion dollars in direct losses. The impact of the IT outages was widespread and cascaded into the OT environments of many organizations.

If an organization had CrowdStrike deployed, it would have been overseen by the IT organization. However, depending on the industry, this update on the IT domain created cascading effects on the OT domain. For example, rail systems faced signaling outages, and airlines such as Delta and United faced communication network disruptions, grounding flights worldwide. Luckily for utilities, impacts were isolated to the IT domain with reports of customer billing outages from City of Corpus Christi and unavailable outage information system from Avangrid.

• Unknown Dependencies Between IT and OT: The CrowdStrike update shined a light on the unknown interdependencies that exists between IT and OT systems across various industries. Building an effective BCP starts with understanding the dependencies between IT and OT systems and their points of failure. By doing so, organizations can access the potential impact of various failure scenarios.
• An Isolated BCP Will Increase Restoration Timelines: As seen in the impacts of the update, due to the interdependencies between IT and OT systems, having an isolated BCP will lead to reactive management during a crisis. Organizations must maintain operational flexibility and agility to switch to alternative systems or manual operations.

Call #1:
Scope requirements, objectives, and specific challenges.

Call #2:
Identify key IT/OT stakeholders as part of the BCP journey.

Define IT/OT definition and boundaries.

Call #3:
Highlight applications where convergence exists and assign IT and/or OT ownership.

Call #4:
Identify IT/OT processes impacted by IT/OT applications disruptions.

Call #5:
Complete BIA for converging applications/ capabilities.

Call #6:
Design recovery workflows and business continuity workarounds for identified applications and processes.

Call #7:
Define IT/OT governance structure and committees.

Level-Set & Align IT and OT Teams

Identify IT & OT Dependencies

Develop DRP and BCP for IT/OT Applications and Processes

IT/OT Governances

1.1 Identify IT & OT stakeholders

1.2 Define IT/OT definition & boundaries

2.1 Complete IT/OT application heatmap and assign ownership

2.2 Identify IT/OT business processes impacted by IT/OT technology

3.0 IT/OT business impact assessment alignment and development

3.1.1 Conduct business impact assessment for IT/OT applications

3.1.2 Document recovery workflows and RACI for each converged application

3.2.1 Conduct business impact assessment for IT/OT processes

3.1.2 Document workarounds and RACI for each IT/OT process

4.1.0 Define IT/OT governance structure and maintenance processes for BCM

4.2.0 Align back with broader organizational BCM strategy

1. IT&OT stakeholder map
2. IT & OT definition
3. IT & OT boundaries

1. IT&OT application inventory with high-level ownership
2. IT&OT business processes
3. Aligned Business Impact Assessment Tool

1. IT/OT application recovery workflows and documented RACI
2. IT/OT business continuity workarounds and documented RACI

1. IT/OT governance structure and BCM maintenance processes

1.1: Identify IT/OT stakeholder mapping

1.2: Establish IT/OT boundaries and align on definition

2.1 Complete IT/OT application boundary heatmap & ownership

2.2 Identify IT/OT business processes impacted by IT/OT technology

3.0 Define aligned Business Impact Assessment (BIA) Tool

3.1.1 Conduct BIA for IT/OT applications

3.1.2 Document IT/OT recovery workflows and assign RACI

3.2.1 Conduct BIA for IT/OT business processes

3.2.2 Document IT/OT workarounds and assign RACI

4.1 Define IT/OT governance structure

4.2 Establish IT/OT BCP maintenance routines