IT and OT: the difference, and why it matters in buildings

In conversations about smart buildings and cybersecurity, two abbreviations come up more and more often: IT and OT. They look alike, but they are about very different things. And it is precisely in buildings that they come together. In this article we explain what IT and OT are, what the difference is and why it matters for owners, facility managers and tenants.

What is IT?

IT stands for Information Technology. IT is about managing digital data, computers and networks. Think of:

• laptops, phones and servers;
• email, the cloud and programs such as Microsoft 365;
• the office network, the WiFi and the internet connection;
• storing and protecting files and data.

IT is all about information. The goal is that people can do their work, and that data is secure, correct and available.

What is OT?

OT stands for Operational Technology. OT is about the hardware and machines that control physical and industrial processes. In a factory, that is the production line. In a building, it is the installations:

• heating, cooling and ventilation, controlled by the building management system;
• lifts and escalators;
• access control, barriers and cameras;
• lighting and sun shading;
• meters, charging points and solar panels.

OT is all about the physical world. The goal is that the building keeps running safely and reliably.

The difference at a glance

The biggest difference is in what is at stake. With IT it is mainly about data. An outage is annoying, and a data breach can do a lot of damage. With OT it is about the physical world. If a climate system fails or an access system is taken over, people notice straight away. That is why safety and reliability come first in OT.

That leads to a few practical differences:

• Lifespan. A laptop lasts a few years. A climate installation or lift often lasts many years longer. As a result, OT often runs on older technology.
• Updates. IT gets updates often and automatically. With OT that happens rarely and in a planned way, because a restart can stop an installation. Devices therefore stay vulnerable for longer.
• Who manages it. IT usually belongs to the IT department or an IT partner. OT belongs to the installer or the facility manager. They often work separately.
• Language. OT systems in buildings speak their own protocols, such as BACnet and KNX. Older versions of these have little security. Secure variants now exist, such as BACnet Secure Connect and KNX Data Secure.

Why IT and OT come together in buildings

In the past, OT had its own, closed network. The climate system had nothing to do with the laptops. That has changed. In a Smart Building the installations are connected:

• the climate adapts to occupancy, measured by sensors;
• the installer logs in remotely to fix a fault;
• energy data goes to a dashboard in the cloud;
• the access pass also works for the printer and the meeting room.

That brings a lot: comfort, lower energy use and faster maintenance. But it also means OT is connected to the network, and sometimes to the internet. The national cyber security centres of the United Kingdom and Ireland warn that precisely this connection increases the risk. A weak spot in a simple sensor can become an entrance to more important systems.

How to keep IT and OT secure

1. Know what is connected to the network. Make a list of all OT devices: climate, access, cameras, lifts, meters. What you do not know, you cannot protect.
2. Separate the networks. Put OT in its own part of the network, separate from the tenants' laptops and from guests. This is called network segmentation. A firewall decides which traffic is allowed.
3. Arrange remote access. Only when needed, through one secure entrance, with a personal account per person.
4. Change default passwords and agree with suppliers who installs updates and how often.
5. Choose secure variants of protocols when you replace or extend installations.
6. Record who does what. IT and OT often have different managers. The IT Demarcation List makes clear who is responsible.

Read more practical tips in Cybersecurity in smart buildings: separate the networks.

What do the rules say?

The law also looks more and more at OT. The Dutch Cybersecurity Act, the Dutch implementation of the European NIS2 directive, has applied since 15 August 2026 to organisations in sectors such as energy, water and healthcare. OT is explicitly part of that. Tenants who fall under the act will therefore ask how the building's installations are secured. In addition, since 1 January 2026, large non-residential buildings in the Netherlands must have a building automation system. Read more on IT and regulation.

What does this mean for the IT-Label?

The IT-Label looks at the digital infrastructure of a building: the IT Building. That includes how the building systems are connected and protected. In Smart Building and Integration we assess whether the installations work together well, and whether that happens securely. Want to know how your building is doing? Take the free self-scan or request a pre-inspection. Buying a building? Then include IT and OT in your digital due diligence.

Sources

• NCSC Ireland: Securing Operational Technology, on the difference between IT and OT and the risks of connecting them.
• NCSC United Kingdom: Operational technologies.
• Dutch government: Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf vandaag van kracht (15 August 2026, in Dutch).
• A critical review of cyber-physical security for building automation systems, on the security of BACnet and KNX.