Information Security Does Not Stop at the IT Boundary

A cyberattack on refrigeration systems in French supermarkets demonstrated in October 2026 how quickly a digital security problem can create physical and economic consequences.

Attackers gained access to the remote controls of refrigeration and freezer systems. Reports indicate that temperatures and defrost cycles were manipulated. Food spoiled, equipment became unavailable and some stores reported further physical damage. According to the French government, around 700 supermarkets were affected.

France’s national cybersecurity agency, CERT-FR, confirmed numerous compromises involving several types of control system. It warned specifically against exposing administrative interfaces directly to the internet and recommended allowing remote access only through secure networks or VPN connections.

The incident is more than an unusual cybersecurity story. It exposes a fundamental problem: many organisations still think about information security primarily within the boundaries of traditional IT.

Business processes do not respect that boundary.

A cyber incident with physical consequences

Refrigeration systems in a supermarket may not look like a typical target for a cyberattack. They do not hold large volumes of sensitive customer data, and they would not normally be considered part of the data centre or the conventional workplace environment.

They are nevertheless essential to the business.

If they fail or are manipulated, the consequences are immediate:

Fresh and frozen goods can no longer be sold.
Food has to be destroyed.
Parts of a store, or an entire location, may become temporarily unavailable.
Supply and replenishment processes are disrupted.
Physical damage and safety risks can emerge.
Customer trust and reputation can suffer.

A compromised technical controller therefore becomes a business continuity event.

This is the wider significance of the incident. A system does not need to be a conventional IT application to matter to information security and organisational resilience.

Information security is broader than IT security

In many organisations, information security is still closely associated with protecting computers, networks, identities, cloud platforms and databases.

Those systems are undoubtedly important. They represent only part of a modern organisation’s digital dependencies.

Operational processes are also increasingly controlled or monitored by connected technology. Examples include:

production equipment and industrial control systems;
energy and utility systems;
logistics and warehouse systems;
building automation;
access control and physical security technology;
heating, ventilation and refrigeration systems;
medical and laboratory equipment;
sensors and connected operational assets; and
external maintenance and management platforms.

These systems are commonly grouped under the term operational technology, or OT.

From an information security perspective, however, the decisive question is not whether a system sits within IT, production, facilities management or an external provider. What matters is which systems a critical business process depends on and what would happen if they failed or were manipulated.

The technical category of a system does not determine its relevance to the business.

Information security must therefore account for all digital and information-processing dependencies of a business process, regardless of where those systems are operated within the organisation.

OT is different — but it cannot be considered in isolation

An integrated view does not mean that OT systems can be treated in the same way as traditional IT systems.

OT operates under distinct technical and operational constraints.

Many components have lifecycles of ten, twenty or more years. Updates may only be possible during defined maintenance windows. Some systems cannot be interrupted or actively scanned while operations are running. Others rely on proprietary protocols, specialised hardware or software versions that are no longer supported by the manufacturer.

Where confidentiality and integrity often dominate discussions in conventional IT, process availability and, in some environments, physical safety have particular importance in OT.

An update deployed without sufficient operational care can interrupt a production process. Aggressive vulnerability scanning can affect older equipment. A component that has run reliably for years may simultaneously contain known security weaknesses for which no patch is available.

OT security therefore requires specialised controls, experienced practitioners and a deep understanding of the process being protected.

Those differences do not justify entirely separate governance.

OT security requires specialised controls, but it must not operate outside the organisation’s information security, risk management and resilience model.

The distinction between IT and OT can make technical and organisational sense. It becomes dangerous when dependencies, risks and responsibilities are no longer considered together.

The gap in risk management

Effective cyber risk management does not begin with a list of vulnerabilities. It begins with an understanding of business processes and their dependencies.

That understanding is often incomplete for OT.

Equipment may be purchased by an operational function. Maintenance may be performed by an external provider. Remote access may be configured by the manufacturer. Network connections accumulate over many years. Individual components reach the end of support but remain in use because replacement would be expensive or operationally difficult.

Each decision may be understandable in isolation. Together, they create a risk landscape that no one fully sees.

An integrated approach to risk management should therefore be able to answer questions such as:

Which business-critical processes depend on OT systems?
Which operational assets are connected directly or indirectly to other networks?
Which systems can be reached from the internet?
Which external providers have remote access?
How is that access authenticated, logged and regularly reviewed?
Which components are no longer supported by their manufacturers?
Which known risks have been accepted, and which compensating controls are in place?
How would manipulation affect operations, safety, supply capability or customers?
Where do dependencies on individual manufacturers, providers or spare parts exist?

It is not enough to record a technical risk such as an “outdated controller” in a register.

The risk must be translated into its potential business effect.

An outdated, internet-reachable controller might create a scenario in which a critical process is manipulated, goods are lost, a site becomes unavailable or the safe restoration of operations takes several days.

Only this connection enables a meaningful assessment of risk.

Why OT security is a business continuity concern

Security controls are intended to prevent incidents or reduce their likelihood. They cannot eliminate disruption entirely.

OT security is therefore inseparable from business continuity management.

An organisation must understand not only how to protect an asset, but also how the affected business process can continue or recover if that protection fails.

That raises different questions from the recovery of an ordinary IT system:

Can the process continue safely in a manual mode?
Can equipment be operated locally if external connections are disabled?
Are current and verified configurations available?
Can controllers be reset and rebuilt reliably after a compromise?
How will the organisation determine that an asset is safe to operate again?
Are replacement devices and compatible components available at short notice?
Are internal specialists and external experts available outside normal working hours?
Is a technical or safety review required before operations resume?
How long does a controlled restart actually take?
What are the consequences for customers, suppliers and other locations during that time?

Traditional measures such as recovery time objective and recovery point objective remain important, but they may not capture all the characteristics of a physical process.

In OT, spare-part availability, equipment condition, calibration, safety checks, manufacturer support and restart sequencing may all be decisive.

A backup of a configuration is not, by itself, a credible recovery plan.

Business impact analysis must connect digital and physical dependencies

A business impact analysis should not end with applications and databases.

The operational systems supporting every critical business process must also be considered:

Which process is essential to the organisation?
Which IT, OT and provider dependencies support it?
Which disruptions could interrupt or manipulate it?
How would the impact develop over time?
Which temporary operating measures are possible?
Which resources are required for recovery?
How has the restart been tested in practice?

The attack on French refrigeration systems illustrates this chain clearly. A remotely accessible controller is manipulated, refrigeration fails, the cold chain is interrupted, and goods are lost while operations are disrupted. What initially looks like a technical misconfiguration or inadequately protected remote maintenance connection quickly develops into an operational and financial problem.

Integration does not mean centralisation

Including OT within information security does not necessarily mean placing every system and decision under a single central function.

Operations understands the equipment and the process. Business functions understand operational requirements. Facilities management runs specialised building technology. Manufacturers and providers hold product expertise. InfoSec contributes methods for cyber risk, security architecture, access protection and incident response. BCM considers impact, temporary operating modes and recovery.

None of these perspectives is sufficient on its own.

What is needed is not an organisational power shift, but a shared model of risks and dependencies.

That model can include:

a coordinated inventory of critical IT and OT components;
mapping those components to the business processes they support;
joint risk and business impact assessments;
secure and regularly reviewed remote maintenance access;
controlled network connections and segmentation;
credible lifecycle and end-of-life management;
protected and tested equipment configurations;
coordinated incident response and recovery plans;
joint exercises involving operations, InfoSec, BCM and crisis management; and
clear escalation paths for technical and operational anomalies.

The interfaces between functions deserve particular attention. This is where blind spots often emerge: an external connection that IT does not know about; an unsupported controller whose replacement has been deferred for operational reasons; a dependency missing from the business impact analysis; or a recovery plan that has never been tested under realistic conditions.

Five questions for your organisation

The incident in France is an opportunity to examine the same dependencies closer to home.

1. Do we know every operational system that can be reached digitally?

This includes building automation, heating and refrigeration, energy supply, access controls and specialised controllers.

2. Do we know which business processes depend on them?

A complete asset inventory is useful. The crucial connection, however, is the one between the asset, the process and the potential business impact.

3. Is external maintenance access adequately protected?

Remote maintenance may be operationally necessary. Direct and uncontrolled exposure to the internet should be avoided. Access requires secure connections, strong authentication, logging and regular review.

4. Are OT scenarios part of risk management and BCM?

A cyber exercise should not focus only on the loss of email, identities or central IT applications. Manipulation or unavailability of physical processes also belongs in realistic scenarios.

5. Have we actually tested the restart?

Documented procedures matter. Only an exercise demonstrates whether configurations, spare parts, contacts, communication paths and technical expertise will really be available during an incident.

The distinction between IT and OT will remain necessary. The two domains involve different technologies, operating models and security requirements.

Those differences must not place OT outside the organisation’s broader view of information security.

Cyber risk does not follow an organisational chart. An attacker does not care whether a system belongs to IT, operations, facilities management or a service provider. What matters is whether it is reachable, vulnerable and relevant to the business.

Information security must therefore begin wherever digital dependencies emerge — and not end where traditional IT stops.

The boundary between IT and OT remains relevant to technology and operations. It must not define the boundary of information security, risk management or business continuity.