How would you handle decommissioning of OT devices to prevent introducing new risk?

How would you handle decommissioning of OT devices to prevent introducing new risk?

• A. Document disposal but skip secure data erasure to save time.
• B. Remove devices from production, securely erase data, document disposal, ensure remaining systems maintain integrity and compatibility.
• C. Decommission by unplugging only.
• D. Keep decommissioned devices connected for audit.

Answer: (B)

When decommissioning OT devices, the goal is to remove risk by treating the asset as a controllable, traceable event in the security lifecycle. The best approach is to securely erase all data and credentials on the device, remove it from production so it can no longer influence live systems, document the disposal and the steps taken, and verify that the rest of the environment remains intact and interoperable. Secure data erasure is essential because OT devices often store configuration, credentials, and control logic. If this information isn’t wiped, the device could be repurposed or accessed maliciously, creating new vulnerabilities. Removing the device from production prevents any chance it can interfere with ongoing operations or be reconnected into the network. Documentation provides an auditable record for governance, compliance, and future asset tracking. Finally, ensuring the remaining systems maintain integrity and compatibility means checking that network topology, access controls, and control loops continue to function as intended after the decommissioning, and updating inventories and configurations accordingly. Other approaches fall short because skipping secure erasure leaves sensitive data at risk, unplugging alone doesn’t guarantee data removal or safe disconnection from all networks, and keeping decommissioned devices connected or untracked creates opportunities for tampering, reuse, or data leakage and undermines the security of the OT environment.

When decommissioning OT devices, the goal is to remove risk by treating the asset as a controllable, traceable event in the security lifecycle. The best approach is to securely erase all data and credentials on the device, remove it from production so it can no longer influence live systems, document the disposal and the steps taken, and verify that the rest of the environment remains intact and interoperable.

Secure data erasure is essential because OT devices often store configuration, credentials, and control logic. If this information isn’t wiped, the device could be repurposed or accessed maliciously, creating new vulnerabilities. Removing the device from production prevents any chance it can interfere with ongoing operations or be reconnected into the network. Documentation provides an auditable record for governance, compliance, and future asset tracking. Finally, ensuring the remaining systems maintain integrity and compatibility means checking that network topology, access controls, and control loops continue to function as intended after the decommissioning, and updating inventories and configurations accordingly.

Other approaches fall short because skipping secure erasure leaves sensitive data at risk, unplugging alone doesn’t guarantee data removal or safe disconnection from all networks, and keeping decommissioned devices connected or untracked creates opportunities for tampering, reuse, or data leakage and undermines the security of the OT environment.