Data Governance Policy (Operational Technology)

Document 1 of [number of documents in suite] · One-time £20 for the full suite

1. Purpose

This policy establishes governance for operational technology (OT) data at [Company Name], covering process data, historians, MES and SCADA systems.

2. Scope

Applies to all OT zones and conduits as defined in the [Company Name] IEC 62443 zone & conduit diagram, and to all process, alarm, event and historian data generated therein.

3. Governance roles

OT Data Owner: [OT Data Owner / Operations Director].

OT Data Steward: [Data Steward].

OT Cybersecurity Lead: [OT Security Lead].

OT Custodians: the [Control Systems Engineering Team].

4. Principles

Safety overrides confidentiality; integrity overrides availability where they conflict.

OT data is classified separately from IT data.

OT/IT data flows are explicit, one-way where feasible, and monitored.

Historian data is the single source of truth for process records.

5. Classification

OT data is classified as: Safety-Critical, Process-Confidential, Operational, or General Engineering. Handling rules per class are set out in the OT Data Classification & Handling Standard.

6. OT/IT interface

Data flows from OT to IT pass through the OT DMZ. Where feasible, one-way data diodes are used. Reverse flows (e.g. setpoint changes from IT-hosted MES) require explicit risk assessment.

7. Historian integrity

Historian configurations are version-controlled. Tag changes follow an Engineering Management of Change process with dual approval. Historical data is retained per the Historian Retention & Integrity Standard.

8. Alignment with safety case

This policy operates within the [Company Name] safety case and does not override operational instructions issued by [Operations Director] during plant emergencies.

9. Review

Reviewed at least annually and after any significant OT architecture change.

Approved by: [Company Owner] Effective date: [Effective Date] Next review: [Review Date]