Defense in depth in OT security comprises which three domains?

• A. Policy, law, enforcement.
• B. Hardware, software, and firmware.
• C. Network, application, data.
• D. People, process, and technology.

Answer: (D)

Defense in depth in OT security hinges on three interacting domains: People, Process, and Technology. People cover training, awareness, secure behaviors, and access control so individuals don’t become the weak link. Process encompasses the policies, procedures, change management, and incident response steps that govern how security is implemented and maintained. Technology includes the actual protective controls and systems—like segmentation, monitoring, authentication, and secure configurations—that enforce those policies and guide responses. When all three domains are addressed together, a weakness in one area can be mitigated by controls in the others, creating layered defenses that are more resilient in an OT environment. The other options describe governance, pure components, or protection targets rather than the unified three-domain approach of defense in depth.