Certified: The CompTIA SecOT+ Audio Course

In this episode, we’re going to step into a reality that surprises a lot of people coming from regular computer security: in operational technology, safety is not a poster on the wall, it is a daily discipline that can decide whether someone goes home uninjured. OT environments can include moving machinery, high voltage, pressurized systems, chemicals, heat, noise, confined spaces, and heavy equipment, and that means the stakes are different than sitting at a desk troubleshooting a laptop. Security work in these environments still matters, but it must be done in a way that respects the physical hazards around you and the people operating the process. A beginner sometimes imagines that cyber risk and physical risk are separate, yet in OT they are tangled together, because a change to a system can affect a machine, and a machine can hurt someone. This lesson is about understanding hazards, using personal protective equipment correctly, and taking lockout and tagout seriously as a control that prevents dangerous energy from hurting people. When you learn to see safety as part of the environment, you start thinking like someone who belongs on the site, not like a visitor who only sees cables and screens.

Before we continue, a quick note: this audio course is a companion to our course companion books. The first book is about the exam and provides detailed information on how to pass it best. The second book is a Kindle-only eBook that contains 1,000 flashcards that can be used on your mobile device or Kindle. Check them both out at Cyber Author dot me, in the Bare Metal Study Guides Series.

A hazard is anything that can cause harm, and in OT job sites hazards come in more categories than most beginners expect. There are obvious hazards, like rotating shafts, pinch points, forklifts, and exposed electrical panels, but there are also less obvious ones, like stored energy in springs, hydraulic pressure, pneumatic pressure, or residual heat in a line that looks quiet. Chemical hazards may include corrosive materials, toxic vapors, and flammable liquids, and even if you are not working directly with chemicals, you might be in areas where they are present. Environmental hazards can include slippery floors, poor lighting, extreme temperatures, or loud noise that makes communication difficult. There are also procedural hazards, where the danger comes from a mismatch between what people believe is happening and what the system is actually doing. For example, if a machine is expected to be off, but an automatic start condition exists, a worker can be caught off guard. A good beginner mindset is to assume that hazards can be hidden, and that safety rules are designed to handle hidden hazards, not just the ones you can see.

Understanding hazards is not only about naming them, it is about recognizing how they behave and how they interact with human behavior. Many injuries happen when people become comfortable and start taking shortcuts, especially in familiar areas or during routine tasks. OT environments often run continuously, which means work is done around active processes, and that increases the temptation to do quick adjustments without fully stopping equipment. Another factor is that multiple teams may be present, such as operators, maintenance, contractors, and engineers, and each group may have different assumptions about what is safe and what is allowed. That is why safety culture matters, because a culture is what people do when nobody is watching, not what a policy says. For security learners, this is important because you might be the new person on site, and you cannot rely on your instincts alone to spot dangers. You need to learn to look for hazard signs, respect barriers, ask questions, and follow the site’s established procedures even if you feel like you are slowing things down. In OT, slowing down is often how you keep people safe.

Personal protective equipment, or PPE, exists because even with good procedures, hazards can still reach you. PPE does not replace safe behavior, and it does not make an unsafe situation safe, but it reduces the harm if something goes wrong. Depending on the site, PPE can include hard hats, safety glasses, hearing protection, gloves, flame-resistant clothing, steel-toe boots, face shields, and respiratory protection. The beginner mistake is treating PPE like a uniform you wear the same way everywhere, but PPE must match the hazard. For example, gloves that protect against cuts may not protect against chemicals, and gloves that protect against chemicals may reduce grip, which can create a different risk. Hearing protection is important in loud environments, but it can also reduce your ability to hear alarms or shouted warnings, so communication practices matter. Eye protection is often required because even small particles can cause serious injury, and eye injuries can happen faster than you can react. A mature safety mindset treats PPE as part of a system of controls, not as a personal preference.

PPE also has to be used correctly, which sounds obvious until you realize how many ways people use it incorrectly when they are rushing. Safety glasses on the top of your head are not protecting your eyes, and a face shield without safety glasses may still leave your eyes exposed from certain angles. A respirator that does not seal properly can create a false sense of protection, which can be more dangerous than knowing you are unprotected. Some PPE must be inspected before use, because cracks, wear, or contamination can reduce protection. Another detail is that PPE can create its own risks, such as reduced dexterity, reduced visibility, heat stress, or fatigue, so you must stay aware of how it affects your body. In an OT environment, fatigue matters because it makes mistakes more likely, and mistakes around machinery can be severe. If you are new, the safest approach is to follow the site’s PPE requirements without trying to negotiate them. You can ask questions to understand why a requirement exists, but you should never treat safety requirements as optional or based on comfort.

A useful way to think about safety controls is a layered approach, where PPE is one layer, but not the first layer. In many safety programs, the goal is to eliminate the hazard if possible, substitute a safer method, engineer barriers, use administrative controls like procedures and training, and then use PPE as a last layer. You do not need to memorize this as a formal model to benefit from it, but the logic matters. If a machine is running and there is a risk of entanglement, the best control is not better gloves, it is preventing access to the hazard through guards and lockout procedures. Administrative controls like signs and rules help, but signs do not physically stop a machine from moving. PPE helps if a minor exposure occurs, but it cannot reliably stop severe injury from a powerful machine. In OT security, this layered thinking also connects to cyber controls, because you want multiple protections rather than one fragile protection. Safety teaches you that relying on one layer is risky, and that principle carries into security decisions, too.

Now we can move into lockout and tagout, often called Lockout/Tagout (L O T O), which is one of the most important safety practices in industrial environments. The core idea is simple: before someone works on equipment, you must control hazardous energy so the equipment cannot start unexpectedly. Hazardous energy includes electricity, but it also includes mechanical motion, hydraulic pressure, pneumatic pressure, gravity, heat, and chemical energy. Lockout means using a physical lock to hold an energy-isolating device in a safe position, and tagout means attaching a clear warning tag that communicates who placed it and why. The lock is the physical control that prevents operation, and the tag is the communication that prevents confusion and signals responsibility. The beginner mistake is thinking L O T O is just about flipping a switch, but real systems may have multiple energy sources, multiple isolation points, and stored energy that must be released. Doing L O T O right is about respecting the complexity of energy, not just the presence of a control panel.

A correct L O T O process usually begins with preparation and identification, which means you understand exactly what equipment is involved and what energy sources feed it. That might include power feeds, control circuits, compressed air lines, hydraulic lines, and any potential stored energy like capacitors or pressurized reservoirs. Then the equipment is shut down using normal procedures, because that reduces the risk of damage and ensures a predictable transition. After shutdown, the energy sources are isolated, meaning the devices that control energy flow are placed in the off or safe position. Locks are then applied so those devices cannot be moved back to an unsafe state, and tags are attached so everyone knows the system is under control and who is responsible. Stored energy is then released or restrained, such as bleeding pressure, discharging capacitors, blocking movement, or allowing hot surfaces to cool. Finally, there is verification, often called a try step, where you confirm the equipment cannot start and that energy is truly controlled. That verification is not a formality; it is where people catch mistakes before they become injuries.

Verification is especially important because OT systems can have surprising behaviors. A machine may have an automatic restart feature after a power dip, or a control system may try to restore a prior state when it comes back online. There may be interlocks, bypasses, or manual overrides that affect what happens when someone presses a start control. In some cases, a system might have enough stored energy to move even after power is removed, like a heavy part that can drop due to gravity or a pressurized line that can release suddenly. The point of verification is to test your assumptions safely, because assumptions are often where people get hurt. Another reason verification matters is that multiple people can be involved, and you need a common reality, not multiple personal guesses. When you think about L O T O, think of it as a structured way to reduce uncertainty in a dangerous environment. In cybersecurity, reducing uncertainty is also valuable, but in safety, uncertainty can cause immediate harm.

Tags deserve special attention because they are communication tools, and poor communication is a common root cause of incidents. A tag should clearly indicate that equipment must not be operated and should identify the person responsible, often including contact information and the reason for the lock. This matters because OT sites can have shift changes, multiple contractors, and complex work schedules, and equipment may be touched by many hands. If a tag is unclear, someone might assume the lock is old, forgotten, or unrelated to their work, and that assumption can lead to a dangerous action. Another danger is when people treat tags as decorations, leaving them on without accurate meaning, which teaches others to ignore them. In well-run sites, removing a lock or tag has strict rules, because removing it changes the safety state of the system. A beginner should understand that you do not remove someone else’s lock, and you do not bypass a lock because it is inconvenient. In safety culture, respect for locks and tags is respect for the people who may be relying on them to survive.

L O T O also intersects with security work in subtle but important ways. For example, a security task might involve inspecting a controller cabinet, tracing a network connection, or observing a device in a panel, and a beginner might think that since they are not touching the machine, L O T O is not relevant. But opening panels can expose you to electrical hazards, and touching cables can cause unexpected movement if it interferes with signals, so site rules still apply. Also, OT systems can be sensitive, and changes, even accidental ones, can affect operations, so coordination with operations and maintenance matters. The safest approach is to treat your presence as part of the work activity, not as an exception to it. If a task requires entering a hazardous area or opening a cabinet, follow the site’s safety procedures, including permits and isolation requirements. This is not about being afraid; it is about being professional in an environment that has physical consequences. A security person who respects safety earns trust quickly, and trust is essential in OT.

Common misconceptions about jobsite safety often sound reasonable until you consider real conditions. One misconception is that safety rules are mainly for people doing mechanical work, and that people working with computers or networks are naturally safe. In OT, the environment does not care what your job title is, because hazards are tied to location and activity, not to your role. Another misconception is that PPE is enough, but PPE is not designed to protect you from all hazards, especially high-energy hazards like entanglement or arc flash. Another misconception is that if equipment looks off, it is safe, but many systems can move or energize due to stored energy, remote control signals, or automated logic. There is also the misconception that safety slows progress, but in reality, safety prevents catastrophic delays, injuries, investigations, and loss of trust. When you view safety as a way to reduce chaos, it becomes easier to follow procedures without resentment. Beginners should treat every site as different, but every site will have rules that exist because someone learned a hard lesson in the past.

A practical way to connect hazards, PPE, and L O T O is to think in terms of what can harm you, what reduces exposure, and what prevents the hazard from acting in the first place. Hazards describe the possible harm, PPE reduces the impact if exposure occurs, and L O T O prevents hazardous energy from reaching you while you are working. These elements also connect through planning, because good planning identifies hazards early, chooses the right protective measures, and coordinates with the right people. In OT, coordination is critical because work often affects multiple systems and multiple teams, and misalignment creates risk. If an operator believes a machine will remain running, but a maintenance team believes it will be isolated, someone is going to be surprised, and surprises are dangerous. That is why safety discussions often include briefings, permits, and clear roles, even before a single tool is picked up. For your exam mindset, remember that safety is not a side topic; it is a primary constraint that shapes what actions are acceptable. The correct choice is often the one that protects people first while still respecting operational needs.

As you move deeper into SecOT+ topics, you will repeatedly see that OT security decisions are not made in a vacuum, because physical processes and human safety are part of the system. Jobsite safety gives you a foundation for thinking responsibly in that environment, starting with recognizing hazards, using PPE as required, and treating Lockout/Tagout (L O T O) as a non-negotiable practice that controls hazardous energy. When you understand why hazards can be hidden, you become less likely to assume a space is safe just because it looks quiet. When you understand PPE as a hazard-matched layer, you stop treating it as a costume and start treating it as part of risk reduction. When you understand L O T O as a structured method for preventing unexpected energization, you respect locks and tags as life-protecting controls, not paperwork. All of that makes you a safer person on site and a more credible security learner, because credibility in OT starts with respecting the reality operators live in every day. Carry that respect forward, because everything else you learn will work better when it sits on top of a safety-first mindset.