# What is a compensating control for legacy OT systems?

It is a measure that reduces a risk you cannot remove at its source. When a controller cannot be patched, has no password or runs an unsupported system, you protect it from outside instead: segmentation and firewall rules so that only named hosts can reach it, no internet access, a controlled remote-access path, locked cabinets, offline backups of programs and configurations, and monitoring that tells you when the protection is bypassed. Auditors working with IEC 62443 or NIS2 risk management generally expect such controls to be documented: which risk, which measure, who owns it and how you check that it still works. Monitoring is the part that produces that checking evidence. NetSenX can provide it: from a SPAN or TAP port it shows who talks to the legacy system and, from the Pro plan, raises OT alerts for unauthorised writes, traffic crossing plant network levels, off-hours activity and S7comm commands.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/what-is-a-compensating-control-for-legacy-ot-systems

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [How do I build an OT asset inventory without active scanning?](https://netsenx.com/en/faq/how-to-build-an-ot-asset-inventory-without-active-scanning)
- [Which OT devices does passive monitoring miss?](https://netsenx.com/en/faq/which-ot-devices-does-passive-monitoring-miss)
- [How many sensors do we need to monitor three factories?](https://netsenx.com/en/faq/how-many-sensors-do-we-need-for-several-plants)
- [Can we monitor OT with open-source tools on a small budget?](https://netsenx.com/en/faq/can-i-monitor-ot-with-open-source-tools-on-a-budget)
- [What is IEC 62443, and do we need it?](https://netsenx.com/en/faq/what-is-iec-62443-and-do-we-need-it)