The SANS ICS Five Critical Controls: incident response, architecture, monitoring, remote access, vulnerability management. Pretty familiar to technology folks, but much more challenging in live production.
Isolating the wrong host can stop a line or create a safety problem. Segmentation means a new network that rarely gets a maintenance window or carving it up like swiss cheese for vendor support. Monitoring has to be passive and protocol-aware, because the active scanning we take for granted in IT can knock over a PLC. Secure remote access means tracking down every integrator and OEM who has had a standing VPN for a decade. Vulnerability management means accepting that some assets will never be patched, so you prioritize by what the process can survive.
They’re easy to say, but hard to do.