In regulated industrial environments, OT security cannot be owned solely by IT or operations. IT typically leads network, identity, and corporate security controls, while operations owns process safety, availability, and change control on the shop floor. Clear RACI, joint governance, and alignment with standards like IEC 62443 are essential. Exact responsibility splits depend on plant maturity, legacy systems, and vendor constraints, and must be documented, validated, and maintained under change control.