For operational technology (OT) and non-traditional devices, downtime must be avoided. CAS-005 recommends passive monitoring and proactive response for environments where active scanning or changes could disrupt operations. Observing the environment continuously and acting on malicious indicators allows security without interrupting critical manufacturing processes.
Honeypots (A) are good for research but don't provide full facility monitoring.
Behavioral analysis (B) is reactive without proactive measures.
Patching (C) is important but could cause downtime and may be limited in OT environments.