How can IT and OT be aligned in cyber-physical security?