Independent DIB implementation resource — not affiliated with or endorsed by the U.S. Department of WarView the official DoW campaign ↗
Brilliant at the BasicsDIB Resource Center
OT-03OPERATIONAL TECHNOLOGYOFFICIAL INTENTEXPERT REVIEWED

Strict Network Segmentation

The single most valuable OT control is keeping the plant network separate from the business network. Strict segmentation uses zones and conduits, a controlled boundary (ideally a DMZ) between IT and OT, and default-deny rules so that a phished laptop in the office cannot pivot to a controller on the floor. Inside OT, further zoning contains a problem to one line or cell.

AUTHOR inDirectIT EditorialREVIEW STATUS SME review completeUPDATED 2026-07-21SOURCE CHECKED 2026-07-19
EXPLAINER · 5 SCENES · ≈40 SEC · CAPTIONS, NO AUDIO

OT-03 in 40 seconds

The problem, the plain-words meaning, three key moves, and what “done” looks like.

Official intent

What the campaign asks for

Strictly segment OT networks so a business-network compromise cannot reach production. The official source remains authoritative.

Read the official campaign ↗

Why it matters

Most OT incidents start in IT and cross a flat connection into production. A hard, well-defined boundary is what stops that pivot — and what keeps ransomware on the business side from halting operations. Zoning also limits how far any single OT compromise can spread once inside.

Coordinate before touching production

Introducing segmentation, firewalls, or new boundary rules can disrupt real-time OT traffic and safety functions. Design with the process owner, validate against production timing requirements, stage changes in maintenance windows, and keep a tested rollback. A control that improves security but risks a safety trip is not an improvement.

Minimum / Strong / Advanced

1
Minimum

The OT network is separated from the business network, with a controlled, documented boundary between them.

2
Strong

An IT/OT DMZ brokers all cross-boundary traffic under default-deny, and OT is divided into zones with conduits between them.

3
Advanced

Zones and conduits follow a recognized model (e.g., IEC 62443), cross-boundary traffic is monitored, and remote/vendor access lands only in controlled zones.

Implementation timeline

First 24 hours
  • Map every connection between the business and OT networks
  • Flag any direct, unfiltered IT-to-OT paths
Next 30 days
  • Define OT zones and the boundary architecture with the process owner
  • Close or broker the riskiest direct connections in a window
Next 60 days
  • Stand up or harden an IT/OT DMZ under default-deny
  • Route vendor and remote access into controlled zones only
By day 90
  • Add zones/conduits within OT for critical lines
  • Monitor and log all cross-boundary traffic

Implementation steps

  1. Map all connections between the business and OT networks, including forgotten and vendor links.
  2. Define zones (by line, cell, or criticality) and the conduits allowed between them, with the process owner.
  3. Establish a controlled IT/OT boundary — ideally a DMZ — that brokers all cross-boundary traffic under default-deny.
  4. Direct remote and vendor access into controlled zones rather than straight onto the OT network.
  5. Monitor and log traffic crossing the boundary and between zones so unexpected flows are visible.

Validation

  • From a business-network host, attempt to reach an OT controller directly — it must be blocked.
  • Confirm no undocumented direct path bypasses the IT/OT boundary.
  • Verify vendor/remote access terminates in a controlled zone, not the production network.

Evidence to retain

Governance

OT segmentation architecture and zone/conduit policy

Configuration

Boundary/DMZ and firewall rule exports enforcing default-deny

Operations

Logs of cross-boundary traffic and investigated anomalies

Validation

Segmentation test results showing blocked IT-to-OT access

Common failure modes

What looks done but is not

A firewall between IT and OT with an any-any rule, a forgotten engineering laptop bridging both networks, and vendor access that lands directly on the plant floor. A boundary with a hole in it is not segmentation.

Framework mappings

Independent mappings are aids, not authoritative equivalence or compliance determinations.

FrameworkRequirementRelationshipConfidence
NIST SP 800-82 Rev. 3Network segmentation / zonesDirectHigh
IEC 62443Zones & conduits (3-3)DirectHigh
NIST SP 800-1713.13.1SupportingModerate