// OF-02 · Segment

OT network segmentation and secure remote access for vendors.

Zones and conduits aligned with IEC 62443, and remote access where each vendor reaches only what it needs, with identity, approval and logging. Designed to be rolled out in phases without unplanned downtime.

The problem

A flat OT network means an infected office laptop can reach a PLC. A VPN shared by several vendors means nobody knows who got in, when, or what they changed.

In many plants these are the two risks with the highest impact and the most direct fix. The hard part is not the theory: it is segmenting a network that has to keep producing.

Segmentation: zones and conduits

Zones defined by function and criticality: corporate network, industrial DMZ, operations, production cells and safety systems.
Documented conduits: every permitted flow between zones, with protocol, source, destination and justification.
Target security levels (SL-T) per zone, following IEC 62443-3-2 and 3-3, sized to the plant.
Firewall rules between IT, the industrial DMZ and cells, with shared services (AD, historian, updates) placed in the right zone.
Realistic implementation options with existing equipment: VLANs, ACLs, industrial or next-generation firewalls.

Secure remote access for vendors

No more shared VPNs or ports open to the internet.
Identity-based access with strong authentication and approval per request or per maintenance window.
Access only to the equipment needed, through ZTNA, jump hosts in the industrial DMZ, or both.
Session recording and a log of who accessed what, and for how long.
A short written procedure to request, approve and revoke access.

Migration plan without downtime

A target architecture is only worth something if it can be implemented. The design therefore includes a phased plan: observe real flows first, then apply rules in monitor mode, and only then block, cell by cell, during maintenance windows.

What you get

Target architecture with zones, conduits and security levels, in an editable format.
Matrix of permitted flows between zones.
Vendor remote-access design and approval procedure.
Phased migration plan with risks and rollback points.
A technical specification you can use for requests for proposal to integrators or vendors.

Frequently asked questions

Do we need an assessment first?

It helps a lot, because segmentation starts from real flows. If a reliable inventory already exists we can start with the design. Otherwise we propose a short assessment as phase one.

Do you recommend a ZTNA or firewall vendor?

We have no vendor agreements. We define requirements and compare options based on what is already on site, the budget and your team's ability to run the solution.

Does segmentation mean replacing equipment?

Not always. Many plants reach a first level of segmentation with VLANs, ACLs and a firewall at the IT/OT boundary. The plan separates what is possible now from what needs investment.

What does aligning with IEC 62443 mean?

Using the standard's zones and conduits model and security levels as the design reference. It is not a certification; it is a common language with integrators, vendors and auditors.

Last updated: November 2026.