Segment an OT network by mapping data flows, grouping assets into levels or zones by function and trust, placing a DMZ between IT and OT, and allowing only the connections each zone needs. NIST SP 800-82r3 recommends this while weighing performance, reliability and safety.
What makes OT different from IT?
NIST SP 800-82r3 covers operational technology, which it describes as programmable systems and devices that interact with the physical environment or manage devices that do. Examples include industrial control systems, building automation, transportation systems and physical access control. The guide stresses unique performance, reliability and safety requirements.
That changes the tradeoffs. In IT you can often patch and reboot. In OT a pause may stop a process or create a safety hazard. Segmentation is attractive because it protects devices you cannot easily patch.
What does NIST recommend for network architecture?
The guide says a good practice is to characterize, segment and isolate IT and OT devices. Devices may be segmented by management authority, level of trust, functional criticality, data flow or location. It suggests organizing segmentation using an industry recognized model, such as the Purdue model, ISA-95 levels, the three tier IIoT architecture, or a combination.
It also suggests considering a DMZ as an enforcement boundary between segments. Using levels, tiers or zones lets organizations control access to sensitive components while also considering operational performance and safety.
How do the rules work?
NIST says organizations typically use mapped data flows to identify required communications. Those requirements go into the network architecture and the policy engines of network devices, which then monitor communication between segments and permit only authorized flows. Switches, routers, firewalls and unidirectional gateways, also called data diodes, can all enforce this.
Firewalls are commonly used and typically constitute the primary mechanism for protecting OT devices. The guide's rule is specific: firewall rule sets should permit connections only between adjacent levels, tiers or zones. In a Purdue style design, level 4 devices should not communicate directly with level 2, 1 or 0 devices.
What are the limits?
NIST is candid that boundary devices between zones do not mitigate lateral movement risk within a zone, and that traditional perimeters are less defined as wireless, cellular and cloud connections grow. It discusses applying zero trust principles to OT as an enhancement, not a replacement.
The guide also advises considering how zone and isolation configuration affect day to day operations, safety and response capabilities. A design that is secure but blocks an operator during an emergency is a bad design.
A constructed example
A water treatment plant has a corporate office network, a historian server and controllers for pumps and valves. The team maps flows and finds that the office network connects directly to the historian and the historian to controllers, plus one vendor remote access path that bypasses both. They place the historian in a DMZ, allow the corporate network to reach only the DMZ, allow the DMZ to reach the control zone on specific ports, and route vendor access through the DMZ with authentication and logging. Operators test each change during a planned window.
How to check or apply this
- Inventory OT assets and their owners, and record each device's function.
- Map actual data flows, including vendor and remote maintenance paths.
- Choose a reference model, such as Purdue levels, and assign assets to zones.
- Place a DMZ between IT and OT for shared services and data exchange.
- Write firewall rules that allow adjacent zone flows only, default deny otherwise.
- Test changes in a maintenance window with operations staff present.
- Monitor traffic between zones and alert on new flows.
- Review rules regularly and consider zero trust measures inside zones.
Quick check
Is a firewall enough for OT security?
No. NIST says boundary devices do not address lateral movement within a zone, so you also need monitoring, access control and device hardening.
Who should approve segmentation changes?
Operations and engineering staff must be involved, because a rule that blocks a legitimate flow can affect safety and availability.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- NIST SP 800-82r3 full text (PDF)
Last reviewed: 18 October 2026.
