Segmentation means splitting your network so that an office compromise cannot reach controllers directly. CISA's May 2025 mitigations recommend separating IT and OT networks, using a demilitarized zone, or DMZ, for passing control data to enterprise systems. The aim is to let data through without letting attackers through.
The basic picture
Think of three areas. The enterprise network holds email, business apps and laptops. The OT network holds controllers, HMIs and engineering stations. The DMZ sits between them and holds only the systems that need to exchange data, such as a historian that copies readings out to business users.
Traffic flows to the DMZ from each side, not straight across. That gives you a place to inspect, log and restrict.
Why it matters
In CISA's Ukraine alert, attackers used VPN access and remote tools to reach operator interfaces, and the alert recommends isolating ICS networks from untrusted networks and locking down unused ports and services. The 2023 PLC advisory also recommends segmenting networks, for example using the Purdue model, and restricting unused ports and protocols.
Segmentation does not stop every attack. It limits what an attacker can do after a first foothold, and buys time to detect them.
How NIST frames it
NIST SP 800-82 Rev. 3 lists typical OT topologies and countermeasures among its topics. Check the full document for how it describes architectures and zones, and match it to your own site.
A starting plan
- Map what talks to what. Capture flows, preferably passively, before changing anything.
- Define zones. Group assets with similar security needs, as in CISA's inventory guidance.
- Place a DMZ for the few systems that must bridge networks.
- Write allow rules for the flows you identified, and deny the rest.
- Control remote access through the DMZ, not around it.
- Test with operations in a planned window, because a missed flow can stop a process.
- Review quarterly, since flows drift.
Common mistakes
- A diagram that no longer matches reality, with an old modem or vendor link nobody removed.
- Rules that say "any to any" for a "temporary" project.
- Engineering laptops that move between networks, carrying anything they picked up.
- A DMZ host that has direct access to everything, which makes it a new bridge.
- Skipping logging, so nobody sees a blocked attempt.
Quick check
Is a firewall between IT and OT enough?
It is a start. CISA's guidance also asks for a DMZ for data exchange, strong remote access controls and monitoring.
What is the Purdue model?
A reference model that arranges industrial networks in levels. The 2023 PLC advisory names it as one way to segment networks.
Safeguard's policies, gates and guardrails apply to software delivery pipelines rather than plant networks, so they complement segmentation but do not replace it.
Sources
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA, IR-ALERT-H-16-056-01
- CISA et al., AA23-335A
- NIST, SP 800-82 Rev. 3
Last reviewed: 19 October 2026.
