To segment IT and OT, put a demilitarised zone between them, group OT assets into zones, define the conduits that may connect zones, and deny everything else by default. Route any needed IT to OT traffic through a monitored intermediary such as a firewall, bastion host or jump box.
Why agencies keep saying it
CISA's ransomware advisory on DarkSide recommends strong segmentation between IT and OT, a DMZ that eliminates unregulated communication, logical zones with defined conduits, and a ban on ICS protocols crossing the IT network. The May 2025 primary mitigations list repeats it: segment critical systems and use a DMZ to pass control data to enterprise systems.
Zones and conduits
The terms come from ISA/IEC 62443. A zone is a group of assets that share security requirements. A conduit is the controlled path between zones. CISA's inventory guidance tells owners to classify assets into zones and conduits as part of their taxonomy, which is why inventory and segmentation are one project, not two.
A workable layout
- Enterprise IT network.
- DMZ holding the systems that exchange data with both sides, such as a historian replica or patch staging server.
- Operations zone with SCADA servers and engineering workstations.
- Control zones with PLCs and HMIs, split by process area where you can.
Nothing in the enterprise network should talk straight to a controller. Data moves outward through the DMZ, and any command path inward is explicit and logged.
Deny by default
In its Volt Typhoon advisory, CISA advises denying all connections into OT networks by default and allowing only approved IP and port combinations, routing necessary traffic through a monitored intermediary, and watching every connection. Where a password cannot be changed, it suggests compensating controls such as enclave segmentation and extra logging.
Common mistakes
- A flat network behind a single firewall, with every device in one zone.
- Remote access paths for vendors that bypass the DMZ.
- Dual homed engineering laptops that bridge networks.
- Rules written once and never reviewed.
- Segmentation drawn on paper but never tested from the IT side.
Testing it
From a host on the corporate side, try to reach a controller address on its control protocol port. The attempt should fail. Then review firewall logs for unexpected flows and compare them with your conduit list. A conduit nobody can explain is a candidate for removal.
Quick check
Is a VLAN enough to separate OT from IT?
Not on its own. A VLAN groups traffic, but you still need enforced rules between zones, logging and a DMZ for shared data.
Can I segment without stopping production?
Plan it in stages with operations, test rules in monitor mode first where your tools allow, and keep a rollback ready.
Sources
- CISA, DarkSide Ransomware advisory AA21-131A
- CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA, Foundations for OT Cybersecurity: Asset Inventory Guidance
- CISA, Volt Typhoon advisory AA24-038A
Last reviewed: 19 October 2026.
