A Plant-Floor Segmentation Plan, Step by Step

Standards, guidance and rules this lesson describes: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023, still the final version; Draft Rev. 4 was released Sept. 21, 2026, with comments open through Nov. 30, 2026); ANSI/ISA-62443-3-2-2020 (security risk assessment, zones and conduits) and ISA-62443-3-3-2013 (system requirements and security levels), described from public ISA material, not quoted, because they are paid standards; CISA and partners, "Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators" (Aug. 13, 2025); CISA, FBI, EPA and DOE, "Primary Mitigations to Reduce Cyber Threats to Operational Technology" (May 6, 2025); "CI Fortify: Advice for isolating vital systems" (July 28, 2026); "Adapting Zero Trust Principles to Operational Technology" (April 29, 2026); CISA and FBI, "Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators" (Sept. 23, 2026); CISA Cross-Sector Cybersecurity Performance Goals 2.0 (December 2025); and NERC Reliability Standard CIP-015-1, Internal Network Security Monitoring (FERC Order No. 907, rule effective Sept. 2, 2025, compliance starting Oct. 1, 2028), all read Oct. 28, 2026. Guidance and rules change; check the current text from NIST, CISA, ISA, NERC or FERC before relying on any point.

Most plant networks were never designed. They grew. A controls integrator put in a switch for the first automated line in 2006 and plugged it into the office network so the plant manager could see production counts. The second line came with its own switch, which went into the first one. A vendor installed a dial-up modem on the wastewater controller so he could help at 2 a.m. without driving in. Someone bought a laser cutter that phones home to its maker over a cellular link. The engineering laptop that holds every controller's program also reads email. Twenty years later the plant has one network, one address range, and no wall anywhere between a phishing email and a running press.

This lesson takes one plant like that and fixes it, step by step, the way official guidance says to. It is the worked example for the whole module: the other lessons explain the parts, and this one puts them together in order, with a drawing of the network before and after, a table of zones and conduits, a phased timeline, and a sample standard and worksheet you can adapt. It is long because the job is long. Nobody should expect to finish it in a month, and nobody should start it by changing equipment.

The lesson builds on others you may want first. The general idea of layered defense for an office network is in Layered Defense Architecture, and the basics of inventories, data maps and risk scoring are in Risk Assessment and Data Mapping. The small-office firewall, Wi-Fi and guest network basics are in Network, Wi-Fi and Remote Work, and a 90-day plan for the office side is in Policies, Training and a 90-Day Plan. This lesson does not repeat those; it goes into what is different on a plant floor.

Inside this module, the vocabulary (OT, PLC, HMI, SCADA, historian) and the Purdue levels are in lesson 1, IT, OT and the Purdue Model. ISA/IEC 62443 and NIST SP 800-82 are explained in lesson 2. The real attacks behind this lesson's warnings are in lesson 3, Threats and Real Cases. Vendor remote access is covered in full in lesson 4, patching in lesson 5, and the sector rules (NERC CIP, TSA, CMMC, FDA, water) in lesson 6.

A short reminder of terms used constantly below. OT (operational technology) is the hardware and software that watches and controls physical equipment. A PLC (programmable logic controller) is the rugged industrial computer that runs a machine or a process step. An HMI (human-machine interface) is the screen or panel an operator uses to run it. A historian is the database that records process values over time. MES (manufacturing execution system) is the plant software that tracks orders, recipes, work in progress and quality on the floor. An engineering workstation is the computer that holds the programming software and the programs for the controllers. A safety instrumented system (SIS) or burner management system is the separate controller whose only job is to take a process to a safe state when something goes wrong.

Why a flat plant network is the problem

A flat network is one where every device can send traffic to every other device with nothing in between that checks whether it should. On an office network that is risky. On a plant network it means that whatever lands on the weakest computer in the building, usually an office PC that opens email and browses the web, has a direct path to the controllers that run machines, boilers and chemical feeds.

Segmentation is the fix: divide the network into groups of devices that need the same protection, and put enforcement points (firewalls, or in some places one-way hardware) between the groups that allow only the traffic the plant has decided it needs. NIST's OT guide calls this a "good practice for network architectures": "characterize, segment, and isolate IT and OT devices."⁵ The ISA/IEC 62443 standards call the groups zones and the controlled paths between them conduits.⁶

How ransomware crosses from email to the line

The path in most plant incidents is not exotic. It goes like this, described at the level of the public reports:

1. Someone gets in on the office side, through a stolen password on a remote access account, an unpatched internet-facing device, or a phishing email. IBM's 2026 X-Force index, as reported by Manufacturing Dive, said manufacturing was the most-attacked industry for the fifth straight year, at 27.7 percent of incidents in 2025, with public-facing applications (32 percent), valid accounts (16 percent) and external remote services (11 percent) as the top ways in.⁷
2. The intruder looks around. On a flat network, the MES server, the historian, the engineering workstation and the HMIs all answer from the same address range as the office PCs.
3. Ransomware spreads to every Windows computer it can reach, which on a flat network includes the HMIs, the historian and the engineering workstation. The PLCs themselves often keep running, but operators can no longer see or steer the process, recipes and work orders vanish, and the plant stops.
4. Even when the plant floor is untouched, the company may shut it down on purpose because nobody can say for sure that the infection did not cross. That is a direct consequence of having no clear boundary.

Dragos's figures for 2025 make the same point from incident response work: its CEO said "industrial organizations significantly underestimate the reach of ransomware into OT environments," and Dragos found that 73 percent of all its incident response cases ever had involved compromised VPN or jump host credentials, and 30 percent of its cases started as an unexplained operational problem rather than a security alert.¹

Colonial and NotPetya as reminders

Two public cases, both covered in detail in lesson 3, show the two ways a flat or unclear boundary hurts.

Colonial Pipeline, May 2021. The ransomware hit the company's office systems, not its pipeline controls. CEO Joseph Blount told a Senate committee on June 8, 2021, that "that attack encrypted our IT systems," and that the attacker likely used "the legacy VPN profile that was not intended to be in use," an account with only a password. Asked whether the attack was detected only in the IT network, he said "Senator, that is correct." Colonial shut the pipeline anyway, because "if there was one percent chance that that OT system was compromised, it was worth shutting the pipeline system down." Blount also said the company brought in an OT security firm to get "the best segmentation we can possibly have on our OT side."⁸ The lesson for a plant: if you cannot prove the plant is separate, you will have to act as if it is not.

NotPetya, June 27, 2017. Destructive malware the U.S. government later attributed to Russia's military intelligence agency spread through company networks worldwide. The Justice Department said it caused "nearly $1 billion in losses" to three victims alone, one of them a large U.S. drug manufacturer.⁹ A New Jersey appeals court opinion in that manufacturer's insurance case (Merck) said "over 40,000 machines in Merck's network were infected," and Merck reported disruption of "manufacturing, research and sales operations."¹⁰ Mondelez, the snack maker, lost "more than 1,700 servers and 24,000 laptops," according to court documents described by The Record.¹¹ NotPetya spread on its own from computer to computer; a flat network is exactly what that kind of malware needs.

A third case shows the payoff of planning. When Norsk Hydro, the Norwegian aluminum maker, was hit by ransomware in March 2019, the company said the attack "affected our entire global organization," and several business units switched to "work-intensive workarounds and manual procedures" while systems were rebuilt; Hydro put the total cost at about NOK 800 million.¹² Manual fallback did not prevent the loss, but it kept metal moving.

What the numbers say about small plants

Readers at small shops sometimes assume attackers only go after Fortune 500 plants. The data says otherwise. Verizon's 2025 Data Breach Investigations Report, in its manufacturing section, counted 3,837 incidents and 1,607 confirmed data disclosures, found ransomware in 47 percent of manufacturing breaches, and said "more than 90% of breached organizations were SMBs with fewer than 1,000 employees."¹³ Dragos reported 119 ransomware groups hitting about 3,300 industrial organizations in 2025, with manufacturing "more than two-thirds" of the victims.¹ Idaho had 77,500 manufacturing jobs in September 2026 (preliminary, seasonally adjusted), about 8.7 percent of the state's nonfarm jobs, most of them at small and mid-size firms.¹⁴

What segmentation will and will not do

Segmentation is not a cure. NIST says plainly that network isolation "does not mitigate risks associated with lateral movement within a network segment, such as the propagation of a worm," and that many industrial protocols have weaknesses "that might be exploitable through network isolation devices."¹⁵ What segmentation does do:

• It turns a single infection into a contained one. Ransomware that lands on an office PC hits a firewall instead of the HMIs.
• It gives the plant a place to watch. Traffic that crosses a boundary can be logged and inspected; traffic on a flat network mostly cannot.
• It lets the plant cut the cord on purpose. A plant with a few well-labeled boundaries can disconnect from the office and the internet in minutes and keep running; a flat plant cannot.
• It lets the company say, with evidence, that the plant was not touched, which is how a Colonial-style precautionary shutdown is avoided.
• It shrinks the problem of patching. A controller that cannot be patched for years (see lesson 5) is far less dangerous behind a strict boundary than on a flat network.

Meet the example plant (invented)

Everything about this plant is made up for teaching. It is not modeled on any real Idaho company, and any resemblance is accidental. Its equipment and problems are typical of what assessments and public reports describe at small and mid-size manufacturers.

The example plant makes machined and fabricated metal parts for farm equipment and trucks. It has 120 employees on two shifts in one building on the edge of a southern Idaho town. Annual sales are a few tens of millions of dollars. It has one IT person, who also handles phones, and a maintenance team of six, two of whom do most of the controls work. A regional integrator built two of its lines and still services them.

What is on the floor

How it got flat

No one at the example plant made a bad decision on purpose. Each connection solved a real problem: the plant manager wanted live counts on his office PC, the MES vendor needed ERP work orders, the wastewater vendor needed to help at night, the laser maker's service plan required the cloud link, and the controls techs needed one laptop that could reach everything. The result is the left side of the drawing below: one switch fabric, one address range, and at least three ways in from outside (the office internet connection, the vendor's phone line, and the laser cutter's cellular link) that nobody had written down in one place.

The right side is where this lesson ends up after roughly a year of work. Read the drawing now, and come back to it after each step.

The drawing uses the Purdue levels from lesson 1 as labels: Level 4 for business systems, Level 3 for site operations, Levels 2 to 0 for the cells where controllers, HMIs and machines live, and the common industry shorthand "Level 3.5" for the industrial DMZ. NIST presents Purdue as one option for organizing segmentation, not a requirement; organizations "may also consider using an industry-recognized model ... such as the Purdue model," ISA-95 levels, or a three-tier IIoT model.⁵ The "3.5" label is industry usage, not a number in an official standard.

The plan in eight steps

The steps below follow the order that NIST and CISA guidance supports: know what you have, decide what matters most, design the zones, enforce the boundaries, watch them, fix remote access, roll changes out carefully, and practice running without the network. NIST says grouping components into levels, tiers or zones "is a precursor activity before organizations can consider applying isolation devices," and CISA's 2025 inventory guide treats the inventory as the base of "a modern defensible architecture."⁵² Skipping ahead to buy a firewall before step 1 is the most common way these projects fail.

Step 1: Asset inventory and data flows

You cannot draw a wall around things you do not know you have. Every segmentation plan starts with two lists: what is connected, and what each thing talks to.

CISA's five steps for an OT inventory

On August 13, 2025, CISA, EPA, NSA, the FBI and cyber agencies from Australia, Canada, Germany, the Netherlands and New Zealand published "Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators." It defines an asset inventory as "an organized, regularly updated list of an organization's systems, hardware, and software," and lays out five steps:²

1. Define scope and objectives. Decide who owns the inventory, assign roles for collecting and checking data, and set the boundaries (which buildings, lines and systems count, and what counts as an "asset").
2. Identify assets and collect attributes. CISA says to "conduct a physical inspection and logical survey," and to compile the list from documentation as well as what people find on the floor.
3. Create a taxonomy to categorize assets. Classify assets by criticality, by function, or both, and organize them with their communication paths. CISA used the ISA/IEC 62443 zones-and-conduits model for its sample taxonomies, while noting that the choice of model "is at the discretion of the organization."
4. Manage and collect data. Pull in other sources such as integrator agreements, vendor manuals, maintenance records and configuration specifications, and keep the inventory in one protected place.
5. Implement life cycle management. Track each asset from purchase to retirement, and require inventory updates whenever a device is added or removed, "even under emergency change authority."

In September 2025, a follow-on guide led by the UK's National Cyber Security Centre with CISA, the FBI and other partners, "Creating and Maintaining a Definitive View of Your Operational Technology Architecture," called a single authoritative OT record "essential for effective risk management," according to an ExecutiveGov summary.¹⁶

The 14 attributes CISA puts first

CISA's guide lists 14 "high priority attributes" to collect for each asset. The table shows them with what the example plant wrote down for one line controller, to make each field concrete. (The values are invented.)

CISA's appendix lists more attributes for organizations that can collect them. A small plant should not stall trying to fill every field for every sensor. Start with the computers, controllers, HMIs, switches, gateways and anything with a network or phone connection, then add field devices over time.²

Passive first: a safety caution about active scanning

Here is where OT differs most from office IT. On an office network, an IT person might run a discovery tool that sends probes to every address to see what answers. On a plant network that can stop machines. NIST's OT guide records two cases in its appendix of accidental events: a ping sweep (a simple probe of every address) on an active SCADA network that controlled 9-foot robotic arms caused one arm to become active and swing "around 180 degrees," and a ping sweep run "for inventory purposes" at a chip plant caused a control system to hang and "resulted in the destruction of $50,000 worth of wafers."¹⁷

NIST therefore describes two kinds of discovery:¹⁸

• Passive discovery "inspects existing network traffic by watching traffic passing through network switches or other dedicated network capture devices," and does "not introduce any additional traffic to the network, which is ideal for sensitive devices found on OT networks." Its limits: it cannot see devices that are not talking, cannot read encrypted traffic, and "will often take days to complete."
• Active discovery directly probes devices. NIST says owners "should exercise extreme caution when permitting active scanning on an operational network," because active scans "may cause device instability or interfere with the device process state, potentially impacting safety and integrity," and should be scheduled "during planned OT outages whenever possible." Some OT tools learn passively first and then ask devices for details in their own language, which NIST calls a "safer version of active scanning."

NIST adds that before using any automated asset tool in production, "performing a test using the automated asset management tools on offline systems or components is recommended," and that where automated tools are not feasible, manual processes are fine.¹⁹ For a plant the size of the example, a careful walkdown with a clipboard and a camera, plus a few days of passive traffic capture from a switch mirror port, finds almost everything. NIST notes that physically inspecting connections "or analyzing network logs" can be enough "especially if the network is not large or complicated."¹⁹

Safety reminder. Do not run discovery tools, scanners or vulnerability checks on a running plant network on your own. Plan any collection with the equipment vendor, the safety lead and qualified controls engineers, test the tool on an offline system first, and keep active methods for planned outages.

Mapping the data flows

An inventory says what exists. A data flow map says who talks to whom, about what, how often, and why. It is the input to every firewall rule later. NIST: "Documenting data flows enables organizations to understand the expected behavior of their networks."¹⁹ It also warns that automated flow-mapping tools that probe actively, or in-line probes that briefly disconnect equipment, should be used during planned downtime.

For each flow, the example plant recorded the source, the destination, the purpose, the protocol in plain words, whether it is needed for production, who owns it, and what breaks if it stops. The flows it found fell into a few families:

• Control traffic inside each line: HMI to PLC, PLC to robot and drives. Must keep working; should never leave the line.
• Supervisory traffic: historian and MES reading values from each line PLC; MES sending recipes or work orders down.
• Business traffic: ERP sending work orders to MES; MES sending counts and quality data back; office users viewing historian dashboards.
• Engineering traffic: the controls laptop programming PLCs and HMIs, and the integrator doing the same during service visits.
• Support and update traffic: Windows updates and antivirus updates for the HMIs and servers, vendor remote sessions, the laser cutter's cloud link.
• Building traffic: cameras to their recorder, badge readers to their controller, HVAC to its vendor's portal.

What the example plant found

Every real inventory turns up surprises. The example plant's list, typical of what assessors report:

• The wastewater modem was always on. The vendor's dial-up modem was plugged into the wastewater PLC around the clock, with no callback and a password nobody at the plant knew. NIST notes that modem access is sometimes written into vendor support contracts (it gives the example "24/7 support with 15-minute response time"), so removing it may take a contract change.²⁰
• The laser cutter had a second way out. Its cellular gateway connected to the maker's cloud and also had a cable into the plant switch, so it bridged the plant network to a cellular carrier's network that nobody at the plant managed.
• One HMI had two network cards. The Line 2 HMI was plugged into both the line switch and the office network ("dual-homed") so the plant manager's PC could see its screen.
• The controls laptop held the crown jewels. It had every PLC program, read email, and went home some nights.
• The boiler controls were cleaner than expected. The burner management system was hardwired and had no network port. Only a separate boiler monitoring panel was on the network.
• Nobody had a copy of the current PLC programs. The last full backup was from the integrator's commissioning, years and many changes ago.
• A forgotten switch. An unmanaged switch in a ceiling over Line 3 connected two areas nobody thought were connected.

Two of those findings (the always-on modem and the dual-homed HMI) are the kind of exposure CISA's May 2025 fact sheet tells owners to fix first: "Remove OT connections to the public internet," and secure remote access with private connections, phishing-resistant multifactor authentication (MFA) and least privilege.⁴

Step 2: Consequence and risk ranking

With the inventory in hand, the plant decides what matters most. On the office side, risk ranking usually starts from data: what would hurt if it leaked (that method is in Risk Assessment and Data Mapping). On the plant floor, the question is physical: what is the worst thing that could happen if this device were misused, and how exposed is it today?

Start from consequences

Idaho National Laboratory's Consequence-driven Cyber-informed Engineering (CCE) method starts by assuming a skilled attacker "can and will" get into the network, and asks which events would be truly unacceptable for the organization: its first phase is called Consequence Prioritization.²¹ A small plant does not need the full CCE process to borrow its main question. For the example plant, the unacceptable events were:

• Anyone hurt by a machine moving when it should not (robot loaders, the press brake).
• A boiler incident.
• Untreated wastewater sent to the city sewer, breaking the plant's discharge permit.
• All three production lines down for more than two days, which would cost the plant its largest customer's on-time rating.
• Loss of every PLC program with no backup to restore from.

CISA's 2025 inventory guidance uses a similar three-level criticality scheme in its sample taxonomies: high-criticality assets "should have the most stringent security measures, such as network segmentation and role-based access control," medium-criticality assets need strong monitoring and regular updates, and low-criticality assets "should have basic security measures" but stay in the inventory.²

The example plant's ranking

The team (plant manager, both controls techs, the IT person, the maintenance lead and the plant's safety lead) placed each system on a simple grid: how bad the consequence of misuse could be, and how exposed the system is today. The ranking is a judgment call made by people who know the equipment, not a calculation, and the values below belong to the invented plant.

Three things stand out on the grid. First, almost everything sits in the high-exposure row, which is what a flat network looks like. Second, the systems with the worst consequences (the burner safety controls, the robot cell safety controllers and the boiler panel) are not the ones with the most exposure, which is good news and tells the plant where not to add connections. Third, the wastewater PLC combines a real consequence (a permit violation) with the worst exposure (an always-on modem), so it moves to the top of the to-do list even though it is a small system.

Safety systems come first and stay apart

Safety controls, such as the boiler's burner management and any safety PLC on a robot cell, get special treatment. The best-known attack on a safety system, Triton in 2017, targeted safety controllers at a foreign refinery. After it, CISA's analysis recommended keeping safety controllers out of program mode except when needed and putting safety systems on isolated networks, with the safety engineering workstations not connected to larger networks.²² For the example plant, the decision was simple: the burner management system stays hardwired and off every network, and the boiler monitoring panel gets its own place in the utilities zone with read-only data going up. How safety and security work together is covered in lesson 5.

Step 3: Zones and conduits

Now the plant draws the new map on paper. Nothing changes on the floor yet.

What ISA/IEC 62443-3-2 asks for, in plain words

Part 3-2 of the ISA/IEC 62443 series (the U.S. edition is ANSI/ISA-62443-3-2-2020) covers security risk assessment for system design, and it is where zones and conduits are defined in practice.²³ The standard is sold, not free, so this lesson describes it from the free ISA Global Cybersecurity Alliance quick start guide rather than quoting it. That guide defines a zone as a "grouping of logical or physical assets based upon risk or other criteria," and a conduit as a "logical grouping of communication channels that share common security requirements connecting two or more zones."⁶ CISA's inventory guide gives a factory example: "all machines that control a production line might be in one Zone because they need the same level of protection," and a conduit "might connect a factory's control system to its monitoring system, but with strict rules to prevent unauthorized access."²

The ISAGCA guide describes the Part 3-2 workflow roughly in this order: identify the system under consideration (what is in scope); do an initial, high-level risk assessment; partition the system into zones and conduits; check whether the initial risk is above what the organization can tolerate; where it is, do a detailed risk assessment of each zone and conduit; document the resulting security requirements, assumptions and constraints; and get the asset owner's approval.⁶ The example plant did a lighter version of the same thing, with the plant manager signing as the asset owner.

Security levels in plain words

Each zone gets a target security level (SL-T), set by the risk assessment. The ISAGCA guide describes four: SL 1 protects against "casual or coincidental violation"; SL 2 against intentional violation "using simple means with low resources, generic skills, and low motivation"; SL 3 against sophisticated means with moderate resources and industrial-control-specific skills; and SL 4 against sophisticated means with extended resources and high motivation. The level a zone actually reaches after the work is done is its achieved level (SL-A), and the level a product can reach when properly configured is its capability level (SL-C).⁶ The point for a small plant is not the number. It is that each zone gets a written target, and the conduit rules and controls inside the zone are chosen to meet it.

Of the seven foundational requirements in 62443, the one that segmentation serves most directly is FR 5, Restricted Data Flow, with FR 1 (identification and authentication), FR 2 (use control) and FR 6 (timely response to events) close behind.⁶

The example plant's zones

The plant's team grouped assets by function, consequence and who maintains them. This is the zones-and-conduits table the plant's segmentation plan was built on.

The target levels in the table are the invented plant's own choices, written to show how a small manufacturer might set them, not a recommendation for any real plant. Two features are worth copying. Each production line is its own zone, so ransomware or a bad change on Line 1 does not reach Line 2. And the equipment that someone outside the plant needs to reach (the laser cutter, the building systems) is kept in zones of its own so their outside connections do not open a path to the lines.

The conduits

Each arrow between zones is a conduit, and each conduit gets a short written description: what may cross, in which direction, who owns the rule, and what enforces it. The example plant had six:

• C1, Enterprise to DMZ (Firewall A): office users reach the historian replica's dashboards and the jump host's sign-in page; the patch relay fetches updates from the internet through the office firewall.
• C2, DMZ to Site Operations (Firewall B): historian data is replicated outward; approved patches and files are pulled inward by the site servers; jump host sessions reach only the engineering workstation and named HMIs.
• C3, Site Operations to each cell (cell firewalls or the cell's managed switch rules): historian and MES reads, recipe downloads, engineering sessions from the engineering workstation only.
• C4, Remote access: internet to the jump host only, with phishing-resistant MFA, on a schedule, with recording.
• C5, Cloud-linked machine: the laser cutter's data goes out to its maker through the DMZ, outbound only; its own cellular gateway is removed or disabled.
• C6, Building systems: a separate path for the camera, badge and HVAC vendors that never touches an OT zone.

VLANs or separate switches

A zone can be built with separate physical switches or with VLANs (virtual networks carved out of one managed switch). NIST says VLANs "can be a cost-effective solution for OT network segmentation," but that organizations "should consider utilizing physically separate switches for segmenting high-criticality devices, such as those that support safety systems."¹⁵ It also suggests color-coded cables and labels "to clearly delineate OT and IT network segments and reduce the risk of potential cross-connections."¹⁵ The example plant used managed industrial switches for each line (most lines already had one), VLANs inside the server closet for Site Operations and the DMZ, and kept the burner safety controls off the network entirely. It also bought orange patch cables for everything OT.

Step 4: The industrial DMZ and the boundaries

Step 4 is where the drawing becomes equipment. It is also where most of the money goes.

What an industrial DMZ is

A DMZ (demilitarized zone) is a small network that sits between two others so that neither talks to the other directly. In NIST's executive summary list of OT protections, it appears as "Employing a DMZ network architecture (e.g., prevent direct traffic between the corporate and OT networks)."²⁴ CISA, the FBI, EPA and DOE put it the same way in their 2025 fact sheet: segment IT and OT networks, including "introducing a demilitarized zone for passing control data to enterprise logistics."⁴ NIST's firewall rule is the heart of it: rulesets "should be established to only permit connections between adjacent levels, tiers, or zones," and Purdue users should "prevent Level 4 devices from directly communicating with Level 2, 1, or 0 devices."⁵

In practice, the DMZ holds copies and brokers. The office never reaches the real historian; it reaches a replica in the DMZ. A vendor never reaches a PLC from the internet; he reaches a jump host in the DMZ, and from there only the machines he is approved to touch. Patches never flow from the internet to an HMI; they land in the DMZ, get checked, and are pulled down by a plant server.

The DMZ has its critics. A Tripwire analysis summarizes them: the Purdue model was introduced "over 30 years ago"; it notes that "neither ISA95 nor the Purdue Model were originally intended as security architectures," and cloud and IIoT designs lead some people to ask whether it is dead. The same analysis defends keeping an industrial DMZ because most ICS threats arrive through IT, the DMZ slows an intruder's movement, and its traffic is predictable enough for strict allow-listing.²⁵ That predictability is the reason a small plant can make a DMZ work with a short rule list.

Firewalls with allow-lists

An allow-list (deny-by-default) firewall blocks everything except traffic that has been specifically approved. NIST: "Organizations should enforce a deny-all, permit-by-exception policy where possible."¹⁵ It describes firewalls as "very flexible isolation devices" that "typically constitute the primary mechanism for protecting OT devices," and notes that OT-specific firewalls "often provide built-in parsers for common OT protocols, such as DNP3, CIP, and Modbus, allowing for deep packet inspection of OT traffic," which can, for example, allow a historian to read values from a PLC while refusing commands that would write to it.⁵²⁶

The example plant's allow-list, in plain words (no addresses or port numbers, which every plant must fill in from its own data flow map with its vendors):

Outbound traffic is not free

Many plants lock down inbound traffic and leave outbound open. NIST calls outbound control from the control network "one area of considerable variation in practice," warns that "allowing outbound connections from lower levels, tiers, or zones could represent a significant risk if unmanaged," and says organizations "should consider making outbound rules as stringent as inbound rules."⁵ The example plant's rule: no OT zone starts a connection to the internet. The laser cutter's cloud link, the one outbound need on the floor, goes through the DMZ to a named destination, and the cellular gateway that bypassed everything is disconnected once the vendor confirms the DMZ path works. CISA's July 2026 update to its advisory on Iranian-affiliated attacks on PLCs told defenders to "remove PLCs from direct internet exposure via secure gateway and firewall."²⁷

Unidirectional gateways

For the conduits where data only needs to flow one way, a unidirectional gateway (also called a data diode) is stronger than a firewall. NIST: data diodes "are designed to only allow data transmission in a single direction," and "unlike a firewall, data diodes cannot be programmed to allow data to flow in both directions because the hardware is incapable." A common use is at the boundary between the plant and the business network, where "the data diode would allow network traffic to leave the operational network but not enter."²⁶ NIST also gives an example of placing one between Levels 2 and 3 to protect the lower levels from an event higher up.⁵

The tradeoff is cost and flexibility: a diode does not allow anything back in, including patches, remote support or recipe downloads, so those need another planned path. The example plant put "replace C2-1 with a one-way gateway" on its 12-month list for historian replication once it had a year of data on what really crosses.

Physical isolation and CI Fortify

On July 28, 2026, CISA, Australia's Cyber Security Centre, the FBI and international partners released "CI Fortify: Advice for isolating vital systems." CISA's announcement warned that "state-sponsored cyber threat actors are increasingly targeting critical infrastructure for pre-positioning," and said "by physically isolating vital OT and enabling systems, CI operators and defenders can disrupt adversaries." Its central sentence: "physical isolation remains the most risk-effective solution." The guidance also covers temporary measures "for organizations unable to physically isolate," and asks operators to identify and map critical assets and their connections, build separation points in advance, and develop "graduated isolation plans with regular testing."³

A summary published by the security company Zscaler describes the graduated sequence as cutting remote workers and vendors first, then corporate connectivity, then other external links.²⁸ The guidance's own worked example, for an invented electricity transmission company, starts the same way: first disable remote workers' access to OT, then on-premises remote access, then all connections between non-OT and OT systems, then lower-priority links between OT environments, and finally isolate the vital systems completely.³ For the example plant, that became a one-page isolation plan with a labeled cable or firewall switch at each step, so a shift supervisor can do it with the plant manager on the phone.

NIST's own list of protections says to consider "where physical separation may be required as opposed to logical separation."²⁴ For the example plant, the burner safety controls are physically separate by design, and the plan's isolation points mean the whole plant can become an island in minutes. Whether every plant should be fully and permanently air-gapped is a real debate, taken up in the hard questions below.

Safety reminder. An isolation plan is itself a plant change. Decide each step with the vendors, the safety lead and qualified controls engineers, confirm what each line needs in order to keep running safely while cut off (licenses, time sources, recipes, alarms), and test it in a planned outage before you ever need it.

Step 5: Monitoring the boundaries and the floor

A wall nobody watches only slows an intruder down. Dragos found adequate OT network monitoring in only 46 percent of its 2025 assessments.¹ Monitoring is the step most small plants skip, and the one that tells them whether the other steps worked.

Learn normal first

Plant traffic is boring in a useful way. NIST: OT traffic "is typically more deterministic (i.e., repeatable, predictable, and designed) than IT network traffic," and organizations "should understand the normal state of the OT network as a prerequisite for implementing network security monitoring." It recommends starting in "a passive (e.g., listen or learning) mode" to tell known from unknown communication.²⁹ In the example plant, two weeks of passive listening showed about forty normal conversations across the whole floor. Anything outside that list, such as a PLC suddenly receiving a program download on a Saturday night, is worth a phone call.

Where the sensors go

NIST says network monitoring in OT is "typically deployed on boundary protection devices using switched port analyzer (SPAN) ports or passive network taps," and that host-based monitoring can be added on compatible machines such as HMIs, SCADA servers and engineering workstations "provided that the addition of the tools does not adversely impact operational performance or safety."²⁹ A SPAN port is a switch setting that sends a copy of traffic to a monitoring port; a network tap is a small hardware device that copies traffic off a cable. Neither sends anything onto the plant network. NIST also cautions that automatic blocking (intrusion prevention) can hurt operations, and suggests placing such units "at higher levels in the environment (e.g., the DMZ interfaces)."²⁹

The example plant put its sensors at three places: on the mirror ports of Firewalls A and B (everything crossing the DMZ), on the Site Operations switch (everything going to and from the cells), and temporarily on each line switch during its cutover.

Logging that someone reads

NIST says routers, switches, firewalls, servers and workstations "should be configured to log events to support monitoring, alerting, and incident response analysis," and that organizations should decide how long to keep logs and make sure there is room to store them.²⁹ At the example plant, the firewalls, the jump host, the engineering workstation and the historian send logs to one log server in Site Operations, and the outside IT provider reviews alerts on weekdays with a phone tree for nights. The historian itself is a monitoring tool: NIST notes that data historians "can serve as a supplemental source of event data" during an incident.¹⁸

A regulated example: NERC CIP-015

For most manufacturers, OT monitoring is voluntary. For the bulk power system it is becoming mandatory, which makes it a useful yardstick. FERC Order No. 907 approved NERC Reliability Standard CIP-015-1, Internal Network Security Monitoring (INSM), on June 26, 2025; the rule took effect Sept. 2, 2025.³⁰ Under NERC's implementation plan, the standard takes effect on the first day of the first calendar quarter 36 months after that, which works out to Oct. 1, 2028, for control centers and backup control centers, with other medium impact systems with external routable connectivity to follow within 24 more months.³¹ In brief, as summarized by Dragos, CIP-015-1 requires entities to collect network data feeds using a risk-based rationale, detect and evaluate anomalous activity (R1), keep the data tied to anomalous activity long enough to evaluate it (R2), and protect that data from being changed or deleted (R3).³² FERC also directed NERC to extend monitoring to certain access control and physical access systems; NERC filed CIP-015-2 to do that on June 18, 2026, and FERC approved it by letter order on Aug. 10, 2026 (Docket RD26-6-000). The Oct. 1, 2028 start date for CIP-015-1 is unchanged; under CIP-015-2's own implementation plan, as summarized by Dragos, CIP-015-2 replaces CIP-015-1 on Oct. 1, 2029 and phases in the added systems through 2031.³⁰³³

CIP-015 applies only to registered entities on the bulk electric system (about 1,706 U.S. entities are subject to CIP standards, according to a FERC notice from October 2026), not to an ordinary factory that buys power.³³ The sector rules are in lesson 6. The reason to mention it here is the shape of the requirement: collect the right traffic, look for what is abnormal, keep what you find, and protect it. That is a sensible goal for the example plant too.

The small-plant version

A 120-person plant will not build a security operations center. Options in rising order of cost:

• Free tools, run by a trained person. NIST's manufacturing extension program (MEP) points small manufacturers to "Malcolm," a network traffic analysis tool suite from Idaho National Laboratory and CISA with parsers for many industrial protocols.³⁴ It still needs someone to set it up and look at it.
• Firewall and switch logs plus a weekly review by the outside IT provider, with alerts for new devices, blocked traffic at the DMZ and any engineering session outside a scheduled window.
• A commercial OT monitoring product, bought or rented, often with the vendor's analysts watching alerts.

Step 6: Remote access through the DMZ

Remote access is how most plant intruders get in, and it gets its own lesson, lesson 4. The segmentation plan's part is simple to state: every remote session, by employees, the integrator, the MES vendor, the wastewater vendor or the laser maker, enters through one door in the DMZ, and nothing else from outside reaches an OT zone.

NIST's remote access section supplies the rules the jump host enforces: remote access "should be provided only if justified and limited to what is required for the business need," "should not circumvent or negate safety or security controls," and should consider MFA; it lists "Removing access when no longer required," "Monitoring remote activities," making operations staff aware of planned remote work, "Initiating the connection from the OT environment," and "Labeling remote connection devices so that operations may disconnect quickly in the case of unauthorized use."²⁰ CISA and the FBI's September 23, 2026, fact sheet on industrial integrators adds: "Ensure integrators access equipment using routes you are able to monitor."³⁵

For the example plant, that meant:

• The wastewater vendor's modem came off the PLC. The vendor now uses the jump host, with a phone call to the shift supervisor to open the session. The contract was amended to match (the vendor's response time promise stayed the same).
• The integrator's old VPN account, still active from a project three years earlier, was disabled. Dragos's figure that 73 percent of its incident response cases involved stolen VPN or jump host credentials is why the jump host itself has phishing-resistant MFA and recorded sessions.¹
• Each vendor reaches only its own equipment from the jump host. The laser maker cannot see Line 1; the integrator cannot see the wastewater PLC.
• The remote access software used on the floor was cut to one approved product. CISA's 2023 guide on remote access software explains why: the same features that help "IT, OT, and ICS professionals" troubleshoot "make it an easy and powerful tool for malicious actors."³⁶

Step 7: Rollout in phases

The design is done; now it has to be built without stopping the plant or hurting anyone. This is where plant segmentation projects most often go wrong, usually because a well-meant firewall rule blocks something nobody knew a line needed.

Safety reminder. Every change in this step touches running equipment. Plan each one with the equipment vendor, the safety lead and qualified controls engineers, put it through the plant's management-of-change process, test it first, and have a rollback ready.

Record first, then restrict

NIST offers a technique for the common problem that nobody knows exactly what a line needs: "organizations might consider temporarily allowing and recording all communication between the network segments," which produces "reviewable logs to identify and document authorized communication for implementing network isolation rules," and "may also reveal previously unknown or undocumented communication."¹⁵ The example plant installed each new firewall in "allow and log" mode for two to four weeks, reviewed every flow with the line's owner, wrote the allow-list from what it saw, and only then switched to deny-by-default.

Phases that follow the outage calendar

NIST notes that OT outages "must often be planned and scheduled days or weeks in advance."³⁷ The example plant tied each phase to a planned shutdown: the summer maintenance week, the Thanksgiving shutdown and the end-of-year week, plus a few Saturday windows when only one line was running. The order:

1. Office side first. Stand up Firewall A and the DMZ servers while nothing on the floor changes. Move office users to the historian replica. Little risk to production.
2. Remote access next. Bring vendors onto the jump host one at a time; remove the modem and the old VPN accounts once each vendor has a working session.
3. Site Operations. Install Firewall B, move the MES/historian and the new engineering workstation behind it. Retire the controls laptop from the office network.
4. One cell at a time. Start with the lowest-consequence cell (packaging), learn from it, then the lines in order, each during its own outage window. Readdress each cell's devices only when the vendor is present.
5. The cloud machine. Move the laser cutter into its zone and its cloud link into the DMZ; disconnect the cellular gateway after a week of good data.
6. Tighten. Switch each boundary from "allow and log" to deny-by-default, one at a time.

Testing and rollback

Before each cutover, the team wrote a short test script with the line's operator and the vendor: start the line, run a recipe change, run a quality report, check the historian, check alarms reach the HMI, check the engineering workstation can go online with the PLC, and run a normal stop and an emergency stop. After the cutover the same script ran again. Each cutover had a written rollback: the old cable left coiled and labeled next to the new one, the old switch configuration saved, and one person with authority to say "roll back" without a meeting. One rollback was used: the packaging label printers turned out to get their label formats from a file share in the office, a flow nobody had mapped. The fix (a copy of the label files in the DMZ file station) took a day.

Who is in the room

NIST notes that installing third-party products without the vendor's agreement can cost a plant its vendor support, which is one more reason the vendor is in the room.³⁷

Step 8: Manual operation drills and recovery

Segmentation reduces the chance that an incident reaches the floor. Step 8 is for the day it does anyway, or the day the plant has to cut itself off on purpose.

Practice running by hand

The fifth of CISA, FBI, EPA and DOE's primary OT mitigations is "Practice and maintain the ability to operate OT systems manually," with routinely tested continuity plans, fail-safe mechanisms, islanding, software backups and standby systems.⁴ The 2023 and 2026 water attacks show why. When a booster station PLC at the Municipal Water Authority of Aliquippa, Pennsylvania, was disabled in November 2023, its chairman said "It sent an alarm and we took control manually."³⁸ In the July 2026 attacks on water systems, which CISA said targeted more than 100 internet-exposed U.S. water and wastewater systems, Plymouth, Minnesota, disconnected cellular-connected equipment at water towers and lift stations and ran them manually.³⁹⁴⁰

The example plant wrote a one-page manual mode card for each area and drilled it twice a year: run Line 1 from its local HMI with the Site Operations network unplugged; run the wastewater system on local control with the pH checked by hand and the readings written on a paper log; issue work orders on paper for one shift. Each drill found something: a label printer that would not print without the network, an HMI that took twenty minutes to start without its time server, a supervisor who did not know where the isolation cable was.

Backups of controller logic

If ransomware or a bad change wipes the engineering workstation or a PLC, recovery depends on having the programs. NIST asks for a list of all maintained backups "including installation media, license keys, and configuration information," verified for integrity, kept on site where recovery staff can reach them, and copied to a second location so that "the same incident that disrupts the primary data cannot modify or destroy the backup," giving the example of storing "PLC logic and configuration files at an off-site, geographically diverse location." It also says to test restoration "as part of contingency plan testing" and to include backups in change management.⁴¹ NIST's architecture section describes a "backup-in-depth" approach, with quick local backups for everyday recovery and secure backups to recover from "a massive security incident (e.g., ransomware attack)," and lists firewall rules and access control lists among the files to keep.⁴¹ On June 17, 2026, NIST's National Cybersecurity Center of Excellence published NIST SP 1339, an "OT Backup Quick Start Guide," aimed at exactly this problem.⁴²

For the example plant, the backup set is: every PLC program and HMI project (current version, plus the version before), robot and drive parameters, the CNC machine programs, switch and firewall configurations, the MES and historian databases, license keys, and a printed list of every device's address. Copies live on the OT backup server, on an offline drive in the plant office safe, and on a drive at the owner's other site. A copy taken after every approved change is part of the change checklist.

Restore is the test

A backup nobody has restored is a hope, not a plan. Once a year, during an outage, the example plant restores one PLC program and one HMI from the offline copy onto spare hardware and confirms the line runs. The first time, it found that the HMI software version on the backup did not match the license on hand, which took a week and a vendor call to fix. Better then than during an incident.

The plan on a calendar: 90 days, 6 months, 12 months

The eight steps are an order of work, not a schedule. The example plant's calendar looked like this, sized for one IT person, two controls techs part time, the integrator and an outside network provider. It spread the spending over two budget years.

The first 90 days

• Name an owner for OT security (the plant manager) and a working team; agree the plant's unacceptable events.
• Walk the floor and build the inventory and data flow map, passively; find every outside connection.
• Fix the urgent exposures that need no new design: turn off the always-on modem except during scheduled sessions, disable unused vendor and employee accounts, change shared and default passwords on HMIs and the wastewater PLC with the vendors, and stop using the controls laptop for email. CISA's 2023 advisory on attacks on internet-exposed PLCs told owners to "Check PLCs for default passwords."⁴³
• Back up every PLC program, HMI project and switch configuration; store an offline copy.
• Write the first manual mode cards; run one tabletop drill.
• Ask for free help: CISA's free vulnerability scanning of the plant's internet-facing addresses, and a conversation with TechHelp (see below).

Months four to six

• Finish the risk ranking and the zones-and-conduits design; get the plant manager's written approval.
• Get quotes, and buy Firewall A, Firewall B and the DMZ servers.
• Build the DMZ; move office users to the historian replica; bring vendors onto the jump host; remove the modem.
• Stand up the new engineering workstation in Site Operations; retire the controls laptop from the office network.
• Start passive monitoring at the DMZ.

Months seven to twelve

• Cut over each cell in its outage window, packaging first, then the lines; move the cloud-linked machine.
• Switch each boundary from "allow and log" to deny-by-default.
• Add monitoring on the Site Operations switch; set alert routing.
• Run a full manual operation drill and a restore test.
• Write the isolation plan and test its first two steps.
• Review the year: update the inventory, the diagram and the zone table; decide on a one-way gateway for historian replication; set next year's budget.

Costs and help for small manufacturers

What costs money

This lesson does not give dollar figures for equipment and services, because prices vary widely by vendor, plant size and region and change quickly; get at least three written quotes. The cost categories are predictable, though:

To give one documented price: the 2024 edition of IEC 62443-2-1 (security program requirements for asset owners) was listed at EUR 416.46 before tax at one national standards shop in October 2026.⁴⁴ ISA members get free viewing of most ISA standards, and ISA's Global Cybersecurity Alliance publishes free overview material.²³

The other side of the ledger is downtime. Jaguar Land Rover's September 2025 cyber incident stopped its manufacturing for about five weeks, and the company reported GBP 196 million in costs relating to the incident in one quarter; Clorox reported $49 million in cyberattack-related expenses in its first months after an August 2023 attack.⁴⁵⁴⁶ A small plant's numbers are smaller, but so is its cushion.

Free and low-cost help

Sources for the table: Boise State University announced on March 25, 2026, that NIST had awarded TechHelp a new cooperative agreement to keep serving Idaho manufacturers; the release does not describe its cybersecurity services, so ask TechHelp what it currently offers.⁴⁷⁴⁸ The MEP national program's cybersecurity page describes what MEP centers can do.³⁴ CISA lists its free scanning and CSET on its #StopRansomware services page.⁴⁹ CISA's ICS301 course page says the course is "4 Days In Person" at "a facility in Idaho Falls, Idaho," that "There is no tuition cost to attend this training," and that the online ICS300 is a prerequisite with a score of "80% or better."⁵⁰ Idaho National Laboratory says the 301 course has "hosted more than 200 sessions."⁵⁰ NIST MEP describes Malcolm.³⁴ CISA announced CPG 2.0 on Dec. 11, 2025, adding "a new component focused on the essential role of governance."⁵¹

When buying new equipment during the project, CISA's January 2025 "Secure by Demand" guide for OT buyers lists 12 security elements to ask suppliers about, including logging in the base product, secure defaults, strong authentication, and an upgrade path to supported software "at no extra cost."⁵² NIST MEP also points manufacturers to ISASecure, which lists products certified to the ISA/IEC 62443 standards.³⁴

What to measure

A plan without numbers drifts. The example plant tracked a short list each quarter and reported it to the owner on one page. These are the plant's own measures, built from the guidance cited in this lesson, not an official set.

Common mistakes

• Leaving an old remote access account alive. Colonial Pipeline's attacker likely used "the legacy VPN profile that was not intended to be in use," protected by a single password.⁸ Segmentation does not help if a forgotten account leads straight past it. Inventory every account and path in step 1, and remove what nobody uses.
• Using legitimate remote tools as the attack path. In Ukraine in December 2015, attackers operated breakers remotely "using either existing remote administration tools at the operating system level or remote industrial control system (ICS) client software via virtual private network (VPN) connections," with credentials likely stolen beforehand.⁵³ One monitored door in the DMZ, with MFA and recording, is the answer.
• Leaving controllers reachable from the internet. CISA's 2023 advisory on attacks on Unitronics PLCs and its 2026 advisory on attacks against PLCs from several makers both describe controllers reachable from the internet, in the earlier case protected by default passwords.⁴³²⁷ CISA said the 2026 attacks targeted more than 100 internet-exposed U.S. water and wastewater systems in July alone.³⁹
• Scanning a live plant. NIST's examples of a ping sweep that moved a robotic arm and another that ruined $50,000 of wafers are the reason step 1 starts passively.¹⁷
• Buying a firewall first. Without a data flow map, the rules are guesses: either too loose to matter or so tight a line stops. Use "allow and log" before deny-by-default.
• A DMZ with a hole through it. A rule that lets one office server talk straight to a PLC "just for now" turns the DMZ into decoration. Every exception needs an owner and an end date.
• Forgetting the dual-homed device. One HMI or laptop with a foot in each network bridges any wall.
• Segmenting but not watching. Only 46 percent of the sites Dragos assessed in 2025 had adequate OT network monitoring.¹
• Backups that were never restored. A program file that will not open with the license on hand is not a backup.
• Treating a manual fallback as automatic. Aliquippa and Plymouth could run by hand because they knew how.³⁸⁴⁰ Drills find the label printer that will not print offline before an incident does.

Questions people ask

We are too small to be a target. Why bother?

Most attacks on small plants are not aimed at them in particular. CISA and partners noted in 2025 that threat actors "target specific OT products rather than specific organizations," and the 2026 water attacks were described as largely opportunistic.⁵²³⁹ Verizon found more than 90 percent of breached manufacturers had fewer than 1,000 employees.¹³ A small plant also has less cushion to absorb two weeks without production.

Can we just use VLANs on the switches we have?

VLANs on managed switches are a reasonable start and NIST calls them cost-effective, but VLANs only separate traffic; they do not decide what may cross. You still need a firewall or equivalent enforcement between zones, and NIST suggests physically separate switches for high-criticality and safety-related equipment.¹⁵ Unmanaged switches cannot do VLANs at all.

Will segmentation break our vendors' support agreements?

It can if the vendor is surprised. NIST notes that service support "can be lost if third-party applications are installed without vendor acknowledgement or approval," and that modem access is sometimes part of a support contract.³⁷²⁰ Bring vendors in at step 3, put the remote access method in writing, and amend contracts where needed. CISA and the FBI's 2026 integrator fact sheet urges owners to put cybersecurity and supply chain requirements in integrator contracts.³⁵

What about the machine that has to talk to its maker's cloud?

Give it its own zone, send its traffic out through the DMZ to a named destination, outbound only, and remove any cellular or wireless link that bypasses the plant's boundaries. Ask the maker in writing what data leaves, what (if anything) can be sent back to the machine, and whether remote commands can be turned off. NIST's draft Rev. 4 of SP 800-82, released Sept. 21, 2026, adds coverage of "Industrial Internet of Things (IIoT) and cloud convergence," a sign that this pattern is now common enough to need its own guidance.⁵⁴

Do we need to buy the ISA/IEC 62443 standards?

Not to start. The free ISAGCA quick start guide, NIST SP 800-82 Rev. 3 and CISA's 2025 inventory guide are enough to do what this lesson describes. If customers or regulators ask you to show conformance, or you are writing specifications for integrators, buy the parts you will use (often 2-1, 3-2 and 3-3). ISA asks that its standards not be entered into AI tools.²³

How is zero trust different from this?

Zero trust means no user or device is trusted just because it is on the inside network; each request is checked. NIST says many OT components cannot support it, and suggests applying it mainly at the higher levels and the DMZ (Purdue Levels 3, 4, 5 and the OT DMZ).²⁹ The April 29, 2026 joint guide "Adapting Zero Trust Principles to Operational Technology" builds on zones and conduits rather than replacing them; the FBI was quoted saying "Resilience in OT isn't achieved through any single control."⁵⁵ A well-segmented plant with a strict jump host is most of the way there.

How long does this take?

For a plant the size of the example, about a year for the first full pass, mostly because changes wait for outage windows. The first 90 days remove the worst exposures without new equipment.

Hard questions

Should plants simply be air-gapped?

The case for: CISA's announcement of CI Fortify says "physical isolation remains the most risk-effective solution," and the same announcement said state-sponsored actors are "increasingly targeting critical infrastructure for pre-positioning."³ The 2024 Volt Typhoon advisory described Chinese state-sponsored actors positioning in IT networks "to enable lateral movement to OT assets," with access in some victims "for at least five years."⁵⁶ A plant with no network path to the outside cannot be reached that way.

The case against: Modern plants depend on data flowing out (quality records, production counts, customer portals, predictive maintenance) and on support flowing in (patches, vendor help, recipe changes). A plant that claims an air gap often has hidden bridges: a laptop, a USB drive, a cellular gateway, a dual-homed HMI. NIST's own guidance treats physical separation as something to consider "where ... required" alongside logical separation, not as the default for everything.²⁴

What the evidence shows: The guidance has moved toward a middle position: segment everything, keep the most vital systems (safety, the processes whose failure is unacceptable) physically separate, and be able to isolate the rest quickly through a tested, graduated plan. That is what CI Fortify asks for, and it is what the example plant built.³

Is the Purdue model still the right map?

The case that it is outdated: The model dates from the late 1980s and early 1990s, was not "originally intended as" a security architecture, and cloud-connected machines and IIoT do not fit neatly into its levels.²⁵ NIST's draft Rev. 4 expands coverage of IIoT with cloud convergence.⁵⁴

The case that it still works: Most threats still arrive through IT, the DMZ slows an intruder's movement, and plant traffic is predictable enough to allow-list.²⁵ NIST still uses it in its examples of firewall rules and treats it as one acceptable organizing model among several.⁵

What the evidence shows: The levels are a useful vocabulary; zones and conduits are the more flexible design tool. CISA's 2025 inventory guide and the 2026 zero trust guide are both built on zones and conduits, which can include a cloud-linked machine in its own zone without pretending it sits at a neat Purdue level.²⁵⁵

Who should pay for securing small manufacturers?

The case for public help: Small manufacturers sit in supply chains for defense, food and critical infrastructure, and a failure at one can spread; the UK government backed a GBP 1.5 billion loan guarantee for Jaguar Land Rover's supply chain after its 2025 incident.⁴⁵ Free programs (CISA services, MEP centers, the Idaho Falls training) exist because many small shops cannot afford consultants.

The case for the market: Security is a cost of doing business like insurance or safety equipment. Customers who want secure suppliers can require it in contracts and pay for it in prices, and public money can crowd out private services. Federal capacity also shifts: CISA's staffing fell from about 3,300 in January 2025 to about 2,400 by late 2025, according to a Cloud Security Alliance research note citing press reports, and a 2026 funding lapse paused some of its outreach.⁵⁷

What the evidence shows: The most effective early steps in this lesson (inventory, removing exposed connections, passwords, backups, manual drills) cost mostly staff time, and free help covers much of the know-how. The equipment in step 4 is where small plants most need either customer support or outside funding, and that is a policy choice no study settles.

Should OT monitoring be required outside the power grid?

The case for: The power sector now has a mandatory internal network monitoring standard (CIP-015-1), and Dragos's field data shows most industrial sites do not monitor well; 30 percent of its incident cases began as unexplained operational problems.³⁰¹ Without monitoring, owners often cannot tell a breakdown from an attack.

The case against: Manufacturing is enormously varied, from a ten-person machine shop to a chemical complex. A single monitoring mandate would cost small firms far more per employee than large ones, and monitoring without trained people to read alerts produces noise, not safety. Voluntary goals such as CISA's CPGs can be adapted plant by plant.

What the evidence shows: CIP-015-1 itself is risk-based and phased over years, with compliance starting Oct. 1, 2028, and it covers only higher-impact systems at first, which suggests that even regulators expect monitoring to be built gradually.³¹ No federal rule requires OT network monitoring at an ordinary manufacturer as of Oct. 28, 2026.

Where to go next

• CISA, Asset Inventory Guidance for Owners and Operators (Aug. 2025): Free 31-page joint guide from CISA and eight partner agencies. For plant managers and controls staff starting step 1: use its five steps and 14-attribute list as the template for your own inventory spreadsheet.
• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security: Free, 316 pages. The main U.S. reference for OT security. For engineers and IT staff: read Section 5.2.3 on network architecture and Section 6.2 for the protect controls; skim Appendix E for tools. Draft Rev. 4 is open for comment through Nov. 30, 2026.
• ISA Global Cybersecurity Alliance free resources on ISA/IEC 62443: Free overviews, including the Quick Start Guide, of the paid 62443 standards. For anyone who needs to talk zones, conduits and security levels with integrators before deciding whether to buy the standards.
• CISA Cyber Security Evaluation Tool (CSET) and free services: Free. CSET is a desktop tool for a structured OT and IT self-assessment; CISA's Cyber Hygiene scanning checks your internet-facing addresses. For small manufacturers doing the first 90 days on a small budget.
• CISA ICS training, including ICS301 in Idaho Falls: No tuition. Online courses first (ICS300 with 80 percent or better), then a four-day in-person course in Idaho Falls with a red team versus blue team exercise. For controls engineers and IT staff who will run the plan.
• TechHelp, Idaho's Manufacturing Extension Partnership center: Based at Boise State with partner universities. Lists cybersecurity among its services; ask what assessments and costs apply. For Idaho manufacturers who want local help planning and budgeting.
• NIST MEP, Cybersecurity Resources for Manufacturers: Where to Start: Free curated list by CSF function, including Malcolm (a free traffic analysis suite from INL and CISA) for monitoring. For small and mid-size manufacturers.

Still being checked (5 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• TechHelp's specific cybersecurity services and fees: its website lists Cyber Security among its services without detail, and its March 2026 award announcement does not describe them.
• The numbering of two steps (the tolerable-risk check and the documentation step) in the ISA/IEC 62443-3-2 workflow figure in the ISAGCA quick start guide; the lesson describes the order without step numbers.
• The label Level 3.5 for the industrial DMZ is common industry usage; it was not found in an official standard read for this lesson.
• CIP-015-1 calendar compliance dates (Oct. 1, 2028 and Oct. 1, 2030) are calculated from NERC's implementation plan; the CIP-015-2 phase dates (Oct. 1, 2029 replacement, phases through 2031) come from a Dragos summary, not from NERC's CIP-015-2 implementation plan, which was not read for this lesson.
• The order of the graduated isolation steps in the example plant's graphic follows a Zscaler summary of CI Fortify and the guidance's own worked example (read through a summary tool, Oct. 28, 2026); the sentence "physical isolation remains the most risk-effective solution" was found in CISA's announcement, not confirmed in the guidance PDF itself.

Last verified October 28, 2026. General education, not legal, engineering, safety or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. Dragos, "Launched: 9th Annual Dragos OT Cybersecurity Year in Review," blog post, Feb. 17, 2026, and the accompanying Dragos press release on its 2026 Year in Review (covering 2025): 81 percent of assessments found poor IT/OT segmentation; 46 percent had adequate OT network monitoring; 73 percent of all-time incident response cases involved compromised VPN or jump host credentials; 30 percent of cases began as unexplained operational problems; 119 ransomware groups hit about 3,300 industrial organizations, with manufacturing more than two-thirds of victims; quote from CEO Robert M. Lee. Vendor data, attributed to Dragos (read Oct. 28, 2026). Read it online. ↩
2. CISA, EPA, NSA, FBI, Australia's ASD's ACSC, Canadian Centre for Cyber Security, Germany's BSI, NCSC-NL and NCSC-NZ, Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators, Aug. 13, 2025, pp. 8 to 12 (definition, five steps, 14 high-priority attributes, zones and conduits, life cycle management) and the sample taxonomies in Appendices B to D (three criticality classes) (read Oct. 28, 2026). Read it online. ↩
3. CISA, email bulletin announcing "CI Fortify: Advice for isolating vital systems," released with Australia's ASD's ACSC, the FBI and international partners, July 28, 2026 (source of the quoted sentences); and ASD's ACSC and partners, "CI Fortify: Advice for isolating vital systems" (PDF at cyber.gov.au), worked example of a graduated isolation plan (read Oct. 28, 2026). Read it online. ↩
4. CISA, FBI, EPA and DOE, "Primary Mitigations to Reduce Cyber Threats to Operational Technology," TLP:CLEAR fact sheet, as of May 6, 2025 (read Oct. 28, 2026). Read it online. ↩
5. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Section 5.2.3.1, "Network Architecture," pp. 71 to 73 (segmentation, Purdue as one option, adjacent-zone firewall rules, outbound rules, unidirectional gateways) (read Oct. 28, 2026). Read it online. ↩
6. ISA Global Cybersecurity Alliance, "Quick Start Guide: An Overview of ISA/IEC 62443 Standards," June 2020 (zone and conduit definitions, the Part 3-2 risk assessment workflow figure, security levels, foundational requirements). Free (read Oct. 28, 2026). Read it online. ↩
7. Manufacturing Dive, report on IBM's X-Force Threat Intelligence Index 2026, Feb. 26, 2026 (manufacturing 27.7 percent of incidents in 2025; top initial access vectors) (read Oct. 28, 2026). Read it online. ↩
8. U.S. Senate Committee on Homeland Security and Governmental Affairs, "Threats to Critical Infrastructure: Examining the Colonial Pipeline Cyber Attack," hearing, June 8, 2021, S. Hrg. 117-429, testimony and answers of Colonial Pipeline CEO Joseph Blount (read Oct. 28, 2026). Read it online. ↩
9. U.S. Department of Justice, "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace," Oct. 19, 2020 (read Oct. 28, 2026). Read it online. ↩
10. Merck & Co. v. Ace American Insurance Co., N.J. Super. Ct. App. Div., No. A-1879-21, decided May 1, 2023; and Merck & Co., Form 10-K for fiscal 2017 (filed with the SEC), describing the June 27, 2017 attack's disruption of manufacturing, research and sales operations (read Oct. 28, 2026). Read it online. ↩
11. The Record, "Mondelez and Zurich reach settlement in NotPetya cyberattack insurance suit," Oct. 31, 2022 (read Oct. 28, 2026). Read it online. ↩
12. Norsk Hydro, "Cyber attack," company page on the March 19, 2019 ransomware attack and its estimated NOK 800 million impact (read Oct. 28, 2026). Read it online. ↩
13. Verizon, 2025 Data Breach Investigations Report, Manufacturing (NAICS 31-33) section, pp. 79 to 80 (read Oct. 28, 2026). Read it online. ↩
14. U.S. Bureau of Labor Statistics, Current Employment Statistics, Idaho, series SMS16000003000000001 (manufacturing, 77,500 in September 2026, preliminary) and SMS16000000000000001 (total nonfarm, 890,100), seasonally adjusted, pulled Oct. 28, 2026; the percentage is this module's calculation (read Oct. 28, 2026). Read it online. ↩
15. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Section 6.2.1.2 (physical security considerations, including cabling, p. 101) and Section 6.2.1.3, "Network Segmentation and Isolation (PR.AC-5)," pp. 102 to 103 (VLANs and separate switches, recording traffic before writing rules, deny-all permit-by-exception, limits of isolation) (read Oct. 28, 2026). Read it online. ↩
16. ExecutiveGov, report on the UK NCSC-led joint guidance "Creating and Maintaining a Definitive View of Your Operational Technology Architecture" (Sept. 29, 2025), published Oct. 2, 2025 (read Oct. 28, 2026). Read it online. ↩
17. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Appendix C.3.4, "Accidental Events," p. 184, describing two ping sweep incidents and citing a Sandia National Laboratories report (read Oct. 28, 2026). Read it online. ↩
18. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Appendix E.2 (data historians as event sources, E.2.2 Passive Scanning and E.2.3 Active Scanning), pp. 208 to 209 (read Oct. 28, 2026). Read it online. ↩
19. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Section 6.1.1 (asset management), 6.1.1.1 (Mapping Data Flows) and 6.1.1.2 (Network Architecture Documentation), pp. 91 to 92 (read Oct. 28, 2026). Read it online. ↩
20. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Section 6.2.10, "Remote Access," pp. 122 to 124 (read Oct. 28, 2026). Read it online. ↩
21. Idaho National Laboratory, "Consequence-Driven Cyber-Informed Engineering," web page, and INL, "CCE Phase 1-4 Reference Document" (phase reports dated May 5, 2020; Phase 1 is Consequence Prioritization) (read Oct. 28, 2026). Read it online. ↩
22. CISA (then NCCIC), Malware Analysis Report MAR-17-352-01, "HatMan: Safety System Targeted Malware," Dec. 18, 2017. The "foreign refinery" description comes from the Justice Department's March 24, 2022 release on the related indictment (read Oct. 28, 2026). Read it online. ↩
23. International Society of Automation, "ISA/IEC 62443 Series of Standards," web page listing current editions (including ANSI/ISA-62443-3-2-2020 and ISA-62443-3-3-2013), member viewing of most ISA standards, free ISAGCA resources, and ISA's prohibition on entering its intellectual property into AI tools (read Oct. 28, 2026). Read it online. ↩
24. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Executive Summary, p. 4 (list of recommended protections, including a DMZ architecture, physical versus logical separation, MFA for remote access and disabling unused ports and services after testing) (read Oct. 28, 2026). Read it online. ↩
25. Tripwire, "Revisiting the Relevance of the Industrial DMZ (IDMZ)," undated web article (vendor analysis; says the Purdue Model was introduced "over 30 years ago") (read Oct. 28, 2026). Read it online. ↩
26. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Appendix E.1.1, "Firewalls," and E.1.2, "Unidirectional Gateways," p. 207 (read Oct. 28, 2026). Read it online. ↩
27. FBI, CISA, NSA, EPA, DOE, U.S. Cyber Command's Cyber National Mission Force and partners, Joint Cybersecurity Advisory AA26-097A, "Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure," April 7, 2026, updated July 22, 2026 (read Oct. 28, 2026). Read it online. ↩
28. Zscaler, blog post on what CI Fortify means for OT operators, 2026, summarizing the graduated isolation sequence (vendor summary; the order in this lesson's graphic follows it) (read Oct. 28, 2026). Read it online. ↩
29. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Sections 5.2.3.2 (Centralized Logging), 5.2.3.3 (Network Monitoring) and 5.2.3.4 (Zero Trust Architecture), pp. 73 to 75 (read Oct. 28, 2026). Read it online. ↩
30. Federal Energy Regulatory Commission, Order No. 907, "Critical Infrastructure Protection Reliability Standard CIP-015-1, Cyber Security, Internal Network Security Monitoring," final rule, Docket No. RM24-7-000, approved June 26, 2025, 90 Fed. Reg. 28889 (July 2, 2025), effective Sept. 2, 2025, including the directive to extend monitoring to EACMS and PACS outside the electronic security perimeter (read Oct. 28, 2026). Read it online. ↩
31. NERC, Project 2023-03 Internal Network Security Monitoring, CIP-015-1 Implementation Plan, February 2024 (36-month effective date rule and 24-month extension to other medium impact systems); the Oct. 1, 2028 and Oct. 1, 2030 calendar dates are this module's calculation, consistent with Dragos's reporting (read Oct. 28, 2026). Read it online. ↩
32. Dragos, "NERC CIP-015-1 Is Approved: What Asset Owners Need to Do," blog post (vendor summary of requirements R1 to R3) (read Oct. 28, 2026). Read it online. ↩
33. FERC, "Commission Information Collection Activities (FERC-725B); Comment Request; Extension," 91 Fed. Reg. 64921 (Oct. 13, 2026), stating that about 1,706 unique U.S. entities are subject to CIP standards as of August 2026, that NERC petitioned for approval of CIP-015-2 on June 18, 2026, and that CIP-015-2 reflects changes implemented through the order in Docket RD26-6-000 issued Aug. 10, 2026; CIP-015-2 phase dates as summarized in Dragos, "FERC Approves NERC CIP-015-2: What It Means for Your INSM Program" (vendor summary) (read Oct. 28, 2026). Read it online. ↩
34. NIST Manufacturing Extension Partnership, "Where to Start," cybersecurity resources for manufacturers (Malcolm, CSET, ISASecure list of products certified to ISA/IEC 62443), and NIST MEP, "Cybersecurity Resources for Manufacturers," last updated Sept. 30, 2025 (what MEP Centers can do; contact mepcyber@nist.gov) (read Oct. 28, 2026). Read it online. ↩
35. CISA and FBI, "Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators," fact sheet, Sept. 23, 2026 (read Oct. 28, 2026). Read it online. ↩
36. CISA, NSA, FBI, MS-ISAC and the Israel National Cyber Directorate, "Guide to Securing Remote Access Software," June 6, 2023 (read Oct. 28, 2026). Read it online. ↩
37. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Section 2.4, "Comparing OT and IT System Security," pp. 29 to 30 (planned outages, vendor support and third-party products) (read Oct. 28, 2026). Read it online. ↩
38. WaterWorld, "Aliquippa, Pennsylvania suffers cyberattack on booster station PLC," November 2023, quoting authority chairman Matthew Mottes (read Oct. 28, 2026). Read it online. ↩
39. TechCrunch, "CISA confirms hackers targeted over 100 US water systems during July," Aug. 26, 2026 (read Oct. 28, 2026). Read it online. ↩
40. Tenable, "Coordinated cyberattack on Minnesota water utilities: what you need to know," blog post, 2026 (Plymouth, Braham and Maple Plain details; vendor summary of public reports) (read Oct. 28, 2026). Read it online. ↩
41. NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023, Section 6.2.4.3, "Backups (PR.IP-4)," pp. 112 to 113, and Section 5.3.2.1, "Data, Applications, and Infrastructure," p. 80 (backup-in-depth) (read Oct. 28, 2026). Read it online. ↩
42. NIST Computer Security Resource Center, Operational Technology Security project news page, listing NIST SP 1339, "OT Backup Quick Start Guide," published by the National Cybersecurity Center of Excellence on June 17, 2026 (read Oct. 28, 2026). Read it online. ↩
43. FBI, CISA, NSA, EPA and the Israel National Cyber Directorate, Joint Cybersecurity Advisory AA23-335A, "IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors," Dec. 1, 2023 (read Oct. 28, 2026). Read it online. ↩
44. NSAI Standards shop, product listing for IEC 62443-2-1:2024 (published Aug. 7, 2024), price shown Oct. 28, 2026 (read Oct. 28, 2026). Read it online. ↩
45. JLR, "JLR performance impacted in challenging quarter," media release, November 2025 (phased restart from Oct. 8, 2025; GBP 196 million in incident costs); and GOV.UK, "Government backs Jaguar Land Rover with GBP 1.5 billion loan guarantee," Sept. 28, 2025 (read Oct. 28, 2026). Read it online. ↩
46. BleepingComputer, "Clorox says cyberattack caused $49 million in expenses," Feb. 3, 2024, reporting the company's quarterly SEC filing; see also Clorox's Form 10-K for fiscal 2024 (filed Aug. 8, 2024) (read Oct. 28, 2026). Read it online. ↩
47. Boise State University, "TechHelp receives federal award to continue supporting Idaho manufacturers," March 25, 2026 (read Oct. 28, 2026). Read it online. ↩
48. TechHelp, home page, service list ("Cyber Security" listed under more services) and notice of a CMMC assessment project with Boise State's Institute for Pervasive Cybersecurity (read Oct. 28, 2026). Read it online. ↩
49. CISA, "#StopRansomware: Services" (Cyber Hygiene vulnerability scanning, CSET and other free services) (read Oct. 28, 2026). Read it online. ↩
50. CISA, "Advanced Cybersecurity for Industrial Control Systems (ICS301)," course page; and Idaho National Laboratory, "Industrial Control Systems Cybersecurity Training" (more than 200 sessions of the 301 course) (read Oct. 28, 2026). Read it online. ↩
51. CISA, "Cybersecurity Performance Goals 2.0 for Critical Infrastructure," alert, release date Dec. 11, 2025 (read Oct. 28, 2026). Read it online. ↩
52. CISA, NSA, FBI, EPA, TSA and international partners, "Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products," Jan. 13, 2025 (read Oct. 28, 2026). Read it online. ↩
53. CISA (then ICS-CERT), ICS Alert IR-ALERT-H-16-056-01, "Cyber-Attack Against Ukrainian Critical Infrastructure," updated July 20, 2021 (read Oct. 28, 2026). Read it online. ↩
54. NIST, "Guide to Operational Technology (OT) Security: NIST Requests Comments on Draft SP 800-82r4," Sept. 21, 2026 (comments through Nov. 30, 2026) (read Oct. 28, 2026). Read it online. ↩
55. CISA, email bulletin announcing "Adapting Zero Trust Principles to Operational Technology," released with the Department of War, DOE, FBI and State Department, April 29, 2026 (read Oct. 28, 2026). Read it online. ↩
56. CISA, NSA, FBI and partners, Joint Cybersecurity Advisory AA24-038A, "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure," Feb. 7, 2024 (read Oct. 28, 2026). Read it online. ↩
57. Cloud Security Alliance, CSA Labs research note, "CISA at 38%," April 23, 2026, citing Axios and Nextgov reporting on CISA staffing and the 2026 funding lapse (press-based figures) (read Oct. 28, 2026). Read it online. ↩
58. Idaho Statesman, republished by East Idaho News, Sept. 8, 2026, on Idaho's Cyber Resilience Operation Center and the summer 2026 water attacks (read Oct. 28, 2026). Read it online. ↩