Partial coverage creates a governance gap, not just a technical one. Attackers and misconfigurations tend to land in the uncontrolled remainder, especially on embedded devices, remote sites, or legacy zones that cannot host the same enforcement method as the rest of the estate. The control looks present on paper but fails where it matters operationally.
Where partial OT segmentation fails in a water utility
Segmentation only works when the enforcement boundary matches the real estate. In a water utility, the leftover zones often include embedded controllers, remote pump sites, vendor-maintained assets, and older segments that do not support the same enforcement model. That creates a split estate: one part is constrained, the other remains reachable in ways the control design did not intend.
That gap matters because attackers do not need the whole environment, only one weakly governed path. A design that is strong on the core network but inconsistent across plants, sites, or legacy islands still leaves a route for unauthorized access, lateral movement, and misconfiguration to persist.
Why “partial” segmentation is a governance problem, not just an engineering one
Partial coverage changes the control from a boundary into an exception-management problem. If the utility cannot explain which assets are inside the protected zone, which are outside, and who owns the exceptions, the segmentation policy becomes an assumption rather than an enforceable security control.
That is especially important in operational technology, where the same rule set is often not deployable everywhere. Remote sites may depend on narrow communications paths, legacy devices may not tolerate new agents or inline inspection, and operational uptime pressure can turn temporary exceptions into permanent exposure.
For OT programs, the real test is whether segmentation aligns to asset criticality and operational dependency, not whether the diagram looks complete. NIST SP 800-82 Rev 3 treats OT architecture and segmentation as part of a broader operational security design, not a box to tick once per perimeter.
What attackers and misconfigurations exploit in the uncovered remainder
The uncontrolled remainder tends to become the easiest place to land. Attackers look for exposed remote access paths, weak vendor channels, shared credentials, flat legacy segments, and devices that were never meant to sit behind modern control layers. Even if the main production zone is segmented well, a weak adjacent zone can still provide a bridge inward.
Misconfigurations create the same effect without an attacker. A stale rule, an unreviewed route, a maintenance exception, or a forgotten site connection can quietly restore reachability between zones that were meant to be separated. Once that happens, the control is only partial in theory and fragile in practice.
This is why utilities often pair segmentation with least-privilege connectivity models. NIST SP 800-207 Zero Trust Architecture is useful here because it frames access as continuously verified and narrowly granted, which reduces the damage from any zone that cannot be fully normalized.
Legacy and remote OT zones also deserve threat-focused monitoring because they are often where exposure accumulates first. CISA Industrial Control Systems resources are a practical reference for the kind of industrial environment assumptions that make partial segmentation brittle.
How to judge whether the control is actually working
The question is not whether segmentation exists, but whether it is consistent enough to reduce blast radius. A useful assessment asks three things: can every asset be assigned to a protected zone, can every exception be justified, and can the team prove that the unprotected remainder is known and monitored?
If the answer is no, the control is exposing a governance gap. That usually shows up as inconsistent enforcement across sites, unclear ownership for embedded devices, or a long tail of “temporary” exceptions that were never retired. In that state, the utility may believe it has a segmentation program while actually operating a patchwork of control strength.
Where the remainder contains remote access, vendor maintenance paths, or service interfaces, review the control path as if it were a privileged access problem, because in practice it is. Partial segmentation fails when the exception path becomes the real operating path.
Risk and Threat Considerations
Partial ot segmentation increases the chance that compromise will concentrate in the least visible part of the estate. The danger is not only direct intrusion, but also the way one unsegmented site, legacy subnet, or remote access bridge can undermine the separation assumed by the rest of the design.
Failure mechanism: Attackers or misconfigurations use the unprotected remainder as a foothold, then move toward higher-value OT assets through weakly governed trust paths, stale exceptions, or legacy connectivity.
Impact: The utility loses containment, and an incident that should have been local can become a broader operational outage, safety event, or recovery problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | Partial OT segmentation is about enforcing and limiting flows between zones. |
| AC-6 — Least Privilege | Uncovered zones often persist through overly broad access paths and exceptions. | |
| Recommendation — Enforce information flow boundaries between OT zones and document exceptions. Reduce access paths to the minimum required for each OT segment. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Continuous verification and narrow access reduce damage from uneven segmentation. |
| Recommendation — Apply zero-trust principles to shrink trust in legacy and remote OT paths. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Segmentation depends on knowing and controlling network boundaries and exceptions. |
| Recommendation — Maintain an accurate map of OT network boundaries and exception routes. | ||
| ISO/IEC 27001:2022 | A.8.20 — Network Security | Network separation and boundary protection are central to segmented OT estates. |
| Recommendation — Implement and review network separation controls across OT zones. | ||
Practitioner Guidance
What to prioritise: Inventory the exceptions first, not the ideal architecture. The highest-value work is to identify which sites, devices, and vendor paths cannot currently support the standard segmentation method and to treat those areas as separate control problems.
What to verify: Confirm that every uncontrolled zone has named ownership, documented connectivity, and a review date. If a segment cannot be enforced in the same way as the rest of the estate, it still needs compensating visibility and a defined path to reduction.
What good looks like: The utility can explain where segmentation is fully enforced, where it is compensating, and where it is absent without ambiguity. The important signal is not perfect uniformity, but defensible coverage with no hidden remainder.
Practitioner takeaway: Treat partial segmentation as an exposure-mapping exercise. The real security question is whether the uncovered remainder is small, understood, and governed, or large enough to become the path an attacker would choose first.
Related resources from NHI Mgmt Group
- What breaks when passwordless sign-in only covers part of the estate?
- What breaks when passwordless is rolled out to only part of an application estate?
- How should security teams control vendor access in water utility OT environments?
- What breaks when OT segmentation depends on static network rules?