Water utility OT segmentation evaluation: what teams should ask

At a glance

What this is: This is an evaluation guide for water utility OT segmentation that compares seven approaches, 14 vendor questions, and a proof-of-value protocol.

Why it matters: It matters because OT segmentation only reduces risk when it can enforce consistently across mixed assets, remote sites, and the utility's own operating constraints.

Context

Water utility segmentation is not a generic network design problem. It is a governance and enforcement problem where the same control can succeed in one plant and fail in another because of firmware, topology, remote connectivity, and the way operational devices are managed.

The article is grounded in OT security evaluation rather than identity governance, but it still has an access-control angle: segmentation works by deciding what can talk to what, and that decision has to survive mixed assets, shared infrastructure, and sites that cannot take an agent. For water and wastewater teams, the practical question is whether a control can be enforced where the process actually runs.

Key questions

Q: What breaks when OT segmentation only covers part of a water utility estate?

A: Partial coverage creates a governance gap, not just a technical one. Attackers and misconfigurations tend to land in the uncontrolled remainder, especially on embedded devices, remote sites, or legacy zones that cannot host the same enforcement method as the rest of the estate. The control looks present on paper but fails where it matters operationally.

Q: Why does OT segmentation in water utilities need to be evaluated site by site?

A: Because enforcement depends on local conditions such as firmware, network gear, topology, remote connectivity, and whether the asset can support an agent or admission control. A method that works in one plant may be only observational in another, so procurement has to compare real site coverage rather than assume estate-wide control.

Q: How do teams know whether IT/OT segmentation is actually working?

A: Teams know segmentation is working when an incident on corporate IT does not alter production traffic, control-system availability, or the ability to maintain safe operations. A valid test is whether cross-boundary access is limited to approved identities and whether blocked paths remain blocked during a live containment drill.

Q: Should utilities prioritise enforcement coverage or lower licensing cost when buying segmentation?

A: Coverage comes first when the goal is risk reduction. A lower-cost option that cannot govern remote sites, embedded devices, or mixed plant assets leaves the most exposed parts of the estate untouched, while a more expensive control that actually enforces can replace hidden operational risk with measurable containment.

Technical breakdown

How OT segmentation differs from perimeter firewalls

OT segmentation is not just a border control between IT and OT. It can be implemented through VLANs and ACLs, firewall zones, admission control, host agents, identity-based policy, or unidirectional gateways, and each mechanism makes different assumptions about topology, visibility, and enforcement. The important distinction is whether policy is anchored to location, device identity, network state, or a host runtime. In water environments, that matters because historians, engineering workstations, remote sites, and embedded devices rarely fit a single clean model. The right mechanism is the one that can enforce under your actual plant conditions, not the one that looks neat in a diagram.

Practical implication: evaluate enforcement mechanics against your site inventory before comparing feature lists.

Why discovery and baselining are part of the control

Several segmentation approaches depend on an initial discovery period before enforcement. In OT, that period is not administrative overhead. It is how the system learns device identity, traffic patterns, and role separation well enough to avoid blocking legitimate plant activity. Baselines are especially important where assets cannot run an agent, where traffic is infrequent, or where an IT device performs an OT function. If the data sources are stale or incomplete, classification quality drops and policy accuracy follows. A segmentation tool that cannot explain what it saw before it enforced is not ready for production OT traffic.

Practical implication: require simulated policy and a written baselining plan before any enforcement cutover.

What enforcement gaps look like in remote and mixed-site estates

Water utilities often have a boundary firewall, passive monitoring, and one internal enforcement mechanism, but that last layer becomes decisive once the estate spans multiple plants and remote sites. A control that only works on managed infrastructure or only at the plant boundary leaves lateral movement paths inside the OT zone untouched. Likewise, controls that depend on agents or detailed posture checks struggle on PLCs, RTUs, and other embedded equipment. That is why coverage percentage, compatibility lists, and enforcement method matter more than broad claims about segmentation. The issue is not whether the tool can see the estate, but whether it can actually govern it.

Practical implication: map which sites are enforce-capable versus observe-only before you commit to a control model.

NHI Mgmt Group analysis

OT segmentation is a control-selection problem, not a category choice. The article shows that utilities do not need another abstract debate about whether segmentation is worthwhile. They need to know which enforcement model can survive embedded devices, remote backhaul, and mixed plant architecture. That is a procurement discipline problem as much as a security one, and the winning control is the one that matches operational reality rather than the cleanest diagram.

Coverage is the real governance metric for OT segmentation. A tool that covers only the easy subset of the estate creates a false sense of containment because the uncontrolled remainder becomes the attack path. For water and wastewater environments, coverage must be measured against the actual device list and site list, not against a marketing architecture. Practitioners should treat partial enforcement as a risk acceptance decision, not a technical footnote.

Baseline quality is the hidden determinant of segmentation credibility. The article makes clear that simulated policy, discovery periods, and asset classification are not implementation extras. They are the only way to tell whether a segmentation model understands the environment well enough to govern it. In operational technology, an inaccurate label can be as harmful as no policy at all, so teams should interrogate how identity, asset, and traffic data are fused before enforcement starts.

For water utilities, segmentation now sits inside resilience planning. The article ties vendor evaluation to EPA assessment evidence, AWIA expectations, and site-specific operational constraints. That means segmentation can no longer be bought as a point control and left at the network team. It has to produce artifacts that support resilience, incident response, and regulatory review, which makes evidence quality part of the control itself.

Remote sites expose the gap between visibility and authority. Passive monitoring can describe what is happening, but it does not stop unsafe movement across a distribution estate. Where utilities still rely on observation-only tooling at remote pump stations, lift stations, or tank sites, they are preserving the illusion of coverage while leaving governance fragmented. Practitioners should insist on a control model that makes authority explicit at every site that matters.

What this signals

Coverage is the control, not the brochure. Water utilities should treat OT segmentation as a question of enforcement reach across plants, remote sites, and embedded assets. If a control cannot govern the full estate, it is only partial visibility with a security label attached.

Discovery and simulation are the trust boundary. In mixed OT environments, the quality of policy is determined before enforcement starts, when traffic baselines and classification rules are established. That means practitioners should evaluate evidence quality and cutover process as part of the control itself, not as project admin.

Remote sites force a governance decision. When a platform can only observe some locations and enforce at others, teams are already making a risk acceptance choice. The right response is to map those gaps explicitly and decide whether segmentation, boundary firewalls, or a layered model is the safer operational pattern.

For practitioners

• Define enforcement by site, not by product Build your evaluation around the exact plants, pump stations, lift stations, and tank sites you run. Ask each vendor where it enforces, where it only observes, and which sites remain outside direct control.
• Require simulated policy before enforcement Do not accept a live cutover as the first proof. Ask for policy simulation against observed traffic, a written baselining period, and acceptance criteria that you control rather than the vendor.
• Price the full operational burden Compare three-year cost across licensing, hardware, support, integration work, and the staff time needed to maintain rules across multiple sites. Hidden operational effort is part of the control cost.
• Test the control against incompatible assets Challenge each approach with PLCs, RTUs, analyzers, and other embedded devices that cannot run an agent. The answer should show how policy still applies when the asset cannot host software.
• Collect evidence for resilience and audit use Ask for outputs that can support AWIA reviews, state sanitary surveys, and incident response documentation. A segmentation platform that cannot produce useful evidence is incomplete for a regulated utility.

Key takeaways

• OT segmentation in water utilities fails when enforcement does not reach the devices and sites that actually carry operational risk.
• The article's core evaluation method is to compare coverage, prerequisites, and proof-of-value evidence against the utility's own estate, not a generic datasheet.
• Utilities should treat discovery, simulation, and site-by-site compatibility as governance requirements, because they determine whether segmentation can be trusted in production.

Key terms

• OT Segmentation: The practice of separating industrial systems into controlled zones so traffic and access can be restricted by operational need. In effective programmes, segmentation depends on trustworthy asset identity, accurate communication mapping, and enforced rules that reflect how the environment really behaves.
• Discovery Period: A discovery period is the time a segmentation platform spends observing traffic and asset behavior before it begins enforcement. It is used to build a baseline, classify devices, and reduce the chance of blocking legitimate industrial processes when policy is turned on.
• Proof Of Value: A proof of value is a controlled evaluation that tests a security product against the buyer's own assets, traffic, and operating constraints. In regulated environments, it should prove enforcement coverage, operational fit, rollback safety, and the evidence the organisation will need later.
• Enforcement Coverage: Enforcement coverage is the portion of an estate that a control can actively govern, not merely observe. In OT environments, it matters because visibility without authority leaves unmanaged devices, remote sites, and embedded assets outside the segmentation boundary.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course if your programme needs a stronger foundation in identity governance across human and machine access.