Organisations should isolate OT from IT with segmentation that limits lateral movement, then add tightly controlled pathways for monitoring, maintenance, and approved business traffic. The goal is not perfect isolation at any cost. It is reducing exposure while preserving safety and uptime. OT environments need controls that account for legacy systems, continuous operations, and the risk that even routine changes can interrupt physical processes.
Why IT and OT Segmentation Is a Control, Not a Diagram
Segmenting IT and OT is about controlling how trust, commands, and credentials move across environments, not just drawing a boundary on a network map. In mixed environments, the main security value is reducing the blast radius of compromise so a workstation issue, phishing event, or supplier compromise does not automatically reach systems that keep production, safety, or physical processes running. That matters because OT often contains legacy protocols, long-lived assets, and maintenance patterns that do not tolerate frequent redesign.
Good segmentation also supports governance: it makes it easier to define approved pathways for remote support, logging, engineering access, and business data flows, then inspect those pathways consistently. A weak design often fails when teams create exceptions faster than they document them, or when temporary access becomes a permanent bridge. Guidance in NIST SP 800-207 Zero Trust Architecture is useful here because it reinforces the idea that access should be explicitly governed, not assumed from network location. In practice, many organisations discover their real segmentation gaps only after remote maintenance paths or shared admin tooling have already become routine conduits between IT and OT.
How to Segment Without Breaking Monitoring or Maintenance
Effective IT and OT segmentation starts with understanding traffic intent, not just device type. Teams need to separate what must cross the boundary from what merely happens to cross it. Common necessities include historian replication, alert forwarding, patch validation, remote vendor support, and tightly scoped engineering access. Everything else should be denied by default or forced through a controlled intermediary. That usually means a layered model with a corporate IT zone, a demilitarised intermediary zone, and an OT zone that receives only approved flows.
The operational challenge is that OT traffic is often more fragile than IT traffic. Protocol inspection may be limited, authentication may be weak or absent, and some systems expect long-lived sessions or broadcast-style discovery. For that reason, segmentation controls need to be tested against plant realities before enforcement. If a rule blocks time synchronisation, controller communication, or monitoring telemetry, the result can be worse visibility or even process disruption.
- Define allowed flows by business purpose and safety need, not by convenience.
- Use jump hosts or controlled gateways for interactive access instead of direct connectivity.
- Restrict vendor access to time-bound, logged sessions with strong approval.
- Separate monitoring paths from control paths so visibility does not require broad trust.
- Validate changes during maintenance windows and confirm fallback procedures before tightening rules.
Where segmentation becomes most effective is at the choke points: identity, remote access, protocol mediation, and logging. If those choke points are bypassed with flat routing, unmanaged VPNs, or shared credentials, the architecture stops meaningfully reducing lateral movement. The MITRE ATT&CK Enterprise Matrix is useful for thinking about how an attacker moves after initial compromise, but the same lesson applies defensively: every unnecessary route between IT and OT becomes an opportunity for progression. This guidance breaks down when the organisation has not mapped critical dependencies well enough to distinguish essential operational traffic from legacy exception paths.
When the Normal Model Breaks Down in Legacy Plants and Hybrid Sites
Tighter segmentation often increases operational overhead, requiring organisations to balance reduced lateral movement against the cost of more exceptions, more testing, and slower troubleshooting.
Legacy OT environments are rarely clean enough for a single, universal segmentation pattern. Some plants contain vendors with proprietary tools, flat legacy segments that cannot be changed quickly, or safety systems whose availability matters more than elegant zone design. In those cases, the right answer is often partial segmentation with compensating controls, not a forced redesign that risks uptime. That is a governance decision as much as a network one.
Hybrid sites also introduce edge cases where IT and OT overlap through shared services, cloud reporting, or remote operations. Guidance and industry practice are still evolving on how much dependency on shared identity, remote administration, and central monitoring is acceptable before the trust boundary becomes too porous. The important question is whether the exception is bounded, observable, and revocable. If not, it is not really an exception.
One common mistake is treating segmentation as complete once VLANs or firewall rules exist. In reality, the operational test is whether an attacker, a compromised contractor account, or a careless administrator can still reach sensitive OT functions through an approved path. Another is over-segmenting so aggressively that teams bypass controls to keep the plant running. That creates shadow routes and undocumented trust, which are harder to govern than the original flat network. The best designs make the safe path the easiest path, while still allowing the plant to operate.
Risk and Threat Considerations
The material risk is not only exposure from IT compromise, but also the persistence of trusted pathways that enable lateral movement into OT once an attacker gains a foothold elsewhere. Segmentation fails when remote access, admin tooling, or shared services create routes that are broader than intended or poorly monitored.
Failure mechanism: Attackers commonly exploit flat internal trust, weak segmentation enforcement, and over-privileged remote access to move from user networks into operational zones. If firewall rules, jump hosts, or monitoring gateways are permissive, they can become transit points rather than barriers.
Impact: The consequence can be loss of visibility, manipulation of industrial processes, interruption of production, or compromise of safety-relevant systems. Even when operations continue, weak segmentation can make containment and recovery materially harder after an incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 — Access Permissions and Authorisations | Segmentation is only effective when access paths are tightly authorised. |
| DE.CM-1 — Monitoring for Unauthorized Personnel, Connections, Devices and Software | Boundary monitoring is central to detecting unexpected cross-zone movement. | |
| PR.PT-4 — Communications and Control Networks Segregated | The question directly concerns separating IT and OT communications paths. | |
| Recommendation — Restrict IT-to-OT pathways to explicitly approved, least-privilege access routes. Monitor cross-zone traffic and alert on unauthorised connections into OT. Segregate OT communications from IT networks with controlled intermediary pathways. | ||
| CIS Controls v8 | 6.3 — Manage Default Accounts | Shared and default credentials often undermine segmented environments. |
| 12.4 — Network Boundary Defense | Boundary defence is the core control family for limiting lateral movement. | |
| Recommendation — Eliminate default and shared accounts that bypass segmentation boundaries. Enforce boundary controls that deny unapproved IT-to-OT traffic paths. | ||
| MITRE ATT&CK | T1021 — Remote Services | Remote administration paths are a common route for lateral movement into OT. |
| Recommendation — Hunt for and harden remote service paths that could carry lateral movement into OT. | ||
Practitioner Guidance
What to prioritise: Start with the highest-consequence OT assets and the specific IT-to-OT flows they actually require. If a connection does not support monitoring, maintenance, safety, or an approved business function, treat it as a candidate for removal rather than a convenience to preserve.
What to verify: Before trusting a segment boundary, verify the exact traffic paths, the authentication method at each hop, and who can approve exceptions. If remote support depends on shared credentials, broad VPN reach, or undocumented vendor access, the segmentation model is weaker than it appears.
What practitioners underestimate: The hardest part is not blocking obvious east-west traffic, but controlling the small number of “necessary” pathways that remain. Those paths need stronger logging, tighter ownership, and regular revalidation because they are where operational need and adversarial opportunity most often meet.
Practitioner takeaway: Good IT and OT segmentation is measured by how little trust remains after the boundary is enforced, not by how many diagrams it improves.
Related resources from NHI Mgmt Group
- How can organisations reduce lateral movement without breaking normal operations?
- How should organisations govern identity in OT environments without disrupting operations?
- How should security teams segment OT networks without disrupting production?
- How should organisations reduce lateral movement in hybrid networks?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
