Use network segmentation, strict allowlisting, and an accurate asset inventory to separate OT from enterprise IT and limit lateral movement. Place remote access through monitored jump hosts or industrial firewalls, restrict protocols to what each control system needs, and map dependencies before making changes. Shared services should have tightly scoped routes, not flat trust.
Segment OT as a trust boundary, not just a VLAN design
When OT and IT share infrastructure, the main security goal is to prevent routine enterprise traffic from becoming a path into control systems. Network segmentation should be designed around process criticality, protocol needs, and permitted conduits, so that only the connections required for operations survive. OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide explains how to turn that principle into enforceable zones and conduits.
That means treating shared services, historians, engineering workstations, and management networks as explicitly scoped dependencies rather than implicit trust. If a route is not needed for a control function, it should not exist. If a protocol is needed, it should be constrained to the exact source, destination, and port combination the system requires.
Why inventory and allowlisting matter before changes go live
Segmentation only works when teams know what actually exists on the network and what each asset depends on. An accurate OT inventory lets you identify hidden controllers, shadow paths, legacy links, and protocol exceptions before a firewall rule or network change breaks operations. OT Asset Visibility Guide is useful here because visibility is the prerequisite for safe restriction.
Strict allowlisting is the practical control that follows from that visibility. In OT, broad permit rules and permissive east-west traffic often survive because they are operationally convenient, but they also make lateral movement easier and incident containment much harder. Good allowlisting is narrow, documented, and tied to an owner who can explain why each dependency exists.
Remote access and shared services need tight chokepoints
Remote administration is often the fastest way to undermine a shared OT and IT environment if it bypasses segmentation. The safer pattern is to force remote work through monitored jump hosts or industrial firewalls, then log and time-bound the session so operators can see who accessed what and when. OT Remote Access Guide shows the operational shape of that model.
Shared services such as authentication, file transfer, patch staging, and monitoring should be reachable only through tightly scoped routes, not flat trust relationships. The question to ask is whether the shared service is acting as a controlled broker or as an unexamined bridge. If it can move freely between enterprise and control zones, it is part of the attack path, not just a convenience layer.
Risk and Threat Considerations
Shared OT and IT networking creates a concentration risk: one weak route, overbroad rule, or compromised jump point can expose multiple control segments at once. The same design also gives attackers a cleaner path for discovery, credential abuse, and lateral movement once they land in the enterprise side.
Failure mechanism: Flat trust or overpermissive routing lets an IT compromise reach OT assets through shared services, management planes, or maintenance pathways that were never intended to be universal bridges.
Impact: A single intrusion can spread into control environments, disrupt operations, and force containment actions that are far more expensive than the original compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Network Integrity | Segmentation and tightly scoped routes protect OT trust boundaries. |
| ID.AM-01 — Physical Devices and Systems Inventoried | An accurate OT inventory is required to know what must be isolated. | |
| PR.AA-02 — Identity Management, Authentication, and Access Control | Monitored jump hosts and remote access controls limit reach into OT. | |
| Recommendation — Enforce network segmentation and restrict communications to approved conduits. Maintain a complete OT asset inventory before changing routes or firewall rules. Route remote access through controlled brokers and restrict privileged entry paths. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Boundary controls are the core mechanism for separating OT from IT networks. |
| CM-8 — System Component Inventory | Inventory is needed to map dependencies and avoid breaking hidden OT links. | |
| AC-4 — Information Flow Enforcement | Allowlisting and protocol restriction are information-flow controls across zones. | |
| Recommendation — Implement boundary protection to enforce OT-to-IT flow restrictions. Keep an authoritative inventory of OT components and dependencies. Enforce approved information flows only between defined OT and IT conduits. | ||
Practitioner Guidance
What to prioritise: Start with the routes that connect enterprise users, remote vendors, and common services into OT, because those are the highest-leverage paths for both disruption and lateral movement. A narrow control on one shared choke point is usually more valuable than a broad policy written for every segment at once.
What to verify: Confirm that every allowed flow has an owner, a business purpose, and a tested rollback path. If the team cannot explain why a route exists, or cannot show what would break if it were removed, it is usually too broad to be trusted.
Practitioner takeaway: In mixed OT and IT environments, security quality is measured less by how many controls exist than by whether the remaining connections are genuinely necessary, observable, and hard to abuse.
Related resources from NHI Mgmt Group
- How should security teams secure hybrid data pipelines across cloud, on-prem, SaaS, and OT/IoT systems?
- Who should be accountable for secure access decisions across systems, networks, and communications?
- How should security teams secure identity and access when OT and IT systems are being connected?
- How should security teams approach OT cybersecurity when legacy industrial systems are tightly connected to modern IT networks?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 6, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org