Because enforcement depends on local conditions such as firmware, network gear, topology, remote connectivity, and whether the asset can support an agent or admission control. A method that works in one plant may be only observational in another, so procurement has to compare real site coverage rather than assume estate-wide control.
Why site-by-site evaluation is necessary
ot segmentation in water utilities is not a single-control decision because each site can have a different mix of controllers, firmware, switching gear, remote access paths, legacy protocols, and operational tolerances. The same segmentation design may block one plant cleanly while leaving another effectively unprotected, so the control has to be validated against the actual local environment, not assumed from the estate as a whole.
That matters because segmentation is only useful when it reflects how traffic really moves between pumps, HMIs, historians, engineering workstations, and remote support channels. If a site depends on brittle legacy devices or cannot support a sensor, agent, or admission-control component, the practical control may be visibility rather than active enforcement. NIST SP 800-82 Rev 3 treats OT architecture and segmentation as environment-specific for exactly this reason.
Site-by-site review also helps distinguish policy intent from deployable reality. A standard may require separation, but the implementation may vary from ACLs and VLANs to jump-host mediation or unidirectional paths depending on plant constraints. CISA Industrial Control Systems guidance repeatedly reflects that industrial environments have to be assessed in context, not by generic enterprise patterns.
What changes from plant to plant
The material differences are usually operational, not just architectural. One site may have modern network switches and clear asset inventory, while another may rely on unmanaged gear, vendor-maintained remote access, or flat subnets that cannot be changed without outage risk. Those differences alter whether segmentation can be enforced at the boundary, within the cell/zone, or only through compensating controls.
Remote connectivity is often the deciding factor. A utility site with permanent vendor tunnels, historian replication, or remote engineering access has a different exposure profile from an isolated facility, even when both are branded under the same utility. That is why the same segmentation language can mean very different things in practice: one site can support a true trust boundary, while another can only approximate one.
Asset capability matters too. Some OT devices cannot tolerate inline inspection, frequent policy changes, or authentication overlays, and some cannot be placed behind an admission-control flow without breaking operations. NIST SP 800-207 Zero Trust Architecture is useful here because it frames segmentation as a trust and policy problem, but the policy enforcement point has to fit the plant.
How to judge whether segmentation is real or only theoretical
The right question is not whether a segmentation diagram exists, but whether the control meaningfully reduces reachable attack paths at that site. A design is stronger when you can show which traffic is denied by default, which paths are allowed for operations, and how remote support is constrained and monitored. If you cannot demonstrate those specifics, the site likely has design intent rather than enforced segmentation.
For procurement and assurance, compare actual coverage rather than asking whether the same product is installed everywhere. Two sites may both own the same platform, yet one may only provide logging or passive monitoring while the other enforces policy inline. NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant because the control outcome depends on concrete access control, auditability, and configuration management evidence.
In water utilities, the most reliable comparison is site coverage against the real topology, not vendor capability statements. That means confirming where segmentation is enforced, what breaks if it is tightened, and whether the site has a compensating design when full enforcement is not feasible. The same platform name across multiple plants does not mean the same security outcome.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | OT segmentation is about enforcing allowed network flows at each site. |
| Recommendation — Enforce site-specific information flow policies to limit OT traffic paths and validate them in production. | ||
| NIST CSF 2.0 | PR.AA-05 — Network Integrity is Protected | Segmentation protects network integrity by constraining lateral movement and trust boundaries. |
| Recommendation — Map and verify OT trust boundaries, then confirm segmentation actually preserves network integrity. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Site-by-site segmentation depends on placing policy enforcement where each plant can support it. |
| Recommendation — Apply zero-trust principles to each plant and choose enforcement points that fit local OT constraints. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Segmentation varies with local switching, routing, and remote connectivity infrastructure. |
| Recommendation — Document and manage the network paths and boundaries that make OT segmentation enforceable. | ||
| ISO/IEC 27001:2022 | A.8.20 — Network security | Network security controls must be implemented to match the actual plant topology and exposure. |
| Recommendation — Implement network security controls in line with each site’s topology and operational requirements. | ||
Practitioner Guidance
What to verify: Validate the site’s live traffic paths, remote access channels, and enforceable boundaries before accepting any segmentation claim. A design that cannot show blocked east-west movement, restricted vendor access, or documented compensating controls should be treated as incomplete.
What to prioritise: Start with the sites that have the highest operational dependence on legacy equipment or the broadest remote connectivity, because those are usually the hardest to segment and the easiest to overestimate on paper. That is where a pilot can reveal whether the chosen control is enforceable or only observational.
Practitioner takeaway: The key judgement is not “is segmentation deployed?”, but “what is actually enforceable at this site without disrupting safe operation?” The answer has to be local, because OT risk is shaped by the plant’s real topology and device constraints, not by a uniform policy template.
Related resources from NHI Mgmt Group
- How should water utilities compare OT segmentation approaches across mixed environments?
- What breaks when water utilities rely on vendor access without OT identity governance?
- What is the difference between OT network segmentation and identity-based access control?
- How should security teams control vendor access in water utility OT environments?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 13, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org