# OT Network Segmentation Maturity Assessment > Source: https://netray.co/tools/ot-network-segmentation-maturity-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Ten questions that score your plant network segmentation from flat network to enforced zones, with next steps for each band. ## Category compliance-legal ## Industry Manufacturing ## Audience - IT security lead - Network engineer - OT engineer ## Tool **Kind:** assessment **Questions:** #### How is the plant network separated from the office network? **Options:** ##### It is one flat network **Score:** 0 ##### VLANs only, routing is open **Score:** 1 ##### A firewall with broad allow rules **Score:** 2 ##### A firewall with specific rules and a DMZ for shared services **Score:** 4 #### How are production cells or lines separated from each other? **Options:** ##### Not separated **Score:** 0 ##### Some VLANs, no filtering between them **Score:** 1 ##### Filtering between most cells **Score:** 3 ##### Each cell is a zone with documented, enforced conduits **Score:** 4 #### How do plant systems exchange data with ERP and MES? **Options:** ##### Direct connections from many machines to the ERP network **Score:** 0 ##### Through shared file shares **Score:** 1 ##### Through a few gateways with some rules **Score:** 3 ##### Through brokered, allow listed interfaces in a DMZ **Score:** 4 #### How is vendor and remote access routed? **Options:** ##### Direct remote tools on machines **Score:** 0 ##### VPN to the plant network **Score:** 1 ##### Jump host with MFA, broad targets **Score:** 3 ##### Jump host with MFA, per-request targets, recording and expiry **Score:** 4 #### Do you have a current network diagram with zones and flows? **Options:** ##### No diagram **Score:** 0 ##### An old diagram, not trusted **Score:** 1 ##### Current for major segments **Score:** 3 ##### Current, versioned and tied to firewall rules **Score:** 4 #### How are firewall rules between zones managed? **Options:** ##### Any to any in several places **Score:** 0 ##### Rules exist, no review **Score:** 1 ##### Reviewed yearly **Score:** 3 ##### Reviewed twice yearly with owner and reason per rule **Score:** 4 #### Is SMB, RDP and other admin protocol traffic blocked between zones? **Options:** ##### No restrictions **Score:** 0 ##### Blocked from the internet only **Score:** 1 ##### Blocked between office and plant **Score:** 3 ##### Blocked between office, plant and cells except from admin hosts **Score:** 4 #### How do you see traffic in the plant network? **Options:** ##### We do not **Score:** 0 ##### Switch counters only **Score:** 1 ##### Flow logs on the boundary firewall **Score:** 3 ##### Passive OT monitoring plus firewall logs reviewed regularly **Score:** 4 #### Do you know every device that connects to the plant network? **Options:** ##### No inventory **Score:** 0 ##### A spreadsheet that is partly stale **Score:** 1 ##### A maintained inventory for most assets **Score:** 3 ##### Automatic discovery reconciled against an inventory **Score:** 4 #### Have you tested containment, such as isolating a cell or the plant from the office? **Options:** ##### Never **Score:** 0 ##### Discussed only **Score:** 1 ##### Tested on paper **Score:** 2 ##### Tested in practice in the last year **Score:** 4 **Bands:** #### Flat and exposed **Min:** 0 **Max:** 25 **Verdict:** Your plant network behaves as one large trust zone. A single compromised laptop or vendor tool can plausibly reach controllers and servers. **Recommendations:** - Place a firewall between office and plant first and block SMB and RDP across it - Take an inventory of devices and remove direct remote tools from machines - Draw a first zone diagram with the five most critical systems #### Partially separated **Min:** 26 **Max:** 55 **Verdict:** There are boundaries, but broad rules and gaps in visibility mean an intruder who gets in can still move around. **Recommendations:** - Replace any to any rules with specific allow lists, starting at the plant boundary - Move vendor access to a jump host with MFA and time limits - Start passive monitoring to learn real traffic before tightening cell rules #### Controlled zones **Min:** 56 **Max:** 80 **Verdict:** You have meaningful zones and managed rules. The work now is consistency, evidence and verification. **Recommendations:** - Add per-cell zones for the highest value lines - Tie each firewall rule to an owner and review date - Run a containment test and record the time it took #### Enforced and verified **Min:** 81 **Max:** 100 **Verdict:** Your segmentation is documented, enforced and tested. Keep it that way as projects add devices and vendors. **Recommendations:** - Automate checks that diagrams and rules still match - Include segmentation in every project's security review - Rehearse recovery and isolation at least yearly ## Content **Intro:** Segmentation decides whether one infected laptop stays a nuisance or stops a plant. This assessment scores ten practical aspects of your network, from the office boundary to cell isolation and containment testing. **Sections:** #### How to use it **Body:** Answer based on what is enforced today, not what is planned or documented. If you are unsure, pick the lower answer and use the exercise to find out. Your score maps to one of four bands with concrete next steps. Export the result and answers for a risk register or a board paper, and repeat after major changes. **Bullets:** - Answer with evidence such as rule exports - Ask OT engineers for their view of the cell answers - Re-run every six months #### The model behind it **Body:** The questions follow the zone and conduit idea in IEC 62443 and the layered levels of the Purdue reference model: enterprise, DMZ, site operations, control and field. Good segmentation limits which systems can talk, over which ports, in which direction, and makes every exception a documented, owned decision rather than an accident. #### Reading your band **Body:** Low scores are not a judgement, they are a starting point common to plants that grew by adding machines. The highest return actions are usually the same: a firewall at the office-to-plant boundary, blocking admin protocols, and bringing vendor access through one gateway. Cell level zoning comes after, driven by observed traffic. #### Common mistakes **Body:** Segmenting by VLAN without filtering gives the appearance of control and none of the effect. Another mistake is tightening rules without capturing traffic first, which can stop a line. A third is to design for the diagram and neglect the people who must keep it true as new machines arrive. Build a change step that updates rules and diagram together. **Cta:** If you want a facilitated segmentation review with traffic capture and a phased rule plan, Netray can work through it with your IT and OT teams. **Faq:** #### Do I need the Purdue model to segment? **Answer:** No. It is a helpful way to think in layers, but the goal is simply to separate systems by function and risk and to control the flows between them. Modern designs often adapt or relax the strict layers. #### Can I segment without stopping production? **Answer:** Yes if you capture traffic first, deploy rules in monitor mode, and enforce in planned windows. Start at the plant boundary where the risk and the traffic are easiest to understand. #### How does this relate to IEC 62443? **Answer:** It is the practical side of zones and conduits. A higher score here means you can show defined zones, controlled conduits and monitoring, which are the inputs for a 62443 risk assessment. #### What score should a manufacturer aim for? **Answer:** Controlled zones is a sound target for most sites within a year or two, with enforced and verified for the most critical lines. Set targets by risk and customer requirements, not for the sake of a number. ## Search terms ot network segmentation assessment, flat network plant floor risk, purdue model segmentation check, it ot segmentation maturity, plant network firewall assessment, ics network zones conduits assessment, factory network segmentation checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json