OT Network Segmentation Maturity Assessment
Segmentation decides whether one infected laptop stays a nuisance or stops a plant. This assessment scores ten practical aspects of your network, from the office boundary to cell isolation and containment testing.
1. How is the plant network separated from the office network?
2. How are production cells or lines separated from each other?
3. How do plant systems exchange data with ERP and MES?
4. How is vendor and remote access routed?
5. Do you have a current network diagram with zones and flows?
6. How are firewall rules between zones managed?
7. Is SMB, RDP and other admin protocol traffic blocked between zones?
8. How do you see traffic in the plant network?
9. Do you know every device that connects to the plant network?
10. Have you tested containment, such as isolating a cell or the plant from the office?
How to use it
Answer based on what is enforced today, not what is planned or documented. If you are unsure, pick the lower answer and use the exercise to find out. Your score maps to one of four bands with concrete next steps. Export the result and answers for a risk register or a board paper, and repeat after major changes.
- Answer with evidence such as rule exports
- Ask OT engineers for their view of the cell answers
- Re-run every six months
The model behind it
The questions follow the zone and conduit idea in IEC 62443 and the layered levels of the Purdue reference model: enterprise, DMZ, site operations, control and field. Good segmentation limits which systems can talk, over which ports, in which direction, and makes every exception a documented, owned decision rather than an accident.
Reading your band
Low scores are not a judgement, they are a starting point common to plants that grew by adding machines. The highest return actions are usually the same: a firewall at the office-to-plant boundary, blocking admin protocols, and bringing vendor access through one gateway. Cell level zoning comes after, driven by observed traffic.
Common mistakes
Segmenting by VLAN without filtering gives the appearance of control and none of the effect. Another mistake is tightening rules without capturing traffic first, which can stop a line. A third is to design for the diagram and neglect the people who must keep it true as new machines arrive. Build a change step that updates rules and diagram together.
Frequently Asked Questions
Do I need the Purdue model to segment?
No. It is a helpful way to think in layers, but the goal is simply to separate systems by function and risk and to control the flows between them. Modern designs often adapt or relax the strict layers.
Can I segment without stopping production?
Yes if you capture traffic first, deploy rules in monitor mode, and enforce in planned windows. Start at the plant boundary where the risk and the traffic are easiest to understand.
How does this relate to IEC 62443?
It is the practical side of zones and conduits. A higher score here means you can show defined zones, controlled conduits and monitoring, which are the inputs for a 62443 risk assessment.
What score should a manufacturer aim for?
Controlled zones is a sound target for most sites within a year or two, with enforced and verified for the most critical lines. Set targets by risk and customer requirements, not for the sake of a number.
If you want a facilitated segmentation review with traffic capture and a phased rule plan, Netray can work through it with your IT and OT teams.
Related Tools
IEC 62443 Security Levels and Parts Reference
A quick lookup of the IEC 62443 series structure, the four security levels, the seven foundational requirements and the zone and conduit vocabulary.
Developer ToolsCommon OT and ICS Protocol Ports Reference
Default TCP and UDP ports used by industrial protocols and the IT services that sit beside them, with a firewall risk note for each.
Compliance & ContractsOT Vendor Remote Access Hardening Checklist
A checklist of controls for machine builders, integrators and ERP partners who connect to your plant, grouped by identity, path, monitoring and lifecycle.
Industry TemplatesPlant Switch Port Budget Worksheet
List devices by plant area, add growth, and get the ports required, switches needed and spare ports for each closet or cell.
More Compliance & Contracts tools
See all- ISO 14001 Internal Audit Checklist
- Environmental Compliance Obligations Register Worksheet
- AI Governance Policy Template for Manufacturers
- AI Acceptable Use Policy Template for ERP Users
- Annualized Loss Expectancy Cyber Risk Calculator
- Cyber Insurance Retention Tradeoff Calculator
- MFA Rollout Risk Reduction Calculator
- Cyber Risk Register with ALE Worksheet
- NIST CSF 2.0 Categories Reference for Manufacturers