05) Do you maintain documentation, such as network diagrams, describing how your OT systems are segregated from enterprise IT networks (e.g., via firewalls or DMZs)?
Answer yes if you have documentation that clearly describes how environments providing OT support are segregated from your enterprise IT networks. Upload supporting documentation as evidence.
Segregation between Operational Technology (OT) and enterprise IT networks is one of the most important controls for limiting the impact of a compromise in either environment, since a boundary that stops an attacker moving from a compromised IT network into OT (or vice versa) can be the difference between a contained incident and one that disrupts physical processes or safety-critical systems. Documentation describing how this segregation is achieved, such as network diagrams showing firewalls, demilitarised zones (DMZs), and the specific paths and protocols allowed to cross between IT and OT, is important for two related reasons: it allows the design to be properly reviewed, tested, and improved over time, and it ensures that segregation reflects a deliberate, understood architecture rather than something that exists only informally or by accident.
How to implement the control
Produce and maintain network diagrams or equivalent documentation showing how your OT environment is segregated from enterprise IT, including the firewalls, DMZs, or other controls enforcing that separation.
Your documentation should typically cover:
- The overall network architecture, showing OT and IT as distinct zones, along with any DMZ used as an intermediary layer between them.
- The specific devices enforcing segregation, such as firewalls, data diodes, or other boundary controls, including their location in the architecture and their high-level rule sets or permitted traffic flows.
- Every legitimate path that crosses between IT and OT, including what protocols, ports, and data flows are allowed, and for what business or operational purpose each one exists.
- Any remote access paths into the OT environment, such as vendor or third-party access, since these are a common and often under-documented route across the IT/OT boundary.
.svg)
