Operational technology is not enterprise IT with a different brand of switch. The protocols are older. The traffic is predictable. Uptime is absolute, and a control you would apply without thinking on the corporate network can take a plant offline.
That is why OT advice copied out of IT playbooks fails in the field. The controls below hold up, because they respect how industrial systems actually run.
Zones and conduits, not a flat plant
Segmentation is the foundation. The OT version is more deliberate than VLANs on the corporate side.
IEC 62443 frames it as zones and conduits. Group assets by function and risk into zones. Define exactly what crosses between them, through controlled conduits. Default to deny. The Purdue model gives you the layers to start from.
Watch for the flat plant network where the historian and the safety system share a broadcast domain. That is the most common OT finding I see, and the most dangerous.
Put an iDMZ between the plant and the business
IT and OT converged whether anyone planned it or not. What matters now is whether the boundary is controlled.
Build an industrial DMZ. Nothing on the business network talks directly to the plant. Data that has to move, historian replication or remote views, moves through brokered services in the iDMZ. A compromise on the corporate side then hits the DMZ instead of the controllers.
If a business-network machine can open a socket straight to a PLC, you do not have a boundary. You have a label.
Know the protocols, because they will not defend themselves
Modbus, DNP3, S7, EtherNet/IP, and OPC have little or no authentication by design. You cannot patch that away.
So account for it. Protocol-aware segmentation. Deep packet inspection where it earns its keep. A clear answer to what each conduit is allowed to carry. Treating industrial protocols like HTTP is how IT-style controls break OT.
Monitor passively, because active scanning breaks things
A vulnerability scanner that is routine on the corporate network can knock an old PLC offline just by probing it. I have watched it happen.
Monitor passively instead. Tap the traffic, baseline what normal looks like, and alert on the deviation, without ever sending an unsolicited packet to a control device. You get visibility into the 200 devices nobody inventoried. You also avoid being the reason the line stopped.
Make remote access deliberate
Vendors and operators need in. The default is a flat VPN into the plant, or a forgotten cellular modem on a panel, and that is how the quiet intrusions get their foothold.
Broker it. Route remote access through a jump host in the iDMZ, monitored and time-boxed, with multi-factor on the way in and a recording of what was done. Convenient back doors are how state-linked actors live off the land inside critical infrastructure for months at a time.
Patch on the plant’s terms, and compensate when you cannot
OT patches lag for real reasons. A reboot is a production event. Vendor certification takes time. Some systems will never be patched, because the vendor is gone.
Pretending otherwise is not a plan. Tie a patch cadence to maintenance windows for what you can patch. Then wrap compensating controls around what you cannot: tighter segmentation, monitoring, access restriction.
An unpatchable system behind a tight conduit is defensible. An unpatchable system on a flat network is an incident waiting for a date.
Keep safety systems separate
Safety instrumented systems exist to bring a process to a safe state. They do not belong on the same network as everything else.
Separate the SIS from the basic process control system, physically or logically. Get that wrong and a security incident becomes a safety incident. Keep them apart.
Own it across the boundary
The hardest part of OT security is the seam, not any single control.
The plant team owns uptime. IT owns the network. Security owns policy. The OT network falls in the gap between all three. It is the same ownership gap that swallows physical security networks.
Someone has to own the converged environment end to end, with the authority and the budget that go with it. Name them before the next integration, not during the incident review. Unowned infrastructure does not get secured, and on a plant network the cost of that is measured in more than data.
If your clients sit in a sector that will be designated under the Critical Cyber Systems Protection Act, these are the controls their supply chain questions will reach for.
None of these controls require breaking the process to secure it. They require understanding the process well enough to secure it the way it actually runs. That is the whole job.
If you are working this on a live plant network, industrial and OT network advisory is the engagement that covers it.