Why segment an OT network and what the audit gets from it
A flat industrial network works well until the first incident. One compromised engineering workstation, one forgotten vendor remote access or one service laptop plugged into a switch in a switchgear room is enough for an attacker to reach controllers and operator panels. Segmentation does not prevent every intrusion, but it limits the reach and shortens the time needed to establish what was affected.
For an essential entity the formal side counts too. The Act of 23 January 2026 amending the Polish National Cybersecurity System Act (KSC), Journal of Laws 2026, item 252, has applied since 3 April 2026 and introduces an information security management system, including asset analysis, risk estimation and monitoring. Fines under Article 73(3)–(5) for an essential entity reach EUR 10 million or 2% of revenue, and in the most serious cases up to PLN 100 million; as a rule they can be imposed from 3 April 2028. The first cybersecurity audit falls 24 months after the provisions enter into force, so there is time to put the OT network in order, but it is not unlimited.
Segmentation is convenient here because its result is material: a diagram, a zone table, a firewall rule set and a test record. The auditor does not have to take your word that the network is divided. They can compare the documentation with the configuration.
Zones and conduits in IEC 62443-3-2
Part 3-2 of the ISA/IEC 62443 series describes risk assessment and the division of an installation into zones and conduits. The standard is voluntary, but it is a recognised reference point for the risk management measures expected under the NIS2 approach. It supports meeting the requirement; it does not replace it.
Zone: a group of assets with shared requirements
A zone groups assets that carry similar risk and need the same level of protection: for example the controllers of one line, the installation safety system, engineering stations or historian servers. Membership of a zone is decided by the consequence of a possible incident, not by where the cabinet stands in the hall.
Conduit: a controlled connection between zones
A conduit describes every permitted communication between zones: protocol, direction, ports, authentication and logging. Whatever is not in the conduit table is forbidden. Such an allow-list is at once a design document and audit evidence.
SL-T level: how much protection a zone needs
After the risk assessment each zone is assigned a target security level SL-T on a scale of 1–4. It is later compared with the achieved level (SL-A) and the capabilities of components (SL-C). The gap between SL-T and SL-A is a list of actions that management can approve and budget.
Sample target SL-T level of zones in a plant
The Purdue model as a starting map
The Purdue model is not a requirement of the standard, but it makes the first split easier. Level 0 is the physical process and sensors, level 1 is controllers and actuators, level 2 is supervision and operator panels, level 3 is manufacturing operations systems, and levels 4 and 5 are the enterprise network and the outside world. Between levels 3 and 4 a demilitarised zone (DMZ) is placed, often described as level 3.5.
The working rule is simple: no conversation passes from IT to OT without stopping in the DMZ. The data exchange server, the update server and the remote access gateway stand in the DMZ, and on the OT side only connections initiated from inside are opened. A detailed description of the levels is in the recommendations on the Purdue model; the one thing that matters here is that Purdue is a scheme for drawing zones, not a ready-made design.
How to run a segmentation project in seven steps
The order matters. A continuous-operation plant cannot afford to experiment on a live process, so the first three steps are passive.
- Inventory of OT assets: controllers, panels, stations, switches, network devices and remote links, with manufacturer, version and owner.
- Passive traffic discovery from a mirror port: who talks to whom, with which protocols and how often.
- Risk assessment and definition of zones by consequences for people's safety, process continuity and the environment.
- Assignment of SL-T to each zone and description of conduits in a table: source, destination, protocol, port, direction, justification.
- Technical design: VLANs, industrial firewalls, DMZ, remote access through a gateway with multi-factor authentication.
- Pilot on one line in a shutdown window, with a rollback plan.
- Acceptance: rule testing, documentation update and handover of maintenance to the OT network owner.
NIS2 audit evidence: what should be produced along the way
The auditor expects a trail of decisions, not only devices. A well-prepared plant has, after segmentation, a complete set of documents that can be shown in one binder or electronic folder.
- A register of OT assets assigned to zones.
- A diagram of zones and conduits with a date, a version and the signature of the risk owner.
- A conduit table with a business justification for every rule.
- Risk assessment results with assigned SL-T and a plan to close the gaps to SL-A.
- An export of firewall and switch configurations and a rule test record.
- A rule change procedure and a register of approved exceptions.
The most common mistakes
The first mistake is splitting into VLANs only, with no traffic filtering between them: the switch separates broadcast, but it does not defend access. The second is a DMZ through which service access passes without logging and without expiring vendor accounts. The third is installation safety systems placed in the same zone as operator stations. The fourth is documentation produced once, without a change procedure, so after a year it no longer matches reality.
The fifth mistake is quiet: leaving out auxiliary systems such as people location, access control or monitoring. If such a solution runs as an independent overlay with its own communication channel, it should have a separate zone in the conduit table and clearly described points of contact with the process network.
Checklist
Video
Frequently asked questions
Is IEC 62443 mandatory for an essential entity?
The standard is voluntary. However, the Act requires risk management measures, and applying IEC 62443 is a recognised way of demonstrating them. It supports meeting the requirement and is not the only route.
Is splitting into VLANs alone enough?
No. A VLAN separates segments, but without filtering traffic between them it does not restrict access. You need firewalls or access control lists and a conduit table.
How many zones should a plant have?
As many as the risk assessment shows. Too few zones do not limit the consequences of an incident, too many make maintenance harder. It is usual to start with a few zones and divide them further after the pilot.
Can segmentation be implemented without stopping production?
Discovery and design can, because they are passive. Rule changes are introduced in stages in shutdown windows, with a rollback plan for each stage.
Sources
Combine segmentation with control of people in zones
Let us talk about how an independent location overlay provides audit evidence of who was present in OT zones, without interfering with the process network.
Let's talk