OT process context, trust boundaries and controlled connectivity
Begin with the physical process
Operational technology monitors or changes physical processes through devices such as controllers, sensors, actuators, engineering workstations and operator interfaces. A system diagram must connect the digital asset to its actual process function and consequences. A historian records relevant process information, while an HMI supports operator interaction and a PLC executes its configured control functions. The same product can have different criticality in different installations, so a device name or address alone is not a complete risk assessment.
Establish the actual architecture
Identify assets, software and firmware, ownership, dependencies, approved communications and important physical interfaces. A hierarchical model can help discussion, but the number on a diagram does not itself establish an enforced boundary. Separate relevant trust zones and define the communication paths between them. A dual-connected host or an unmanaged maintenance laptop can create a route around the intended separation. Disconnected designs also need controlled removable-media and service practices rather than assuming a label guarantees isolation.
Control necessary information flows
An industrial DMZ mediates defined exchanges between different trust environments, rather than providing an unrestricted bridge. Firewalls, application proxies, jump services and one-way gateways have different capabilities and limitations. A data diode constrains its designed channel; other paths and the full business workflow still need assessment. Default-deny rules are useful only when necessary authorized flows are understood, tested and maintained. Legacy protocol fields may lack modern authentication or confidentiality, so placement and compensating controls matter.
Coordinate safety and security design
Cybersecurity and functional safety have related but distinct objectives. A control that blocks all communication can still create an unsafe physical condition if the process depends on that flow. Likewise, fail-closed network behavior is not automatically the same as a process reaching its defined safe state. Involve operators, control engineers, safety specialists and responsible management in architecture changes. Current NIST OT guidance emphasizes performance, reliability and safety alongside security; draft and final editions must not be confused. These written principles are not a plant design, an IEC or NERC compliance determination, or permission to reconfigure a live control network.