Essentials for OT
PRO-18 Network segmentation and segregation
Divide OT into network zones to limit how far an attacker can move. Allow only approved paths between OT and other networks, and route traffic between sites and zones through a buffer network (DMZ). Separate safety systems at a network boundary, and keep non-production environments apart.
Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026
The principle
Systems (infrastructure, operating systems and applications) are segmented into network zones based on business criticality and trust levels, with only authorised, controlled and monitored inbound and outbound communication paths between network zones permitted.
The four actions
ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.
Action 1 of 4
Limit communication between OT assets and any other network to explicitly approved pathways and services, based on business requirements, location and trust levels, and design new OT systems so that each service can exist within its own network segment or enclave.
In plain English: Limit OT traffic with other networks to explicitly approved paths and services, by business need, location and trust. Design new OT for a segment or enclave per service.
- Domains
- Critical processes and services
- Boundary services
- Business systems
- MITRE ATT&CK
- Remote services
- Internet accessible device
- Lateral tool transfer
Action 2 of 4
Isolate OT sites and business function zones within protected network segments, with communication between them policy driven through a demilitarised zone rather than direct and unlimited.
In plain English: Isolate OT sites and business function zones in protected network segments. Traffic between them must go through a buffer network (DMZ) under set policy, not directly and freely.
- Domains
- Boundary services
- MITRE ATT&CK
- Remote services
- Exploitation of remote services
- Lateral tool transfer
Action 3 of 4
Segment safety systems from non-safety parts of the OT environment, enforced at a network boundary rather than by device configuration alone, and protect safety systems against change originating outside the site safety system boundary.
In plain English: Separate safety systems from non-safety OT at a network boundary, not by device settings alone. Protect them from changes made from outside the site safety system boundary.
- Domains
- Critical processes and services
- MITRE ATT&CK
- Loss of safety
Action 4 of 4
Isolate non-production OT environments from production and from each other, where such environments exist.
In plain English: Where you have non-production OT environments, such as development, test or staging, isolate them from production and from each other.
- Domains
- Boundary services
- MITRE ATT&CK
- Lateral tool transfer
- Remote services
See all 34 principles in Essentials for OT, or read our OT guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.