Network Segmentation for OT/IT Environments in Manufacturing: How to Build It Without Stopping the Line

Network segmentation for OT/IT environments in manufacturing separates the systems that run production, like PLCs, HMIs, and SCADA, from office IT, with an industrial DMZ brokering every connection, so a compromised office laptop can't reach the machines.

Start with three zones, and build the DMZ before you touch a single machine. Capture traffic across a full production cycle so you know what the line actually needs. Then enforce the rules one cell at a time during a planned changeover, with a rollback written down in advance. Vendor remote access is its own project, so plan it separately.

Pull up the network diagram for a plant whose manufacturing IT has grown over 15 years and you'll usually find one big network wearing several labels. The ERP server, the shipping printers, the controls engineer's laptop, and the PLC running the press brake can all talk to each other, because at some point that was the fastest way to get a project done. A firewall at the internet edge guards the front door. Segmentation decides which doors exist inside the building.

That inside layer is where plants come up short. Dragos, the industrial security firm, reported in its 2026 OT Cybersecurity Year in Review that 81% of its assessments found poor IT/OT segmentation, and that manufacturing made up more than two-thirds of industrial ransomware victims in 2025. Plants running everything on one flat network aren't unusual. In Dragos's field work, they're the norm.

If you need the basics first, our explainer on what network segmentation is covers them with office examples.

What does network segmentation look like inside a plant?

At minimum, three zones. The enterprise zone holds office IT and ERP. The industrial DMZ is a buffer network where plant data gets handed off. Cell or area zones hold the machines, grouped by production line. Nothing crosses directly from enterprise to plant floor.

The plant-side vocabulary, briefly. A PLC (programmable logic controller) is the small industrial computer that runs a machine. An HMI is the operator screen on that machine. SCADA is the supervisory software that watches and controls equipment across the plant, and a historian is the server that logs process data over time.

The rule that holds the design together comes from NIST's guide to OT security, SP 800-82 Revision 3. It says any communication between the enterprise level and the operations level is "required to go through services within the DMZ." CISA puts it the same way in its May 2025 OT mitigations fact sheet, which pairs segmenting critical systems with "introducing a demilitarized zone for passing control data to enterprise logistics."

You'll hear the Purdue model come up here. It's a reference drawing from the 1990s that stacks plant systems into numbered levels, with the DMZ at "Level 3.5." Treat it as a map. It tells you roughly where things belong. It doesn't tell you which conversations are allowed, and that's the part that actually stops an attack.

Why plant networks stay flat

Nobody designs a flat plant network. It grows.

A new line gets installed and the integrator plugs it into the nearest switch. Someone in finance wants live production counts, so the MES (the manufacturing execution system that tracks work on the floor) gets a direct path to the ERP. Years ago a machine vendor needed remote access during a warranty issue, whoever ran IT back then opened a VPN for them, and it never got closed. Each decision made sense on the day. Together they add up to a network where an infected email attachment in accounting has a route to the press brake.

IT runs the office network and stays off the floor, partly by choice and partly because plant managers told them to, after one too many Windows updates rebooted a machine mid-shift. The controls engineer runs the floor and doesn't think about the office. The boundary between them, where OT/IT security in manufacturing actually lives, belongs to nobody, which is exactly why it's full of holes.

Attackers know where those holes are. In the same Dragos report, 73% of all-time incident response cases involved compromised VPN or jump host credentials. A jump host is the single server people are supposed to log into before reaching the plant. When it's shared, or its password lives in a spreadsheet, it becomes the attacker's front door.

Segmentation is a business decision with a network diagram attached, and it belongs inside a broader managed cybersecurity program rather than a one-time firewall install.

The build sequence: six steps that don't stop production

Do it in order, and don't rush the middle. The plants that lose a shift to a segmentation project almost always started enforcing rules before they'd finished watching the traffic.

1. Inventory passively, then walk the floor

Active scanning tools, the kind IT uses on office networks, can crash older PLCs. So start passive. A sensor plugged into a SPAN port (a switch port that mirrors traffic without touching it) listens and builds the device list.

Passive has blind spots, though. Tenable notes that with passive monitoring alone, "dormant" devices will not be discovered, and neither will firmware or model details. That's the cabinet PLC that only talks during a quarterly calibration. Walk the floor with the controls engineer and a clipboard. Open the panels. You will find a switch nobody listed.

2. Capture the conversations production actually needs

Before you write a single rule, record which device talks to which, on which port, how often, and at what time of day, because a flow that happens once a week looks exactly like noise until the day you block it. Run the capture across a full production cycle, and make sure that window includes a product changeover and a month-end close.

Why those two? Because the rare flows hide there. The recipe download that only happens at changeover. The batch report finance pulls on the last business day. Block either one by accident and you've stopped the line or delayed the close, and the segmentation project gets blamed for both.

3. Draw zones by consequence, not by level

Group machines by what happens if they're compromised and who owns them, not just where they sit on the Purdue drawing. The zones-and-conduits approach in ISA/IEC 62443, the industrial security standard series, works this way. Two cells at the same level can belong in different zones if one makes a regulated part and the other makes packaging. Our post on IEC 62443 zones and conduits goes deeper on the standard itself.

4. Build the industrial DMZ first

The DMZ is where everything that crosses between office and floor gets handed off. Put a read-only copy of the historian there, so finance and quality can pull production numbers and batch records whenever they like without ever opening a connection to the server that's logging the live process. Stage patches and antivirus updates there. Put the jump host there.

Then give the plant its own logins. NIST SP 800-82 recommends that "OT network accounts do not use corporate network user accounts." If one stolen office password unlocks the HMIs, the zones are decoration.

5. Enforce one cell at a time, with a rollback trigger

Put the new firewall rules in log-only mode first. They record what they would have blocked without blocking it. Review that log with the controls engineer for a couple of weeks. Every unexpected hit is either a flow you missed in step 2 or something that shouldn't be there.

Then pick one cell and switch it to enforce during a planned changeover or maintenance window. Before anyone touches the rules, write down the rollback trigger. Something like "if the HMI loses its tags for more than 5 minutes, revert the rule set," plus the name of the person who makes that call. Nobody should be debating rollback criteria at the moment the line goes quiet.

NIST also cautions that automated blocking tools can disrupt OT and suggests considering them at the DMZ edge rather than deep in the plant. That fits the same instinct. Start strict at the boundary, and don't enforce anything on the floor you haven't watched in log-only mode first.

6. Rebuild vendor remote access

Machine builders, integrators, and software vendors all need to reach equipment. Give them one path. Their session ends at the jump host in the DMZ, uses multifactor login, lasts only for the scheduled job, and gets recorded.

CISA's fact sheet asks operators to configure remote access around "least privilege for the specific asset and user role" and to disable dormant accounts. In practice that means the robot vendor can reach the robot cell for a scheduled Tuesday window, and nothing else, ever. And that old warranty VPN finally gets closed.

Where plant segmentation usually breaks

The design rarely fails on paper. It fails at a few predictable spots.

The engineering laptop. It programs PLCs on the floor, and someone also uses it for email. NIST specifically warns about maintenance devices that allow "simultaneous connections between networks," also called dual-homed. That laptop is a bridge around every rule you just wrote. Give engineering its own workstation that stays in the plant zone.

The "temporary" rule. An any-to-any rule added during a 3 a.m. breakdown, meant to last until morning, still there 2 years later. Every exception gets an expiry date and an owner, or it doesn't go in.

Shared Active Directory. Active Directory is the system that manages logins on Windows networks. If plant and office share it, an attacker who takes over the office directory owns the plant logins too. It's also easy to miss, because nothing looks broken.

Then there's USB. Lock the network down without giving people a sanctioned way to move files, and before long the second shift will be carrying recipes and PLC programs between zones on whatever thumb drive happens to be sitting in the break room. That's worse than the flat network you started with. The DMZ file transfer server exists for exactly this reason.

And the safety system sitting on the same switch as everything else. NIST recommends considering separate segments for safety systems. If the controller that shuts a process down safely can be reached from the office, fix that first, before anything else on this list.

VLANs, firewalls, or microsegmentation: what does a plant actually need?

In industrial network segmentation, a firewall between zones is required. VLANs alone aren't enough. A VLAN (virtual LAN, a way to split one physical switch into separate networks) separates traffic, but it doesn't decide what's allowed between networks unless a firewall or access rules enforce it.

Here's how the three layers stack:

• VLANs keep traffic apart and reduce broadcast noise that can disrupt older controllers. Cheap, and usually already supported by your switches.
• A firewall at each zone boundary, especially enterprise to DMZ and DMZ to plant, is the actual enforcement. This is where the allow-list from step 2 lives, meaning the short list of connections that are permitted, with everything else blocked. Our managed firewall and network security team runs this layer for plants, and the next-generation firewall explainer covers what to look for in the hardware.
• Microsegmentation puts a boundary around individual devices. It's a strong later layer, but vendors pitch it as the starting point, and for a plant that still has a flat network it usually isn't.

There's a reason for caution with the newest pitch, too. NIST says plainly that some PLCs, controllers, and HMIs "may not support the technologies or protocols required" for a zero trust setup, and suggests applying zero trust at the higher levels, the plant servers and the DMZ, instead. A 20-year-old controller can't verify identities. A firewall in front of it can.

What segmentation does on the day something gets in

Prevention gets the budget. Containment decides how long you're down.

When ransomware lands on an office PC in a segmented plant, the incident response question changes. Instead of "is the floor infected?" it becomes "do we cut the DMZ link and keep running?" CISA and its international partners published CI Fortify guidance in July 2026 built around that idea, preparing operators to isolate vital OT systems and keep essential operations going during a serious incident. It's written for critical infrastructure, but the logic transfers directly to a plant with orders to ship.

CISA's fact sheet adds the other half. Practice running OT manually, because isolation only helps if the floor can work while it's cut off. That ties straight into your disaster recovery planning for manufacturing IT, and into why plants are such frequent targets in the first place, covered in why manufacturing companies get ransomware.

Ask your team one question. If the office network were compromised at 10 a.m. today, could you cut the plant off from it within 15 minutes and keep shipping? If the answer involves unplugging cables nobody has labeled, the segmentation work hasn't started yet.

A plant with a dedicated OT security team, a working DMZ, and enforced cell zones can treat this as a checklist. For everyone else, that 15-minute question is the place to start. Speak to an OT security expert and bring your current network diagram, even if it's a whiteboard photo.