Resources · Tool
OT/IT Segmentation Planner
Tick the activities that happen on your site, such as a vendor connecting remotely, a laptop moving between the office and the plant, or a USB stick plugged into an HMI. The planner maps them onto the Purdue model and ranks each network crossing by how many levels it spans. It then names the control each crossing needs, in the order you should fix them.
This tool runs entirely in your browser. Nothing you enter is sent to us, stored or logged. Closing the tab deletes it. Your answers never leave your browser, so you can answer fully and accurately. The result is only wrong if your list is incomplete.
What happens on your site
UNIT 01These are the twelve network crossings we find most often on real sites. Tick every one that happens on your site, including those that happen only occasionally. A crossing that happens occasionally is still a permanent path for an attack.
Zone map and crossings
UNIT 03
About the model
UNIT 04The zones follow the Purdue Enterprise Reference Architecture, as used in industrial security work. Field devices are at Level 0, control at Level 1 and supervisory systems at Level 2. Site operations are at Level 3 and the industrial demilitarised zone (DMZ) at Level 3.5. The enterprise and the outside world are at Levels 4 and 5.
The planner calculates each crossing's risk from three things: how many levels it spans, the type of activity, and how much your current separation already reduces the risk. A DMZ reduces the risk of data flows that should end inside it. It does not help with an engineering laptop that reads email in the morning and programs a controller in the afternoon. That crossing stays high risk however good the firewall is.
This is a planning aid. It cannot see your firewall rules, your patch levels or a wireless access point that someone installed last year for convenience. It does list the crossings that you must approve deliberately. Most OT (operational technology) security discussions centre on these crossings. You can give the list directly to the person who manages your network.
Technical references
UNIT 05These are the sources for the reasoning on this page. We mark standards that you must pay to read. Where a free document covers the same subject better, we list it first.
- NIST SP 800-82 Rev. 3NISTGuide to Operational Technology Security. It is free, several hundred pages long and the most useful single document in this field. Our segmentation planner follows its model of zones and conduits.
- ISA/IEC 62443Paid standardISAThe series of security standards for industrial automation. Customers and insurers usually cite it when they ask how your operational technology (OT) is secured.
- ISA-95Paid standardISAThe standard for integrating enterprise and control systems, and the source of the Purdue level model. It gives the official definitions of Levels 0 to 4.
- Industrial control systemsCISAFree advisories and guidance, including vulnerability notices that may name equipment in your own plant.
Links open in a new tab, so you do not lose anything you have entered on this page. We checked every link when we built the page. If a link no longer works, please tell us and we will remove it.
Each of these tools is a short version of a conversation with one of our engineers. If your result raised a question you want to discuss, book a scoping call and bring your result with you.
More resources
- Tool
Readiness assessment
Score a proposed integration on the five dimensions that decide whether it will work in a running plant, and find the one that limits it most.
- Tool
Payback calculator
Calculate the hours you could recover, the likely build cost and the payback period for a process you plan to automate. The result can also tell you not to automate it.
- Tool
Scope estimator
Describe your equipment, sites and compliance requirements. The estimator returns a complexity band, the main cost drivers in order and a range for engineering time.