OT Network Segmentation for Manufacturing: A Minimum-Viable Starting Point
You don't need a green-field rebuild to get the plant floor out of a flat, unmanaged IT/OT network. A staged segmentation plan protects the line while it keeps running.
By Uniqcli Team · · 6 min read
Plant floor security
OT network segmentation for manufacturing doesn't require a shutdown to start
Most plant-floor networks were built for uptime, not isolation. Programmable logic controllers, human-machine interfaces, historians, and IT workstations often sit on the same flat subnet because that's how the line was commissioned ten or twenty years ago, and nobody has had a maintenance window long enough to change it. That single fact is the biggest obstacle to OT network segmentation in manufacturing: the fix competes directly with production schedules. The good news is that segmentation is not one project — it's a sequence of smaller ones, each deployable during a normal maintenance window, each reducing blast radius the moment it goes live. This guide lays out a minimum-viable path: what to segment first, what hardware that requires, and where a flat network turns one infected laptop into a stopped line.
Why does a flat plant-floor network matter to a security team?
On a flat network, any device that can reach the switch can reach every other device on it — a PLC, an HMI touchscreen, a historian server, and a contractor's laptop are all peers. There's no boundary a piece of malware or a misconfigured device has to cross to get from IT to OT or from one production cell to the next. Ransomware that lands on an office PC can, in a flat topology, reach engineering workstations that have write access to controller logic within a few hops.
The consequence isn't hypothetical in the way it's often described — it's mechanical. Industrial control protocols like Modbus, EtherNet/IP, and PROFINET were designed for deterministic, trusted-network communication with minimal authentication. They assume the network boundary is the security boundary. When that boundary doesn't exist, the protocol's own permissiveness becomes the exposure. Segmentation restores the boundary the protocol was designed to rely on, without touching the protocol itself.
This is why OT segmentation is usually the first recommendation in any plant-floor security assessment, ahead of endpoint agents or protocol-aware monitoring. It's foundational: those other controls work better, and fail more safely, once the network is zoned. An intrusion-detection sensor watching a flat network sees one undifferentiated flow, while the same sensor watching zoned traffic can flag a control-zone device suddenly reaching for the enterprise network as the anomaly it plainly is.
How do you segment a live production line without stopping it?
The Purdue Model — the reference architecture most OT security frameworks build on — defines levels from the physical process (Level 0) up through the enterprise network (Level 5), with a demilitarized zone at Level 3.5 mediating IT/OT traffic. Most plants don't need to implement the full model on day one. A minimum-viable segmentation plan starts by drawing three zones instead of six: the control zone (PLCs, drives, I/O), the supervisory zone (HMIs, historians, engineering workstations), and everything else. Getting a firewall or Layer 3 switch between those three zones closes the majority of the exposure with the fewest changes.
The sequencing that avoids downtime looks like this: first, install managed switches with VLAN capability during a scheduled changeover, configured but not yet enforcing — this establishes visibility with zero behavior change. Second, mirror traffic to a passive monitoring tap to build an asset inventory and a baseline of normal communication patterns; most plants discover devices they didn't know were talking to each other at this stage. Third, once the baseline is understood, apply access-control-list rules that permit only the traffic the baseline showed and deny everything else, rolled out cell by cell rather than plant-wide.
Each of those three steps is independently schedulable inside a normal maintenance window — none of them requires taking the whole line down at once. Because enforcement is the last step and lands cell by cell, any rule that turns out to be too strict can be relaxed on that single cell without disturbing the rest of the plant, so the chance that a segmentation change stops production stays small and contained rather than plant-wide.
What does a minimum-viable segmentation architecture actually run on?
The hardware list is shorter than most plants expect. Industrially rated managed switches (DIN-rail mounted, extended temperature range, redundant ring topology support) replace unmanaged switches at the cell level. A next-generation firewall or industrial firewall appliance sits at the IT/OT boundary and, if budget allows, at each major production zone boundary — this is the device doing the actual traffic denial, not just VLAN tagging. A passive network tap or SPAN port feeds a monitoring tool that fingerprints ICS protocols, which most general-purpose IT monitoring doesn't parse correctly.
None of this requires replacing PLCs, drives, or HMIs. The controllers keep running the process exactly as before; segmentation changes what can reach them, not how they operate. That distinction is what makes the retrofit feasible on a live line — the security boundary moves to the network layer, where changes are reversible and testable, instead of the control layer, where they aren't.
Where do legacy PLCs and unpatched HMIs fit into the plan?
Manufacturers frequently run controllers that are 15 to 25 years into a 20-year-plus service life, with vendor patches long discontinued and firmware that can't be upgraded without recertifying the whole cell. Segmentation is the primary control for exactly this situation: a device that can't be patched can still be isolated. Placing legacy PLCs in their own restricted VLAN, reachable only from the specific engineering workstation that programs them and on the specific ports that function requires, contains the exposure without touching the device.
The same logic applies to remote-access points — vendor support VPNs, cellular gateways for remote monitoring, and contractor laptops connected during commissioning are consistently the paths incident responders trace back to when a plant network is breached. A segmentation plan should treat every remote-access point as its own zone with its own explicit allow-list, not as a trusted extension of the supervisory network.
Minimum-viable OT segmentation checklist
A practical sequence for a plant that hasn't segmented before, ordered by what to do first.
- Inventory every device on the plant-floor network, including ones IT doesn't manage
- Deploy managed, industrially rated switches at the cell level during a scheduled window
- Mirror traffic to a passive tap and baseline normal communication for 2-4 weeks minimum
- Draw three zones first: control, supervisory, everything else
- Apply deny-by-default access rules cell by cell, not plant-wide, using the baseline
- Isolate every remote-access point (VPN, cellular gateway, vendor support link) in its own zone
- Put unpatchable legacy PLCs in a restricted VLAN reachable only by their engineering workstation
- Add ICS-protocol-aware monitoring at the IT/OT boundary once zones are enforcing
- Document the as-built architecture — the biggest risk after segmentation is undocumented drift
- Re-baseline after any line reconfiguration; segmentation rules go stale as fast as the process does
Frequently asked
What is OT network segmentation in manufacturing?
It's dividing a plant-floor network into isolated zones — typically control, supervisory, and enterprise IT — so that traffic between zones passes through a firewall or managed switch enforcing explicit rules, instead of flowing freely across one flat network. It limits how far malware, a misconfiguration, or unauthorized access can spread.
Can you segment an OT network without downtime?
Yes, if it's staged. Installing managed switches and passive monitoring can happen without changing traffic flow at all. Enforcement (access-control rules) rolls out zone by zone during normal maintenance windows once a traffic baseline confirms what's safe to allow, rather than as a single plant-wide cutover.
How is OT segmentation different from IT network segmentation?
OT segmentation has to account for industrial protocols (Modbus, EtherNet/IP, PROFINET) that weren't built with authentication in mind, devices with decades-long service lives that can't be patched or rebooted casually, and availability requirements where a dropped connection can stop a physical process, not just an application.
What hardware is needed to segment a plant-floor network?
Industrially rated managed switches with VLAN support at the cell level, a firewall or industrial firewall appliance at zone boundaries, and a passive tap or SPAN port feeding ICS-aware monitoring. Existing PLCs, HMIs, and drives typically don't need to be replaced.
Where should segmentation start on an unsegmented plant floor?
With an asset inventory and a passive traffic baseline — you can't safely write access rules for a network you haven't observed. After that, isolating remote-access points and unpatchable legacy controllers usually delivers the largest risk reduction per dollar spent.
Related resources
Go deeper
Manufacturing industry overview
How Uniqcli sources and stages IT and security hardware for plant-floor and manufacturing environments.
Learn moreCyber capabilities
Screening, sourcing, and integration support for network security hardware, including industrial firewalls and monitoring.
Learn moreElectronics capabilities
Sourcing for industrially rated networking hardware — managed switches, DIN-rail equipment, and ruggedized components.
Learn moreScope a segmentation rollout for your plant floor
Tell us your current network topology and constraints, and we'll help you source the switches, firewalls, and monitoring hardware for a phased rollout that doesn't require a production shutdown.