Map assets to security zones, define the conduits between them and record the communication each conduit is allowed to carry. The model becomes the backbone for risk and compliance work.
Buffer zone where IT and OT exchange data. Nothing passes straight through; every flow terminates here. Historian data is mirrored here for business users.
Key risks
Broad firewall rules added for projects
Unpatched shared services
Remote access bypassing the jump host
Recommended controls
Deny-by-default rules with documented justification
MFA on the jump host with session recording
Hardened, monitored DMZ servers
Assets: Jump host, Historian mirror, Patch / AV, DMZ switch Conduit up: Firewall, HTTPS, RDP via jump host
L3 · SL 3
Control centre (EMS / SCADA)
Grid operators supervise and control substations across the network.
Key risks
Compromise of the EMS affecting many substations
Weak authentication on operator consoles
Unvetted vendor access
Recommended controls
Role-based access and MFA for operators
Application allowlisting on servers
Logging forwarded to a monitored SIEM
Assets: SCADA / EMS, Operator WS, Historian, WAN router Conduit up: Firewall, OPC UA, historian replication
L2 · SL 3
Station level
Local supervision and the gateway that talks to the control centre. Engineering access to protection settings starts here.
Key risks
Engineering workstation used to change protection settings
WAN exposure of the gateway
Time source spoofing
Recommended controls
Substation firewall restricting WAN traffic to IEC 60870-5-104
Change control for protection settings
Authenticated time sources
Assets: Station HMI, Gateway / RTU, Engineering WS, GPS clock, Station bus Conduit up: Firewall, IEC 60870-5-104 over WAN
L1 · SL 3
Bay level
Protection relays and bay controllers that trip breakers in milliseconds.
Key risks
Unauthorized setting changes
Spoofed GOOSE messages
Default passwords on IEDs
Recommended controls
IEC 62351 security where supported
Per-user IED access and setting backups
Separate VLANs for GOOSE
Assets: Protection IED, Protection IED, Bay controller, Bay controller, Bay switch Conduit up: Direct, IEC 61850 MMS / GOOSE
L0 · SL 2
Process level
Primary equipment and the merging units that digitize measurements onto the process bus.
Key risks
Manipulated sampled values
Physical access to yards
Uncontrolled maintenance laptops
Recommended controls
Isolated process bus
Physical security and port control
Procedures for test equipment
Assets: Merging unit, Circuit breaker, Power transformer, CT / VT, Disconnector Conduit up: Direct, IEC 61850-9-2 sampled values, hardwired
Site BGas processing facilityA DCS-controlled process with a separate safety instrumented system zone and a pipeline RTU.
L4 · IT
Enterprise IT
Business IT: email, ERP and corporate users. Treated as untrusted from the OT point of view.
Key risks
Phishing and ransomware spreading towards OT
Direct IT-to-OT connections
Shared credentials with OT
Recommended controls
No direct traffic to OT: all flows terminate in the DMZ
Separate identities for OT
Monitored IT/OT boundary
Assets: Corporate WS, ERP, Email, Edge router
L3.5 · SL 2
Plant DMZ
Buffer zone where IT and OT exchange data. Nothing passes straight through; every flow terminates here. Vendors reach the plant only through the remote access gateway.
Key risks
Broad firewall rules added for projects
Unpatched shared services
Remote access bypassing the jump host
Recommended controls
Deny-by-default rules with documented justification
MFA on the jump host with session recording
Hardened, monitored DMZ servers
Assets: Historian mirror, Remote access, Patch / AV, DMZ switch Conduit up: Firewall, HTTPS, RDP via gateway
L3 · SL 2
Operations
Plant-wide servers: DCS application, historian, engineering and domain services.
Control room consoles where operators run the process.
Key risks
Removable media on consoles
Shared operator accounts
Unauthorized software
Recommended controls
Locked-down consoles with allowlisting
USB control and scanning station
Individual or role accounts with audit
Assets: Operator console, Operator console, Alarm mgmt, Asset mgmt, Control switch Conduit up: Firewall, DCS control network
L1 · SL 3
Safety (SIS)
Independent safety instrumented system that brings the plant to a safe state.
Key risks
Loss of independence from the DCS
Safety logic changed remotely
Shared engineering tools
Recommended controls
Separate zone with read-only conduit to the DCS
Key-switch for program mode
IEC 61511 security risk assessment
Assets: Safety controller, Safety controller Conduit up: Data diode, Read-only status to DCS
L1 · SL 3
Process control (BPCS)
Basic process control: DCS controllers and the RTU for the export pipeline.
Key risks
Controller logic changes
Telemetry link exposure for the RTU
Unsupported controller firmware
Recommended controls
Controller keyswitch and change records
Encrypted, authenticated telemetry
Compensating controls for legacy firmware
Assets: DCS controller, DCS controller, Pipeline RTU, Control net Conduit up: Direct, Vendor control protocol
L0 · SL 2
Field instruments
Transmitters, valves and rotating equipment, wired to controllers.
Key risks
HART access to instruments
Physical tampering
Spoofed sensor values
Recommended controls
Restrict HART multiplexers and handhelds
Physical security
Plausibility checks in control logic
Assets: ESD valve, Pressure TX, Flow meter, Control valve, Compressor Conduit up: Direct, 4-20 mA, HART, Foundation Fieldbus
Site CDiscrete manufacturing plantMES and site services above production cells, each cell its own zone behind a cell firewall.
L4 · IT
Enterprise IT
Business IT: email, ERP and corporate users. Treated as untrusted from the OT point of view.
Key risks
Phishing and ransomware spreading towards OT
Direct IT-to-OT connections
Shared credentials with OT
Recommended controls
No direct traffic to OT: all flows terminate in the DMZ
Separate identities for OT
Monitored IT/OT boundary
Assets: Corporate WS, ERP, PLM, Edge router
L3.5 · SL 2
Industrial DMZ
Buffer zone where IT and OT exchange data. Nothing passes straight through; every flow terminates here. OEMs and machine builders connect only through the remote access gateway.
Key risks
Broad firewall rules added for projects
Unpatched shared services
Remote access bypassing the jump host
Recommended controls
Deny-by-default rules with documented justification
Buffer zone where IT and OT exchange data. Nothing passes straight through; every flow terminates here. Timetable and passenger information data is exchanged here.
Key risks
Broad firewall rules added for projects
Unpatched shared services
Remote access bypassing the jump host
Recommended controls
Deny-by-default rules with documented justification
MFA on the jump host with session recording
Hardened, monitored DMZ servers
Assets: Data exchange, Remote maint., Patch / AV, DMZ switch Conduit up: Firewall, HTTPS, file transfer
L3 · SL 3
OCC: Traffic management
Operations control centre that routes trains and manages the timetable in real time.
Buffer zone where IT and OT exchange data. Nothing passes straight through; every flow terminates here. Integrator access and regulatory reporting pass through here.
Key risks
Broad firewall rules added for projects
Unpatched shared services
Remote access bypassing the jump host
Recommended controls
Deny-by-default rules with documented justification
The OTVista Platform is in early access. Modules are released progressively, and demos show the current release. Ask us which capabilities are available for your environment today.
We would like to use Google Analytics cookies to understand how visitors use otvista.com, so we can improve it. Analytics only runs if you accept. No advertising cookies are used. Cookie notice
Architecture8 min
Regulation6 min