IT/OT Segmentation
IT/OT segmentation is the separation of the plant control network (OT) from the corporate network (IT) so that an incident on one cannot spread to the other. It is enforced with firewalls, VLANs, and an industrial DMZ, and documented as zones and conduits.
The goal is not isolation. Production data has to reach the business and vendors have to reach equipment. Segmentation defines the few, monitored paths through which that happens and blocks everything else. The output is evidence: which zones exist, which conduits connect them, and what is allowed through each.
Segmentation inside OT matters too: separating the kiln from the packing line, or one site from another, limits how far a fault or an intrusion can travel.
Why it matters in cement, mining, and aggregates
Potenza's 2025 report found that physical IT/OT separation was still being established for the first time at cement sites that had run for years without it. Segmentation is the third control in the Cement & Mining OT Baseline, after inventory and topology, because it cannot be designed without knowing what is on the network.