01
Establish identity and scope
Identify OT applications, IACS security zones, remote users, Service and Route Endlets; validate participating Endlets before admission.
Energy
Protected OT boundaries · Architecture
Map the service path for protected OT boundaries.
Apply identity-centric segmentation across industrial automation and control system security zones and conduits.
Primary capability
Zero Trust
How it works
Trace the protected service path from admission to evidence.
Restrict unauthorized lateral movement and expose only approved operational service relationships.
02
Build the protected service path
validated identity and machine state → Endlet admission → least-privilege service policy → enforcement across an approved OT conduit
03
Capture decision evidence
Review identity state, policy decision, allowed and denied flows, route visibility, session logs with the responsible teams.
Architecture flow
Trace the protected service path and its control points.
validated identity and machine state
Endlet admission
least-privilege service policy
enforcement across an approved OT conduit
Inputs
OT applications, IACS security zones, remote users, Service and Route Endlets, identity and policy services
Path
validated identity and machine state → Endlet admission → least-privilege service policy → enforcement across an approved OT conduit
Evidence
identity state, policy decision, allowed and denied flows, route visibility, session logs, and revocation timing
Quick answers
Protected OT boundaries FAQs
Which technical path should the team review?+
validated identity and machine state → Endlet admission → least-privilege service policy → enforcement across an approved OT conduit
Which evidence should reviewers collect?+
identity state, policy decision, allowed and denied flows, route visibility, session logs, and revocation timing
Who should review the architecture?+
OT security, network security, application owners, plant operations
Continue the evaluation path
Evaluate protected OT boundaries with a representative scope.
Determine whether named users, workloads, and IACS zones receive only the minimum approved access.
Continue to Evaluation
