Walk onto almost any manufacturing floor, power substation, or water treatment facility today, and you will find a network that was never designed to be attacked. It was designed to run , reliably, predictably, and for decades. That design philosophy built the industrial world we depend on. It also built the exact conditions that make operational technology (OT) environments so difficult to defend.

For years, industrial organizations treated network segmentation as a "nice to have." A firewall between IT and OT was often considered sufficient. Today, that assumption is dangerous. Attackers no longer need to breach a control system directly , they simply need one unpatched laptop, one exposed remote access tool, or one vendor connection that was never properly isolated. Once inside a flat network, they move laterally with almost no resistance, often reaching programmable logic controllers (PLCs), engineering workstations, and safety instrumented systems within hours.

This is exactly the problem that IEC 62443 was written to solve. At the center of the standard sits a concept that is simple to describe but genuinely hard to execute well: zones and conduits. Segmentation is not a checkbox in this framework, it is the architectural foundation that everything else, from risk assessment to security level targets, is built on.

This article breaks down what IEC 62443 segmentation actually requires, why so many industrial sites still get it wrong, and how OT security leaders can turn abstract risk into concrete, enforceable network controls.

Why Segmentation Is the Backbone of IEC 62443 Compliance

IEC 62443 is built around a risk-based philosophy rather than a one-size-fits-all rulebook. It recognizes that a chemical processing plant, a food and beverage line, and an electric utility substation all carry different consequences if compromised , so they should not all be protected with identical controls. Segmentation is the mechanism that makes this risk-based approach possible in practice.

Without clear zone boundaries, every asset on the network effectively inherits the risk profile of the least secure device connected to it. A single internet-facing HVAC controller or a poorly configured remote access gateway can become the weak link that exposes an entire production line. Segmentation contains that risk by design, rather than hoping it never gets tested.

There is also a business reality driving this urgency. Insurance underwriters, regulators, and increasingly, customers themselves are asking industrial organizations to demonstrate that their control systems are architected with defined security boundaries , not just protected by a single perimeter firewall. Segmentation has moved from a technical best practice to a governance expectation.

Understanding IEC 62443 Zones and Conduits

The standard defines two foundational building blocks for industrial network architecture: zones and conduits. Understanding both, deeply, not superficially, is the starting point for any serious segmentation project.

What Is a Zone

A zone is a grouping of logical or physical assets that share common security requirements. Assets are grouped together because they have similar criticality, similar consequences if compromised, and similar operational function. A zone might contain:

• All PLCs and remote I/O associated with a single production line

• The historian and reporting servers used by plant engineers

• A safety instrumented system (SIS) and its associated logic solvers

• Remote access infrastructure used by third-party vendors

Grouping is deliberate, not convenient. Assets should never be placed in the same zone simply because they sit on the same physical switch or subnet. The grouping decision must be driven by risk consequence , what happens to safety, production, and business continuity if this group of assets is compromised.

What Is a Conduit

A conduit is the pathway through which communication travels between zones , or, in some cases, within a zone when traffic needs to be tightly controlled. Conduits are where the actual security controls live: firewalls, unidirectional gateways, data diodes, protocol-aware inspection, and access control policies.

Every conduit should answer three questions before it is allowed to exist:

• What data needs to cross this boundary, and why?

• What is the minimum level of access required to support that need?

• What happens if this pathway is misused or compromised?

If a conduit cannot clearly answer these questions, it usually should not exist in its current form.

Security Levels: Matching Protection to Consequence

IEC 62443 defines Security Levels (SL 0 through SL 4) that describe the strength of protection required against increasingly capable adversaries. Each zone should be assigned a target security level (SL-T) based on risk assessment, and the conduits protecting it should be designed to meet that target.

The value of this table is not academic. It gives OT leaders a defensible, standardized language to explain to executives and auditors why one zone gets a data diode and another gets a standard firewall rule set. Segmentation stops being a technical opinion and becomes a documented, risk-justified decision.

Risks, Challenges, and Industry Insights

Segmentation sounds straightforward on a whiteboard. In practice, it is one of the most operationally sensitive projects an industrial organization will undertake , and the consequences of getting it wrong have played out publicly, more than once.

When Flat Networks Meet Real Attackers

In late 2015, attackers gained access to the control networks of several Ukrainian regional power distribution companies. Once inside, they were able to move from corporate IT systems into operational networks with relative ease, ultimately manipulating breaker controls and cutting power to roughly 230,000 residents. Investigators later noted that stronger separation between corporate and control networks would have significantly slowed or blocked the attackers' path to the breakers. The incident remains one of the clearest real-world illustrations of what happens when IT and OT share the same trust boundary.

A similar pattern emerged in 2017, when a safety instrumented system at a petrochemical facility in the Middle East was targeted by malware designed specifically to manipulate safety controllers. The attack did not begin inside the safety network , it began with access gained elsewhere in the environment and moved laterally until it reached systems that were never meant to be reachable from general operational traffic. Safety systems, by design, are meant to be the last line of defense against catastrophic failure. When they sit in the same reachable network space as everything else, that last line of defense becomes just another hop for an attacker.

In 2019, a major aluminum producer was forced into manual, pen-and-paper operations across multiple facilities after ransomware spread through its network, ultimately disrupting production worldwide. The financial impact ran into tens of millions of dollars, and recovery took weeks. The lesson repeated across nearly every post-incident review: ransomware rarely respects network assumptions. It spreads wherever there is unrestricted connectivity, and it will find every flat, unsegmented pathway available.

A pattern shows up across each of these cases. The initial point of entry was rarely the most sensitive system. The real damage came from what the attacker could reach afterward , and that reachability was almost always a segmentation failure, not a failure of a single security tool.

Why Segmentation Projects Commonly Stall or Fail

Talking to OT security leaders across manufacturing, energy, and process industries reveals a consistent set of challenges that slow segmentation efforts down:

• Undocumented legacy connections. Many plants have communication paths that were set up years ago by a vendor or integrator and were never formally documented. Segmenting the network without first discovering these paths risks breaking production.

• Fear of operational downtime. Engineering and operations teams are understandably cautious about any network change that could interrupt a running process, especially in continuous manufacturing or energy generation.

• Mixed old and new equipment. Legacy PLCs with limited or no support for modern authentication sit alongside newer, IP-connected devices, making uniform policy enforcement difficult.

• Unclear ownership. IT often owns the network infrastructure while OT owns the process , and segmentation decisions frequently fall into a gap between the two teams.

• Overreliance on a single perimeter firewall. Many sites still consider one IT/OT boundary firewall sufficient, without internal segmentation between production lines, vendor access points, or safety systems.

• Remote access sprawl. Third-party vendors and integrators frequently retain standing remote access that was never scoped down after commissioning, creating conduits that bypass intended zone boundaries entirely.

None of these challenges are unusual. They are, in fact, the norm across most industrial sites that have been operating for more than a decade. Recognizing this is important , segmentation projects fail less often because of bad technology choices and more often because of rushed planning that skips asset discovery and risk-based zone definition.

Practical Recommendations and Best Practices

Turning IEC 62443 principles into a working segmentation architecture is a structured process, not a single project milestone. The following approach reflects how mature industrial organizations move from flat, high-risk networks to defensible zone-and-conduit architectures.

1. Start With a Complete Asset Inventory

Segmentation cannot be designed for assets you do not know exist. A comprehensive, continuously updated inventory of every device, controller, workstation, and communication path is the non-negotiable starting point. This includes passive network discovery to surface undocumented or forgotten connections, since these are frequently where the highest risk hides.

2. Group Assets by Consequence, Not Convenience

Define candidate zones based on what would happen operationally, financially, and safety-wise if that group of assets were compromised , not based on existing physical wiring or subnet layout. A safety system, a production PLC network, and a plant historian almost always deserve separate zones, even if they currently sit on the same switch.

3. Assign a Target Security Level to Each Zone

Use a documented risk assessment process to assign SL-T ratings. This step turns segmentation into a defensible, auditable decision rather than a subjective network diagram, and it directly supports IEC 62443-3-2 risk assessment requirements.

4. Design Conduits Around Least Privilege

Every conduit should permit only the specific protocols, ports, and directions of traffic required for legitimate operational purposes. Where possible, favor unidirectional data flows for reporting and historian traffic, and restrict engineering access to defined maintenance windows rather than leaving it permanently open.

5. Isolate Remote Access Completely

Vendor and remote engineering access should route through a dedicated, monitored jump environment , never directly into a production zone. Access should be time-bound, logged, and reviewed regularly, with credentials revoked immediately once work is complete.

6. Separate Safety Systems From General Control Traffic

Safety instrumented systems deserve their own zone with the strictest conduit controls in the entire architecture. They should never share a broadcast domain, switch, or management interface with general production control traffic.

7. Validate Before You Enforce

Before applying strict conduit rules, run segmentation policies in a monitoring-only mode to confirm legitimate traffic patterns are fully understood. This avoids the most common cause of segmentation-related downtime: blocking a communication path that operations did not know existed but actually needed.

8. Treat Segmentation as a Living Architecture

Networks change as equipment is added, replaced, or reconfigured. A segmentation architecture that was accurate at commissioning can quietly become inaccurate within a year. Scheduled reviews, paired with continuous asset visibility, keep zones and conduits aligned with the real environment rather than an outdated diagram.

A Quick Reference: Conduit Controls by Risk Scenario

This kind of structured mapping gives plant managers and CISOs a shared reference point , one that translates technical segmentation decisions into language that operations, engineering, and executive leadership can all understand and support.

How Shieldworkz Supports Organizations

Designing and implementing IEC 62443-aligned segmentation is rarely something an internal team can complete alone, especially alongside day-to-day production demands. Shieldworkz works alongside industrial organizations to turn segmentation from a stalled initiative into a working, sustainable architecture.

• Comprehensive OT asset discovery to build an accurate, continuously updated inventory before any zone design begins

• Risk-based zone and conduit design aligned directly with IEC 62443-3-2 and 3-3 requirements, tailored to each facility's actual operational risk

• Security level target (SL-T) assessments that give leadership a documented, defensible basis for every architectural decision

• Conduit and traffic validation using monitoring-first deployment to prevent unplanned production disruption

• Remote access hardening for vendor and third-party connections, closing standing access points that bypass intended boundaries

• Safety system isolation guidance to ensure SIS environments meet the strictest protection requirements in the architecture

• Ongoing architecture reviews so segmentation stays accurate as equipment, vendors, and network conditions evolve

• Executive-ready reporting that translates technical segmentation work into risk language for boards, insurers, and regulators

The goal is not simply to draw zone boundaries on a diagram. It is to build an architecture that operations trusts, that security teams can defend, and that genuinely reduces the blast radius of the next incident.

Conclusion

Segmentation is not a single project with a finish line , it is an ongoing discipline that determines whether one compromised device becomes a contained incident or a plant-wide crisis. IEC 62443's zones and conduits give industrial organizations a structured, risk-based way to make that determination deliberately, rather than leaving it to chance or historical network sprawl.

The organizations that get this right share a common trait: they treat segmentation as a business risk decision, not just a network engineering task. They involve operations, engineering, and security leadership together, they base zone boundaries on consequence rather than convenience, and they validate before they enforce.

The incidents that make headlines rarely start where the damage ends. The difference between a contained event and a catastrophic one almost always comes down to what the network allowed the attacker to reach next.

Book a Free Consultation with Our Experts

If your organization is working through IEC 62443 segmentation requirements , or simply unsure how exposed your current network architecture really is, our team is ready to help you assess it. Book a free consultation with Shieldworkz OT security experts and take the first step toward a network architecture built on defensible, risk-based zones and conduits.

Additional resources  

A downloadable report on the Stryker cyber incident here  
Removable media scan solution vendor evaluation and selection checklist here  
IEC 62443-based OT/ICS risk assessment checklist for the food and beverage manufacturing sector here 
IEC 62443-based remediation guides here