Cybersecurity and Risk Management for IT/OT Data Flows

Information technology and operational technology protect different things. IT protects the confidentiality and integrity of data first. OT protects the availability of the plant first — and with it, people, material, and schedule. A data path between the two must satisfy both goals, and in case of doubt, the plant wins.

That implies an uncomfortable rule: a security concept that opens up production for analytics purposes is not a compromise, it’s a mistake. The path runs the other way — production publishes outward; it is not queried from outside.

A cyberattack on a production plant rarely looks like it does in the movies. The three most common paths are unspectacular and have been the same for years:

• Remote access. A maintenance access point that stays permanently open, with an account known to multiple service providers. The most common entry point into ICS environments — Industrial Control Systems, meaning controllers, SCADA, and control systems.
• Ransomware via office IT. Encryption almost never starts on the plant floor but in the administrative network. Whether it reaches production is decided solely by the separation between the two — and in many plants, manufacturing then stops not because it was attacked, but because it has to be shut down as a precaution.
• Supply chain. A component, an update, or a third-party device brings along something nobody ordered. No perimeter helps against that — only the question of what a device is allowed to reach in the first place.

What’s notably missing from this list is the targeted attack on a controller. It happens, but it’s rare. The normal case is a path that someone opened for good reasons and then forgot about.

The established ordering principle comes from the IEC 62443 series of standards. The core is described in IEC 62443-3-2 — Security Risk Assessment for System Design: the landscape is divided into zones with comparable protection needs, and all traffic between zones runs through a defined transition, called a conduit in the standard — few, named, monitored routes instead of many that grew organically.

In practice, the same thing is called network segmentation: the flat plant network is divided into sections, between which only what’s needed is permitted. The difference is one of perspective — zones and conduits describe the protection need, segmentation describes the implementation in the network. Anyone who equates the two skips the decisive step: first it’s determined what belongs together and what needs protecting, then the cutting happens.

The layer logic behind this is older than the standard and still known in many plants as the Purdue model: field level, control level, supervisory level, operations management level, enterprise level, with a DMZ in between as a buffer zone between production and office IT. You don’t have to adopt the model to create zones — but it answers the question of where the DMZ belongs.

Three zones, two transitions, one direction: production publishes, it is not queried.

In practice, this means: no inbound port leads into the production zone. The local runtime in the transition zone retrieves values from the plant and itself establishes an outbound, encrypted connection upward. If this connection fails, it buffers and delivers later — production doesn’t depend on the availability of the central system.

• One direction

  Connections are established from the zone that needs more protection outward, never into it. A return path for instructions exists — but as its own explicitly approved channel, not as an open port.

• Few routes

  The fewer transitions there are, the more completely they can be audited. A shared layer replaces a growing number of bilateral connections that nobody fully understands anymore.

• Verified identities

  Every connection authenticates itself — via certificates, not shared passwords. Rights are granted by role, and revoking a right takes effect immediately and everywhere.

• Traceability

  It can be determined afterward which source delivered what and when, and where a gap occurred. Without this evidence, neither an incident can be investigated nor an audit passed.

The pressure is shifting from the measure to the proof. Three references are decisive here:

• IEC 62443 describes security for industrial automation systems — among other things via zones and transitions as well as graduated security levels. It provides the language in which architecture decisions can be justified.
• NIS2. According to the BSI (Germany’s Federal Office for Information Security), the German NIS2 Implementation Act took effect on December 6, 2025. The risk management obligations are set out in Sections 30 ff. BSIG (Germany’s BSI Act); supply chain security is explicitly named there (Section 30(2) No. 4 BSIG). Affected organizations register via the BSI’s portal. In the event of a significant security incident, a three-stage reporting chain applies: an initial report within 24 hours, a follow-up report within 72 hours, and a final report no later than one month afterward.
• BSI fundamentals. For concrete implementation, the ICS Security Compendium and the IT-Grundschutz module on industrial IT are the most practice-oriented German-language sources. Where an information security management system under ISO 27001 already exists, it covers a substantial part of the organizational requirements — the OT-specific points are added on top, they don’t replace it.

For the architecture, this implies above all one thing: what isn’t documented and observable can’t be proven. Visibility is therefore not a convenience feature but part of the obligation.

This section provides context and does not replace legal advice. Clarify whether and how your company is affected with your compliance function; the BSI’s guidance and the statutory text are authoritative. Information current as of: September 2026.

• pronubes Edge runs locally at the plant, establishes outbound connections, and buffers on connection loss — no inbound access into the production zone.
• Secure by Design as a principle: certificates, roles, telemetry only by opt-in, SBOM-capable and Vault-ready.
• pronubes Insights makes connections, data flows, and system states visible — including the flows that go silent.
• pronubes Zones records which flow belongs to which site, area, and system — the basis for being able to assign responsibility in the first place.

More about the platform