Improving ICS/OT Security Perimeters with Network Segmentation

**Executive summary:** This guidance paper explains best practices for securing ICS/OT network perimeters, emphasizing the risks of flat networks and rule creep, the value of proper segmentation using the Purdue model, the role of firewalls and DMZs, and specific controls to mitigate boundary bypasses (for example MFA, monitoring, limited host access, data diodes, and one-way replication) to reduce adversary lateral movement and protect critical operational assets.