Two plants can share the same network diagram and have different exposure. One may use a managed jump host for vendor support; another may retain an undocumented cellular path. A multi-site segmentation assessment should compare the common design with the connections, identities and operating constraints at each facility.
Use a common flow record, not a common assumption
For each required crossing, record source, destination, protocol, direction, purpose, owner and expected operating condition. Ask the operator what fails if the flow stops. The resulting record distinguishes necessary process communication from rules that remain open because no one owns the decision.
Review paths through enterprise networks, industrial demilitarized zones, remote-access services, engineering stations and maintenance connections. Include identity relationships and administration paths. A blocked ping is not proof that an application or management service is unreachable.
Compare configuration with observed communication
Use available firewall, route, translation and switch records alongside passive traffic observations. Document the capture points and period so an unobserved flow is not mistaken for an impossible flow. Check for dual-homed systems and temporary arrangements that bypass the intended boundary.
- Separate approved design, observed condition and unresolved uncertainty.
- Identify shared remote-access infrastructure that affects several facilities.
- Record exceptions by site and process owner.
- Keep evidence of the original exposure for the remediation retest.
Approve tests and changes with the operator
Life safety, environmental protection and stable operations take priority. Start with configuration review and passive evidence. Active validation requires operator-designated authority, a process-risk review, approved operating conditions, explicit stop points and personnel able to halt the work. Some boundaries cannot safely be tested live and should remain a documented limitation or be tested in an appropriate non-production environment.
A remediation recommendation should name the affected process, expected result, change window and rollback conditions. Closing a ticket is not the same as confirming that the original path is controlled without breaking required communication.
See OT network assessments and multi-site passive asset discovery. For the broader safety and architecture guidance, consult NIST SP 800-82 Revision 3.