IT and OT Segmentation Validation, Conduit Testing, and Remediation Retesting
Prove the Boundary Between Office and Plant Actually Holds
Your diagram shows the plant separated from the office network and the firewall policy agrees, but neither knows about the engineering laptop with two network cards or the vendor tunnel that reaches a whole control segment. Global Digital Forensics tests the boundary from both sides to prove which routes actually cross it, through configuration review, observed traffic and operator approved path tests. Your engineers get the fix for each route, and we retest it once the change is made.
Scope the validation
Every Route Across the Boundary, Not Just the Firewall
Separate VLANs and a firewall can still leave a path open through routing, a temporary rule that outlived its project, an account that administers both sides or a machine plugged into both networks. We scope the validation around the systems that must stay separate and the communications the plant cannot live without, then check every way across, including the ones nobody drew.
Industrial DMZ and Firewall Rules
Rules, NAT, routes and access lists compared with the flows the plant actually needs, with broad permissions and stale exceptions flagged for removal.
Vendor Tunnels and Remote Access
Jump hosts, VPN concentrators, vendor gateways and cellular modems traced to see whether each reaches only the equipment it was installed to support.
Dual Homed Hosts and Shared Identities
Machines on two networks, wireless bridges and accounts spanning both domains, the routes that extend access without ever touching a firewall rule.
Every active check runs under the operator's authority, inside an agreed window, with stop points and rollback written down first.
The engagement
Compare the Boundary You Designed With the Access That Exists
A policy export proves intent, not enforcement. We put three kinds of evidence side by side: configurations show what is permitted, passive traffic shows what was actually used during the observation period, and approved path tests show how a selected connection behaves under test conditions. Every discrepancy between the three is examined, across enterprise and industrial boundaries, cell and area zones, management networks, safety systems, wireless links, historians and vendor channels.
Where an active check would put the process at risk, we work from configuration and passive evidence and say so in the report, with the coverage that method achieved. The findings name the boundary behavior the evidence supports and the change that would make the boundary enforce the access you intended.
Scope
IT and OT boundary and industrial DMZ
The boundary is compared with your reference design and ISA/IEC 62443 zone and conduit concepts, and broker and DMZ services are examined for direction, protocol and identity.
Cell, area and safety separation
Cell, area and safety instrumented system separation and management isolation, including broadcast and multicast traffic that quietly crosses zones meant to stay apart.
Identity and privilege paths
Accounts spanning domains, service identities and shared credentials that carry access between zones regardless of what the rules allow.
Remediation and retest plan
Each change names its owner, protocol needs, monitoring, safety dependencies, rollback and maintenance window, with a defined retest for the approved paths.
Not every check fits every plant. Tell us what zone diagrams you have and which boundary worries you, and we will mark which checks your evidence can support; the diagrams themselves move through a secure exchange we arrange.
Start From the Communications the Plant Needs
We begin with the traffic that must keep flowing: each material source, destination, service, direction, owner and business reason. That record is what separates necessary access from the exception opened for a commissioning project six years ago and never closed.
Identity is part of the path. A permitted connection to a jump host can lead to far broader access under the account that uses it, so we assess the rights behind jump hosts, shared credentials and administrative relationships alongside the rules themselves.
Your engineers can start that list before the first call. Our OT and utility audit preparation guide shows the records an assessment team asks for first.
Find the Routes That Bypass the Reviewed Firewall
A second network interface, a wireless bridge, a cellular vendor gateway or an engineering laptop can create a route the reviewed firewall never sees. We compare access lists, rules, routes and packet evidence with the diagram to find them.
Vendor tunnels deserve particular attention. A tunnel installed to support one workstation may reach an entire control segment. We document how far it reaches and why, then recommend a restriction that keeps the support route your vendor genuinely needs, for your team to implement and for us to retest.
Suspect a route the firewall never sees? Call (800) 868-8189 and describe the two networks that are supposed to be separate.
Methodology
How a Boundary Is Proven, Then Retested
-
Design: Intended Zones and Conduits
Drawings, engineering files and inventories are recorded with the operator to establish what the boundary is expected to enforce.
-
Evidence: Configuration and Traffic
Configuration exports plus passive traffic, identity and remote access records over a defined observation period, with collection points and timing documented.
-
Validation: Approved Path Tests
Observed reachability is compared with the design, and controlled checks run under operator supervision on the specific paths that matter.
-
Correction: Ranked Fixes and Retest
Findings are ranked by operating consequence, each with an owner, sequence, rollback and window, followed by the agreed retest.
Boundary Review, Full Validation or Fix Verification
Configuration and passive boundary review
For sites where active testing is off the table, rules, routes and observed traffic establish what the boundary permits and what actually crossed it, with no packet sent toward a controller.
Full validation with approved path tests
Configuration and traffic evidence plus operator approved reachability tests from agreed footholds on both sides, which is the strongest record a boundary can have.
Verification of your team's corrections
After your network team makes a change, we compare it against the configuration, the traffic and, where approved, a live test of the path that was supposed to close, and record the result beside the original finding.
If the boundary itself has never been mapped, an OT network assessment usually comes first. If it holds, ICS penetration testing answers the next question: what an attacker already inside could reach.
Evidence commonly examined
Describe the plant and the constraints your operators set and the first call plans the work around them.
Segmentation Evidence We Review
Firewall, router and switch exports document the configured boundaries, and passive captures identify flows at documented collection points. Remote access and identity records show who crossed the boundary and when, drawings and asset registers set out the intended design, vendor agreements define the support access that was approved, and operator approved reachability tests validate the selected paths.
What you receive
Your Reachability Findings and Corrective Action Plan
A zone and conduit map of the reachability the evidence supports, ranked findings tied to operating consequence, a remediation sequence with owners and windows, retest evidence for each selected path and an exception register for compensating controls.
The first conversation is free and starts the scope with you. Request it now.
Every Reachability Finding Carries Its Proof
A segmentation finding gets argued over by engineering, vendors and sometimes auditors, so each one comes with the configuration line, the capture or the test record behind it, written by a practice whose examiners have testified in federal and state courts. Read the team biographies for the credentials of Joseph Caruso and Robert Knudsen.
Free segmentation guide
Download the OT Segmentation Review Guide
Our guide to validating IT and OT segmentation across multi site operations shows which diagrams, rule exports, remote access records and owners to gather, and how a validation is staged around operating windows. Bring it to the first call and the scope can be set in one conversation.
OT Segmentation Review Guide
Records, owners and staging for a multi site IT and OT boundary validation.
Format: PDF, also readable online.
OT Assessment Planning Tools
An OT security review checklist, a preparation worksheet and the full planning library with sector packs and a project workbook.
Format: PDF checklist, CSV worksheet and ZIP library.
Download the OT Security Review Checklist (PDF) or read it online
Download the Assessment Preparation Worksheet (CSV), explained in the OT and utility audit preparation guide
Download the OT Assessment Planning Library (ZIP), described on the planning library page
More audit and assessment packages are listed by subject in our library of preparation packages.
Frequently asked
VLANs, Active Testing and Audit Evidence
Does a VLAN prove isolation?
On its own, no. A VLAN separates traffic at layer two; routing and access controls decide what crosses between VLANs, and trunk settings, vendor bridges and dual homed hosts can open alternate routes. We test that combined behavior before calling anything isolated.
Can you verify changes made by our network team?
Yes. We compare the intended fix with the configuration, the observed traffic and, where approved, a live test of the path that was supposed to close, and we record the result beside the original finding.
Is active testing safe in an OT environment?
Active tests run only under the authority your operator designates, with approved process conditions, stop points and recovery steps. Where an active check would pose unacceptable risk, we use configuration and passive methods, and the operator keeps control of process safety and change windows throughout.
Can the results support NERC CIP or NYDFS Part 500 evidence?
Yes. The reachability record, rule review and retest evidence are organized so your compliance team can map them to the requirement in front of it. See our NERC CIP audit evidence support and NYDFS Part 500 evidence support for how that mapping works.
Name the Two Networks That Must Stay Apart
Bring the systems that must stay separate, the communications that must continue and the limits your operators set. The first call settles which boundaries and paths to test, which methods your site will allow, the observation period and the price, and that consultation is free.
Talk with an examiner
One Boundary Question Is Enough to Begin
Bring your network design, the critical systems behind it and your approved testing limits. We will discuss the source records, the expertise and the scope the boundary review needs, and the first consultation is free.
GDF has operated since 1992, and the hotline is answered 24/7 by a practice that includes court tested examiners.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .