The updated NIST SP 800-82 (2026) standard imposes strict requirements on IT/OT environment segmentation, forcing enterprises to rethink the architecture of connections between shop-floor equipment and corporate ERP systems. The document emphasizes that IT and OT segmentation is a fundamental industrial cybersecurity control. Technical leaders face a challenge: business demands real-time telemetry for ERP-driven optimization, but direct connection of legacy systems creates critical vulnerabilities where an attack on the corporate IT network can halt physical production.
Why ERP becomes an attack vector for production: the IT and OT priority conflict
The main complexity of integration lies in a fundamental conflict of priorities. In classic IT, confidentiality is paramount. Conversely, in OT environments, as noted by NIST SP 800-82, availability takes precedence over confidentiality, requiring specific protection measures distinct from traditional IT solutions.
Legacy OT equipment often lacks the resources for encryption, authentication, or regular security patching. Any direct connection of such equipment to a corporate network where an ERP functions opens a path for the lateral spread of cyber threats. This is why the standard insists on adapting IT controls to OT specifics through compensating measures at the network level, as not all equipment can be updated or safely connected directly.
The Zones and Conduits concept per NIST SP 800-82: isolating critical assets
The foundation of a secure architecture is IT/OT segmentation, which in the NIST SP 800-82 standard and the ISA/IEC 62443 series is based on the "Zones and Conduits" principle. No device from the OT zone should have a direct network connection to the corporate IT zone. Any information exchange must occur exclusively through a demilitarized zone (DMZ).
This approach prevents a scenario where a compromised corporate segment becomes an entry point for modifying the logic of programmable logic controllers (PLCs). Reverse control influence from an ERP to a PLC must be completely blocked.
Architectural pattern for secure transit: the role of Edge Gateway and OPC UA
To transmit IIoT data into an ERP without breaching the perimeter, an edge computing pattern is applied, as detailed in the AWS Well-Architected IoT Lens. The document advises clearly distinguishing which data to process at the edge and which to transmit to the cloud or ERP. Edge processing allows for filtering and normalizing telemetry before it reaches corporate systems.
In practice, instead of broadcasting a raw stream of high-frequency motor vibration data directly into an ERP, an industrial edge gateway is implemented between the shop-floor PLC network and the corporate system. It locally aggregates equipment health metrics and sends only summarized indicators to the ERP, ensuring a physical protocol break. At the same time, it is important to understand that edge gateways do not guarantee "absolute security" and are only one element of defense-in-depth.
An important component of this break is the OPC UA (OPC Unified Architecture) protocol. Thanks to its platform-independent architecture, OPC UA ensures secure and reliable interoperability, acting as a standard for normalizing machine data (e.g., from Modbus) before transmission into the IT circuit.
Minimizing risks for legacy systems: compensating measures at the network level
For systems where legacy equipment integration is vital, strict firewall rules are implemented. All requests between the OT zone and the IT DMZ must pass only authorized and normalized traffic. Certain critically outdated systems require complete isolation, as their secure connection is impossible even with a buffer zone.
The scale of the task is complicated by the growing number of connections. According to the Ericsson Mobility Report, 5G will become the dominant mobile access technology by subscription count by the end of 2027. The number of IIoT devices will reach thousands, requiring automated lifecycle management at the network level.
Practical implementation: building a secure bridge between the shop floor and corporate center
The development of custom IoT/embedded solutions and integration gateways for secure telemetry collection is a key focus for Softengi (a member of the Intecracy Group alliance). Engineers develop architecture that allows for building digital twins and integrating OT data into enterprise systems without violating the security perimeter.
At the shop-floor level, the AZIOT Platform can be used—an IoT platform that provides real-time edge event processing and secure integration with SCADA using Modbus and MQTT protocols. For receiving, processing, and storing aggregated business metrics at the corporate level, solutions can be built on the UnityBase platform. Its Enterprise and Defence editions provide strict access control (RBAC, RLS, ACL), detailed audit trail maintenance, and the ability to securely integrate with existing ERPs via generated REST APIs, preventing direct queries into the production segment.
Architecture requirements matrix for IIoT to ERP integration per NIST SP 800-82
| Architecture Level | Technical Mechanisms | Security Result |
|---|---|---|
| Edge Level | Protocol filtering and normalization (e.g., Modbus to OPC UA) | Prevents transmission of raw, unvalidated traffic to the IT network |
| DMZ Level | Unidirectional data transfer (data diodes) or strict ACLs on firewall | Completely excludes the possibility of reverse control influence from ERP to PLC |
| ERP Level | Reception of aggregated business metrics (not raw telemetry) | Reduces load on ERP and eliminates the need for direct system access to the OT zone |
FAQ
How to ensure compliance with NIST SP 800-82 requirements when integrating SCADA with ERP?
According to the Zones and Conduits concept, it is necessary to completely abandon direct network connections between SCADA and ERP. Data must be transmitted through a demilitarized zone (DMZ) using edge gateways to normalize protocols (e.g., switching to OPC UA) and send only aggregated indicators.
Can standard IT firewalls be used for OT network segmentation?
Standard IT firewalls are often insufficient because the priority of OT is uninterrupted availability, not confidentiality. OT segments require specialized industrial firewalls capable of analyzing specific protocols and supporting strict access rules, or physical unidirectional gateways (data diodes).
Which protocols are secure for transmitting industrial data to the business application level?
For secure and reliable interoperability between closed shop-floor systems and IT infrastructure, it is optimal to use OPC UA or MQTT over TLS. They allow for the application of built-in encryption and authentication to protect telemetry.