The NIS2 directive requires critical infrastructure enterprises to implement strict cybersecurity controls in Operational Technology (OT) networks. This creates a critical dilemma for CISOs and heads of automation departments: how to implement robust network segmentation to pass an audit without disrupting the continuity of legacy equipment that cannot be easily updated or taken offline. Attempting to apply classic IT security tools directly to SCADA systems often results in emergency line shutdowns.
The updated NIST SP 800-82 (2026) guidance provides a clear architectural blueprint that allows for transforming legacy OT environments into secure, segmented networks. In this article, we examine the practical aspects of segmentation using the Zones & Conduits principle without creating risks for production.
The NIS2 dilemma in OT environments: why the classic IT approach disrupts industrial processes
The fundamental conflict between IT and OT lies in priorities. According to NIST SP 800-82, availability is the number one priority in OT environments, unlike corporate IT networks where confidentiality dominates. Shutting down a compressor station or turbine due to a false positive from an Intrusion Prevention System (IPS) can lead to colossal losses or a technological accident.
A significant portion of industrial equipment is legacy. These devices often use protocols without built-in encryption and authentication, have limited computing resources, and do not support regular security patching. Active network scanning with standard IT scanners can overwhelm the TCP/IP stack on an old controller (PLC) and cause it to fail. At the same time, NIS2 audits require access control and activity monitoring, forcing the search for architectural compromises.
Anatomy of NIST SP 800-82 (2026): adapting security controls for availability
NIST SP 800-82 is not a legally binding law, but it serves as a key guidance framework for adapting IT controls to the specifics of OT. The guidance is based on the concept of Defense-in-Depth and closely intersects with the ISA/IEC 62443 series of standards, which are applicable in over 20 industries.
Instead of the economically and technically impossible requirement to immediately update all PLCs, the standard recommends using compensating controls—specifically, isolating vulnerable devices within protected segments. Thus, even if a controller has a known vulnerability, an attacker cannot exploit it due to the lack of a direct network route from the corporate environment.
Practical implementation of Zones & Conduits: how to segment a network without stopping production
A fundamental tool of industrial cybersecurity is segmentation based on the Zones & Conduits principle. A Zone is a logical or physical grouping of OT assets with common security requirements. A Conduit is a single, controlled path for data transmission between zones, where traffic filtering is mandatory.
Segmentation design usually relies on the Purdue Model, which allows for the gradual, risk-aware separation of hundreds of different assets:
| Architecture level (Purdue Model) | Typical assets | Segmentation method (Zones) | Permissible communication channels (Conduits) |
|---|---|---|---|
| Level 4-5 (Enterprise IT) | ERP, mail servers, corporate databases | Full isolation from OT, placement in the IT zone | Only via DMZ (Level 3.5) with mandatory proxying |
| Level 3 (Operations Systems) | SCADA servers, engineering stations, general monitoring HMI | Operations management zone, restricted access | Encrypted tunnels, strict firewall rules, authentication |
| Level 1-2 (Process Control) | PLC (controllers), RTU, local HMI | Technological process control zones (isolated by shop/function) | Industrial protocols only (OPC UA, Modbus TCP via security gateways), direct IT access prohibited |
| Level 0 (Physical Process) | Sensors, valves, motors, legacy sensors | Physically protected connection zones | Direct wired connection to PLC, passive data extractors for monitoring |
The main rule: no asset from the corporate network (Level 4-5) should have a direct connection to technological controllers (Level 1-2). Interaction must occur exclusively through intermediary servers in the industrial DMZ.
Protecting legacy equipment: compensating controls and protocol normalization
A significant portion of assets in OT consists of legacy equipment. To protect it, NIST SP 800-82 suggests implementing compensating controls directly on the communication channels (Conduits):
- Industrial security gateways (Secure Gateways): Installed in front of groups of legacy PLCs. They accept unencrypted traffic, normalize it, strip out dangerous commands (e.g., firmware update attempts), and pass the data further through secure tunnels.
- Conversion to OPC UA: Using the industrial standard OPC Unified Architecture ensures secure, platform-independent interoperability. A gateway at the zone boundary can convert an old protocol without encryption into a standardized OPC UA stream with application-level authentication.
Passive monitoring and asset visibility: preparing for NIS2 audits without risk to SCADA
To satisfy NIS2 requirements, an enterprise must have full asset visibility and track communication patterns. To avoid the risks of active scanning, passive monitoring is used. Port mirroring (SPAN) is configured on switches, or physical Network TAPs are installed. Specialized platforms analyze a copy of the traffic, identify assets, detect anomalies in real-time, and generate a network map without creating any load on sensitive sensors or controllers.
Intecracy Group architectural approach: designing secure industrial IoT from sensor to dashboard
Although segmentation alone does not ensure full NIS2 compliance (the directive also requires organizational management and policies), it is a critical engineering foundation. Experts from the Intecracy Group technology alliance (specifically the company Softengi, which specializes in IoT and embedded systems) help design secure architectures according to best practices from the edge to the cloud (including AWS Well-Architected IoT Lens guidelines).
For real-time event processing, data collection from sensors, and integration with SCADA at the network edge, the specialized AZIOT Platform is used. It allows for the secure collection of telemetry via MQTT and Modbus protocols directly within isolated OT zones.
For systems consolidating telemetry, generating audit reports, and monitoring higher-level solutions, the UnityBase platform (a joint development of the Intecracy Group alliance companies, with InBase as the key developer) is used. This low-code platform allows for building a unified domain metadata model and automatically generates a REST API for reliable integration.
For infrastructure projects with high compliance requirements, commercial editions of the platform are deployed—UnityBase Enterprise (EE) or Defence (DE). They provide critical architectural mechanisms for NIS2:
- Strict access control at the record level (RLS) and attribute level (Attribute-level security);
- Complete, immutable audit trail of actions and system events;
- Support for advanced authentication mechanisms (OpenID Connect/OAuth2, Kerberos/NTLM);
- Ability to deploy on-premises in fully isolated (air-gapped) environments.
Such a comprehensive approach ensures that the enterprise not only meets regulatory requirements for visibility and control but also maintains the continuity of critical technological processes.
FAQ
How to meet NIS2 network security requirements if our SCADA equipment does not support encryption?
According to NIST SP 800-82, compensating controls are applied for legacy equipment: physical or logical isolation of devices into protected zones and the installation of industrial security gateways on conduits. Gateways normalize unencrypted traffic and transmit it further via secure protocols (e.g., OPC UA or encrypted tunnels).
What is the Zones & Conduits concept in the ISA/IEC 62443 standard and how to apply it in practice?
This concept involves the logical grouping of industrial assets with common security requirements (and the same risk level) into isolated zones. Any network interaction between different zones is permitted exclusively through strictly controlled conduits, where deep packet inspection and filtering are performed.
How to prepare an industrial network for a cybersecurity audit without stopping the continuous production cycle?
It is necessary to completely abandon active vulnerability scanning in OT networks. Instead, passive monitoring systems are deployed to analyze mirrored traffic (using SPAN ports or Network TAPs). This allows for the secure construction of an asset map (Asset Visibility) and the detection of anomalies without placing a load on legacy industrial controllers.