Introducing a boundary into an OT network without understanding required data flows can affect operations. Alongside a network drawing, teams need a connection map explaining why each application accesses each source. This is a guide to organizing design inputs, not instructions for changing a production network.
Add data flows to the asset inventory
For each connection, record source, destination, business purpose, protocol, direction, expected frequency and owner. Include less-visible dependencies such as time synchronization, licensing and backups. IP addresses alone are not sufficient: record the asset function and responsible team.
Validate the design across teams
IT, OT, process and vendor teams should review the same connection list. An unnecessary connection and one whose owner has not yet been found are different cases. Track uncertainty as an investigation item. Define remote-support requirements together with duration, authorization and monitoring responsibility.
Plan testing and rollback
Prepare an approved test plan, observation period and rollback conditions. Establishing a connection is not the only acceptance criterion; consider data quality, delay and failure behavior. NIST SP 800-82 is a reference for considering OT security alongside operational and reliability requirements.
Review with your team
- Does every connection have a purpose and owner?
- Are indirect dependencies listed?
- Is an approved test and rollback plan available?
Next step
To map these points to your plant scope, use the project preparation checklist. An engineering discussion can review installed conditions, open questions and priorities together.
