Microsegmentation

What is microsegmentation?

Microsegmentation is a network security strategy in which a network is divided, within its existing zones, into very small, logically isolated segments around individual devices, workloads or applications, so that each segment only permits the communication that is strictly necessary. Where classic network segmentation or segmentation separates large blocks, such as office and production, microsegmentation governs who may talk to whom inside such a block. In OT networks, microsegmentation therefore limits the lateral movement of attackers and gives fine-grained control over traffic between PLCs, SCADA, HMIs and the engineering station.

🧠 How does microsegmentation work?

Microsegmentation works with an allowlist: every connection is forbidden unless a rule explicitly permits it. A rule describes a source, a destination, a protocol or port and sometimes a direction or time window. The Zero Trust principle of “never trust anything because of its network location” is enforced technically in this way. The policy is usually managed centrally in a policy engine or management console and, in some environments, pushed to switches and firewalls through software-defined networking (SDN).

The US agency CISA describes microsegmentation as an extension of macrosegmentation: the large zones remain in place but are divided further. A microsegment can be static, for example based on IP address and port, or dynamic, based on identity, role, application profile or device posture. CISA stresses that microsegmentation does not replace defence in depth but complements it.

Enforcement takes place at a policy enforcement point. CISA distinguishes five types:

🔄 What is the difference between microsegmentation and VLAN segmentation?

A VLAN separates traffic at layer 2, but on its own it is not a security boundary: as long as a router connects all VLANs without filtering, the network is effectively flat. Moreover, devices within the same VLAN talk to each other freely. Microsegmentation closes exactly that gap.

In OT, microsegmentation is therefore a refinement, not a replacement: first coarse zones following the Purdue Model, then finer segments where the risk justifies it.

🏭 What does microsegmentation look like in an industrial network?

Within a production cell, microsegmentation means that devices only keep the connections the process actually needs:

• PLCs talk only to their own HMI and not to PLCs or HMIs on other lines
• Remote access is permitted only to specific assets and only during maintenance windows, through a jump server
• SCADA servers do not communicate directly with OT clients outside their zone
• An engineering station can only make changes to equipment within its project scope
• Critical processes are isolated from less trusted parts, such as wireless access and supplier networks

A typical rule set for a single cell looks like this:

Protocol filtering and deep packet inspection take this a step further. An industrial firewall can, for example, allow Modbus function code 3 (read holding registers) and block the writing function codes 5, 6, 15 and 16 for every source except the operating HMI.

🔐 Which standards and guidelines call for microsegmentation?

The IEC 62443 series is the main framework in OT, complemented by US guidance that is widely used in Europe as well:

• IEC 62443-3-3 - foundational requirement FR 5 Restricted data flow contains SR 5.1 (network segmentation) and SR 5.2 (zone boundary protection); requirement enhancement SR 5.2 RE 1 asks for deny by default, allow by exception, exactly the allowlist principle of microsegmentation
• IEC 62443-3-2 - the risk assessment with which you group assets into zones and conduits; microsegmentation refines those zones
• NIST SP 800-207 (August 2020) - names microsegmentation as one of three approaches to a Zero Trust Architecture, with gateways such as next-gen firewalls or host agents as enforcement points
• CISA Zero Trust Maturity Model 2.0 (April 2023) - in the Networks pillar, the Network Segmentation function progresses from large perimeters and macrosegmentation to fully distributed micro-perimeters around application profiles
• CISA Microsegmentation in Zero Trust, Part One (29 July 2025) - a planning guide that explicitly also applies to OT, ICS and IoT
• NIS2 and the Dutch Cybersecurity Act - the act, in force since 15 August 2026, does not literally prescribe microsegmentation, but it does require appropriate network security measures; microsegmentation helps you demonstrate that an incident stays contained

🧭 How do you introduce microsegmentation step by step?

CISA recommends a phased approach in four steps that you repeat over time. Translated to an OT environment:

1. Select candidate assets - start with the assets with the highest impact, such as a safety instrumented system, the SCADA servers or a critical production line. Use the asset inventory as your source.
2. Map dependencies - use passive monitoring for several weeks to record who communicates with whom, including rare flows such as backups, time synchronisation and licence servers. Active scanning can disrupt older PLCs.
3. Define the policy - translate the observed flows into an allowlist and have process engineers and suppliers review it. Every rule gets an owner and a reason; see firewall rule management.
4. Roll out in phases - run rules in monitor or alert-only mode first, switch them to blocking only afterwards and schedule that during a shutdown or maintenance window.

Management follows: every change to the installation requires a change to the policy. Send permitted and blocked connections to a SIEM, so that anomaly detection picks up unusual traffic. Combine microsegmentation with IAM, RBAC and EDR on the Windows systems, and with 802.1X or NAC on the switch ports.

A hypothetical example: a drinking water company first divides a treatment plant into zones per process stage. Each pumping station PLC then gets a microsegment in which only its own HMI and the central SCADA server can reach it. An infected maintenance laptop at one site can then no longer address the PLCs of other process stages.

⚠️ What are the pitfalls of microsegmentation in OT?

• No agents on PLCs - endpoint solutions do not run on embedded controllers, so in OT enforcement usually sits in the network
• Unknown flows - a forgotten connection, for example to a licence server, can stop a line once a blocking rule is activated
• Latency and determinism - a firewall in a real-time path must keep up with the control cycle times; real-time Ethernet such as PROFINET tolerates little delay, and Precision Time Protocol is sensitive to variable delay (jitter) in devices that do not support the protocol
• Rule explosion - hundreds of manual rules without an owner become unmanageable; group by role or function rather than by individual IP addresses
• False sense of security - microsegmentation does not stop living-off-the-land attacks over permitted connections; monitoring remains necessary

❓ Frequently asked questions

Is microsegmentation the same as Zero Trust?

Microsegmentation is not the same as Zero Trust, but it is one of its most important building blocks. Zero Trust is a strategy in which no connection is trusted automatically. Microsegmentation enforces that principle in the network by deciding per connection what is permitted.

Can microsegmentation work with legacy PLCs?

Microsegmentation can work with legacy PLCs, because enforcement then does not take place on the device itself. You place an industrial firewall or a managed switch with access control lists in front of the PLC, which only lets the necessary traffic through. That way you also protect devices that do not support updates or agents.

Which standard requires microsegmentation?

No standard uses the word as a hard requirement, but IEC 62443-3-3 asks for network segmentation and zone boundary protection through SR 5.1 and SR 5.2, including deny by default. NIST SP 800-207 and CISA’s guidance explicitly name microsegmentation as a core part of a Zero Trust architecture. Microsegmentation is therefore a common way of meeting these requirements.

What is the difference between macrosegmentation and microsegmentation?

Macrosegmentation divides a network into large zones, such as office, DMZ and production, and controls traffic at the boundaries between them. Microsegmentation divides those zones further around individual devices or applications. Macrosegmentation limits spread between zones; microsegmentation limits lateral movement within a zone.

Does microsegmentation slow down the industrial network?

Microsegmentation adds a small delay when traffic passes through a firewall or filtering switch. For most SCADA and HMI communication that is negligible, but for real-time fieldbus traffic and time synchronisation you should keep enforcement out of the critical path or choose hardware that can handle the cycle times. Test it beforehand in a test environment.

How do you get started with microsegmentation in OT?

Microsegmentation in OT starts with insight: an up-to-date asset inventory and an overview of all communication flows through passive monitoring. Then pick one critical cell, draw up an allowlist and run it in monitor mode first. Only when no unexpected blocks remain do you switch the rules to blocking.

📌 In summary

Microsegmentation divides existing OT zones further around individual devices and applications, so that only strictly necessary connections are permitted and an attacker cannot move freely within a zone. In industrial environments this is mostly done with network-based enforcement, such as industrial firewalls with protocol filtering, based on IEC 62443, NIST SP 800-207 and CISA’s phased approach. It is a key part of a modern OT security architecture: start with insight into the communication flows, test in monitor mode and then manage the policy as part of the installation.