What is an OT network?
An OT network (Operational Technology network) is the communication network that connects PLCs, HMIs, SCADA systems, sensors, actuators and other process equipment in order to control, monitor and protect industrial processes and physical systems. You find it in factories, power plants, water treatment works, pumping stations, tunnels and buildings. Unlike an office network, an OT network does not carry documents or e-mail but measurements and control commands that must arrive on time: a packet that arrives late can stop a machine or cause a safety function to trip.
Unlike IT networks, an OT network is all about availability, reliability and deterministic behaviour, often in real time.
🧠 How does an OT network work?
An OT network connects three kinds of components:
- Control - PLCs, DCS controllers and safety instrumented systems run the control and protection logic
- Field - IO modules, O, sensors, variable-speed drives and valves communicate over fieldbuses or Ethernet
- Supervision - SCADA, HMIs, historians and engineering workstations collect data, display the process and store measured values
The traffic has a character of its own. A controller exchanges inputs and outputs with its field devices cyclically, often every 1 to 100 milliseconds, and always with the same partners. On top of that there is acyclic traffic for parameters, diagnostics and engineering, and supervisory traffic in which SCADA polls the controllers periodically. Because the traffic pattern is so predictable, a new connection or an unknown protocol stands out quickly, which makes anomaly detection particularly effective in OT.
🧱 Which layers and zones make up an OT network?
Most OT networks are structured according to the Purdue Model, a reference model from the early 1990s by Theodore Williams and Purdue University that later became the basis of ISA-95. Each level gets its own network segment:
| Purdue level | Contents | Typical network |
|---|---|---|
| Levels 0–1 | Sensors, actuators, I/O and controllers | Fieldbus or field network (ProfiNET, Ethernet IP, Ethernet-APL) |
| Level 2 | SCADA, HMI, local engineering | Control network and supervisory network |
| Level 3 | Historian, MES, OT domain controllers | Site operations network |
| Level 3.5 | Jump servers, patch servers, data replication | IDMZ between OT and IT |
| Levels 4–5 | ERP, e-mail, internet, cloud | Office and enterprise network (IT) |
Ideally there is no direct route between IT and OT: traffic terminates in the IDMZ (an industrial DMZ), behind a firewall, or flows in one direction only through a data diode. IEC 62443-3-2 uses a risk assessment to divide a plant into zones with common security requirements and conduits as the controlled connections between them, the zones-and-conduits model. The Purdue levels are a common starting point for this, but not a substitute.
🔧 Which protocols does an OT network use?
Besides ordinary TCP/IP, OT networks use a range of industrial protocols. Many of them were designed for closed networks and have no authentication or encryption.
| Protocol | Transport | Typical use |
|---|---|---|
| Modbus TCP | TCP port 502 | Simple data exchange with PLCs, meters and building automation |
| ProfiNET RT/IRT | Directly on Ethernet (layer 2, not routable) | Cyclic I/O; RT around 1 ms, IRT down to 31.25 µs with dedicated hardware |
| Ethernet IP | TCP 44818 (explicit), UDP 2222 (I/O) | Factory automation, especially with Rockwell equipment |
| OPC UA | TCP 4840 (default) | Vendor-independent data exchange with built-in security |
| DNP3 / IEC 60870-5-104 | TCP 20000 / TCP 2404 | Telemetry in power and water distribution |
| IEC 61850 | Ethernet (GOOSE) and MMS | Substation automation |
Two technologies make Ethernet more suitable for hard timing requirements: Precision Time Protocol (IEEE 1588) synchronises clocks to within microseconds, and TSN (Time-Sensitive Networking, a set of IEEE 802.1 standards) reserves time slots for critical traffic. Safety functions run over a “black channel” protocol such as PROFIsafe or CIP Safety, which itself checks integrity and timeliness regardless of the underlying network.
🔄 What is the difference between an OT network and an IT network?
| Feature | OT network | IT network |
|---|---|---|
| Purpose | Controlling machines and processes | Managing data, applications and users |
| Priority | Availability and integrity, then confidentiality | Confidentiality and integrity, then availability |
| Protocols | ProfiNET, Modbus, OPC UA, Ethernet IP | TCP/IP, HTTPS, LDAP |
| Equipment | PLCs, sensors, HMIs, industrial switches | Servers, laptops, printers |
| Timing | Milliseconds, predictable (latency and jitter matter) | Best effort, delay is annoying but not dangerous |
| Security | Little built in, relies on segmentation | Layered, standard security |
| Changes | Only in maintenance windows, after testing | Frequent and largely automated |
| Suppliers | Often vendor-specific hardware and protocols | Largely standardised and interchangeable |
| Lifecycle | Long (15–25 years or more) | Short (3–5 years) |
The biggest practical difference is how a disruption plays out. In IT a reboot is an inconvenience; in OT it can spoil a batch or shut down a plant. That is why patch management and active scanning are more complex in OT: an aggressive network scan can make an older PLC hang.
🏭 How does an OT network achieve high availability?
Industrial networks use rugged hardware and redundant topologies. Managed switches with DIN-rail mounting, a wide temperature range and dual power supplies are standard. For the topology there are four common solutions:
| Technique | Standard | Topology | Recovery time after a fault |
|---|---|---|---|
| RSTP | IEEE 802.1w / 802.1D | Any (tree, ring, mesh) | Hundreds of milliseconds to several seconds |
| MRP | IEC 62439-2 | Ring, up to 50 switches | Maximum 500, 200 or 30 ms (10 ms with up to 14 switches) |
| PRP | IEC 62439-3 | Two independent parallel networks | 0 ms, every frame is sent twice |
| HSR | IEC 62439-3 | Ring, frames travel in both directions | 0 ms |
The choice follows from the process: a ring with MRP is sufficient for most machines, whereas substations and critical process plants use PRP or HSR because even a 30 ms interruption is too long there. You can read more about rings under Ring Redundancy.
🔐 How do you secure an OT network?
Security follows Defense in Depth: several layers, because no single measure stops everything.
- Segmentation - separate IT from OT, and within OT the production lines or process units, using industrial firewalls, VLANs and protocol filtering (see Network Segmentation)
- No open access from outside - suppliers and service engineers work through remote access with MFA and a jump server in the IDMZ
- Visibility - an up-to-date asset inventory and passive monitoring via SPAN ports or TAPs, feeding an OT IDS and a SIEM
- Hardening - disable unused ports and services, remove default passwords, update firmware only after testing
- Recovery - backups of PLC programs and switch configurations, stored offline
A true air gap is rarer than often assumed. Stuxnet proved in 2010 that an isolated network can be reached through USB sticks, and most plants now have connections for data, maintenance or cloud analytics. Through OT convergence, OT networks face malware, ransomware and insider threats that used to affect only IT.
🛠️ How do you design an OT network step by step?
- Inventory all devices, protocols and communication relationships. Without a map, segmentation is guesswork.
- Divide into zones based on risk and function, following IEC 62443-3-2. Start coarse: IT, IDMZ, site OT, and one cell per production line or process unit.
- Set the target security level per zone and derive the technical requirements from IEC 62443-3-3.
- Design the conduits: which connection may use which protocol, in which direction, to which destination. Anything not explicitly needed is blocked.
- Choose the redundancy per zone based on the interruption time the process can tolerate.
- Plan time synchronisation and addressing: fixed IP addresses, an address plan per zone and a reliable time source for logging and sequence-of-events.
- Set up monitoring and management and document everything, so that changes go through change management.
Dutch and EU context. Since 15 August 2026 the Dutch Cyberbeveiligingswet (Cbw) and the Cyberbeveiligingsbesluit have applied, the Dutch implementation of NIS2. For many energy, water, food and manufacturing companies, the OT network therefore falls under the duty of care and the incident reporting obligation. The Cyber Resilience Act additionally sets requirements for products such as industrial switches and firewalls: reporting of actively exploited vulnerabilities applies from 11 September 2026, full application from 11 December 2027. NIST SP 800-82 (Revision 3, September 2023) is a widely used, free guide to OT security.
❓ Frequently asked questions
What is the difference between an OT network and an ICS?
An ICS (industrial control system) is the whole set of control systems, such as PLCs, DCS and SCADA. The OT network is the communication infrastructure over which those systems talk to each other and to the field. Every ICS needs an OT network, but the network is only one part of it.
Can an OT network simply use Ethernet?
Yes, most modern OT networks use Ethernet, but with industrial protocols and rugged industrial switches. For hard timing requirements, technologies such as PROFINET IRT, TSN and Precision Time Protocol are added. With Ethernet-APL, Ethernet reaches into the field level: 10 Mbit/s over a single twisted pair, with trunks of up to 1,000 metres and spurs of up to 200 metres, including in hazardous areas.
Is an air gap enough to secure an OT network?
No, an air gap on its own is not a reliable way to secure an OT network. USB sticks, maintenance laptops and forgotten connections can bypass the separation, as Stuxnet showed. A secure OT network combines segmentation, access control, monitoring and recovery plans.
Why can’t you scan an OT network the way you scan an IT network?
Older PLCs and field devices have limited network stacks that can hang on unexpected packets or high scan rates. That is why administrators preferably map an OT network passively, via a SPAN port or TAP. Active scanning is done only selectively, at low speed and during a maintenance window.
Which standards apply to securing an OT network?
The most important standard is IEC 62443, with part 3-2 for zones and conduits and part 3-3 for the technical system requirements per security level. NIST SP 800-82 provides practical guidance, and in the Netherlands the Cyberbeveiligingswet imposes a duty of care and reporting obligations on essential and important entities. Together they form the framework for designing and operating an OT network.
How long does equipment in an OT network last?
Equipment in an OT network often stays in service for 15 to 25 years or longer, far longer than the 3 to 5 years common in IT. As a result, legacy systems without current security updates keep running. Segmentation and compensating controls protect that older equipment until replacement is possible.
📌 In summary
An OT network connects the control, field and supervisory layers of an industrial plant, with predictable timing and high availability as its key requirements. It is layered according to the Purdue Model, uses industrial protocols that often lack built-in security, and absorbs faults with rings and parallel networks. Security rests on zones and conduits according to IEC 62443, passive monitoring and controlled access, and in the Netherlands it increasingly falls under the Cyberbeveiligingswet.
An OT network is the backbone of industrial automation: it must always work, deliver on time and be well separated from the rest of the world.