Practical OT Security No. 2
If disconnecting a path also cuts your access to its control, how will you reconnect it?
For small and mid-size utilities and the integrators who support their OT systems.
Use this worksheet to plan one disconnect boundary, check operational dependencies, and establish how authorized staff will restore access safely.
Inside the worksheet
- Two worksheet pages and a one-page fictional example continuing the Cedar Bend utility scenario
- Questions covering the disconnect boundary, operational dependencies, and alternate routes
- Checks for independent management access, authorized reconnection, and safe validation
- Space to record the decision, owners, and evidence needed
FICTIONAL WORKED EXAMPLE
Cedar Bend’s login dependency
Cedar Bend discovers that its disconnect control’s remote login depends on an Active Directory server reached through the maintenance path. The team rejects that management design until independent login and recovery can be demonstrated.
These worksheets are TANDMM’s interpretation of NSA’s October 2026 guidance, Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles. Pages 10-11 address remote and third-party access. Pages 16-17 address safe validation. No NSA endorsement of these resources or any product is implied.
PRECEDING STEP · PRACTICAL OT SECURITY NO. 1
OT Vendor Access Review
Review one vendor connection. Compare hours worked with hours of available access, identify what remains accessible, and assign the questions your team needs to resolve.
Questions about your environment? Contact TANDMM.