OT Asset Visibility and IT/OT Segmentation for a Distributed Renewable Operator

The operator was scaling fast, adding solar and storage sites across a wide and remote geography, and connecting operational technology to its IT network so it could monitor and optimize assets centrally. That connection is exactly what modern renewable operations need: visibility into distributed assets, the ability to spot problems early, and data to optimize performance across sites.

It is also what creates serious new risk. The operational systems running these sites, the controllers, sensors, and SCADA components, were designed for a world where they were isolated, not for exposure to modern threats. Many could not be easily patched. As OT and IT converged, the security team realized it could not even fully inventory what was on the OT network, let alone secure it, and remote sites were difficult to monitor or maintain.

The purpose of the engagement was to capture the visibility and data the business wanted from connected operations, while keeping the inherently vulnerable OT systems protected. That meant achieving full OT asset visibility, establishing proper IT/OT segmentation aligned to IEC 62443, and doing all of it in a way that respected OT reliability rather than applying disruptive IT-style practices. The work had to account for the realities of remote, sometimes bandwidth-constrained sites.

Project duration

The engagement ran in three fixed-price stages over approximately five months.

Deliverables

• A complete, current inventory of OT assets across all sites
• IEC 62443-aligned IT/OT segmentation (zones and conduits)
• Secure remote access and monitoring for distributed sites
• OT-aware continuous monitoring without disrupting control systems
• A governed data platform for asset-performance and operational data
• A clear, defensible boundary between corporate IT and operational technology

The core challenge was that connecting operations had quietly removed the one thing that was protecting the OT systems: isolation. These systems were never built to be secure against modern threats, because they were never meant to be reachable. Now they were connected, and the team had neither a full inventory of what was on the OT network nor proper segmentation between the corporate IT environment and the systems that physically run the sites.

This is a regulatory and a physical-risk problem, not just an IT one. A compromise on the operational side can affect generation, safety, and grid stability, and the consequences are physical, not just data loss. Standard IT security practices, like aggressive patching, can themselves disrupt fragile control systems, so the usual playbook does not apply. The operator needed OT secured on its own terms.

Our solution architect designed a staged roadmap that started where OT security has to start, with visibility, then established segmentation, then layered on safe monitoring and a governed data foundation.

Stage one, see everything. We deployed OT asset discovery and passive network monitoring to build a complete, current inventory of what was actually on the OT network across every site. Passive techniques were chosen deliberately, because they map the environment without injecting traffic that could disturb sensitive control systems. You cannot secure or optimize what you cannot see, so this came first.

Stage two, segment the right way. With a clear picture of the environment, we established IEC 62443-aligned segmentation, organizing the OT environment into zones and conduits and putting a clear, defensible boundary between corporate IT and operational technology, enforced with industrial firewalls and, where appropriate, data diodes. We implemented secure remote access for the distributed sites, so the team could reach assets without exposing them.

Stage three, monitor safely and capture the data. We added OT-aware continuous monitoring that watches for unusual activity without the disruptive patching or scanning that can break control systems, compensating for the fact that the underlying systems often cannot be patched. In parallel, we built a governed data platform to capture asset-performance and operational data, delivering the visibility and analytics that justified connecting operations in the first place, safely.

On the OT and network side, we used OT asset discovery and passive monitoring to inventory the environment, then implemented Purdue-model, IEC 62443-aligned segmentation with industrial firewalls and data diodes to separate IT from OT and to create enforceable zones and conduits within the OT environment. Secure remote access replaced ad hoc connectivity to distributed sites, and OT-aware monitoring fed into a SIEM tuned for industrial environments. Identity and access were governed through IAM with MFA and least privilege, with secrets in HashiCorp Vault.

On the data side, we built a governed data platform (on AWS or Azure, provisioned through Terraform) that ingested asset-performance and operational data, including SCADA and historian data through OPC UA, into time-series storage where it could be analyzed for performance and reliability. Crucially, the data flowed out of the OT environment through controlled conduits, so the operator gained visibility without opening the operational systems to the corporate network or the internet.

• Visibility first, always. You cannot secure or optimize OT assets you cannot see, so the complete inventory came before anything else.
• Passive, non-disruptive techniques. We mapped and monitored without injecting traffic that could disturb fragile control systems.
• Segment to IEC 62443, not IT habits. OT was secured on its own terms, with zones and conduits and a defensible IT/OT boundary, not by treating it like a corporate network.
• Capture the data through controlled conduits. The business got the visibility and analytics it wanted without exposing the operational systems generating the data.

Engagements of this type target the following outcomes:

The engagement achieved its goals:

1. The operator has a complete, current inventory of its OT assets across all sites, where before there was guesswork.
2. IT and OT are properly segmented, so a breach in the corporate network cannot reach the systems that run the sites.
3. Distributed assets are monitored safely, without disrupting the control systems.
4. The business has the asset-performance data and visibility it wanted from connected operations, captured without opening the door.