# OT Network Architecting

> Purdue-aligned segmentation, industrial DMZ design and secure remote access, engineered around the process instead of on top of it.

Canonical: https://blackbirdcyber.com/capabilities/ot-network-engineering  
Blackbird Cyber · https://blackbirdcyber.com/ · sales@blackbirdcyber.com

## Engagement

- Engagement: 6–16 weeks
- Delivery: On-site build
- Mapped to: IEC 62443-3-2 · Purdue

## Scope — From the industrial DMZ to the controller.

We design the zones, build the conduits, write the rule sets and cut over during the windows you already have.

- Zone and conduit architecture per IEC 62443-3-2
- Industrial DMZ with brokered data flows only
- Firewall, ACL and industrial switch configuration
- Secure vendor and remote access with session recording
- Redundant ring topologies and cutover plans

## Purdue levels in scope

| Level | Name | Systems | Scope |
| --- | --- | --- | --- |
| L5 / L4 | Enterprise | ERP, Email, Corporate AD | Out of scope |
| L3.5 | Industrial DMZ | Jump host, Patch relay, Historian mirror | In scope |
| L3 | Site operations | Historian, Eng. workstation, Domain ctrl | In scope |
| L2 | Supervisory | SCADA server, HMI, Alarm server | In scope |
| L1 | Control | PLC, RTU, Safety PLC | In scope |
| L0 | Process | Sensors, Actuators, Drives | Out of scope |

## Engagement timeline — Design, build, cut over.

- PH 1 · WK 1–3 · **Discover**: Passive capture and drawings. Every conversation on the wire, mapped.
- PH 2 · WK 4–7 · **Design**: Target architecture, rule sets and a cutover plan reviewed with operations.
- PH 3 · WK 8–14 · **Build**: Staged in parallel, tested against live traffic, cut over inside outage windows.
- PH 4 · WK 15–16 · **Hand over**: As-builts, runbooks and a change process your team can hold.

## You receive

Target architecture, as-built drawings, configured hardware, rule sets, cutover runbooks and a change-control process.

## We need from you

Network drawings, outage windows, integrator contacts and access to the switch closets.

## Other capabilities

- [OT Cyber Consulting](https://blackbirdcyber.com/capabilities/ot-cyber-consulting): Fractional OT security leadership for operators without a full-time ICS team.
- [OT Cyber Audit](https://blackbirdcyber.com/capabilities/ot-cyber-audit): A site-level assessment of control system exposure, ranked by consequence.
- [OT Cyber Program Review](https://blackbirdcyber.com/capabilities/ot-cyber-program-review): An independent review of your OT security program against the standards your regulators cite.

## Scope this engagement

Use the [contact form](https://blackbirdcyber.com/contact) or email sales@blackbirdcyber.com.