OT Safe-to-Isolate Matrix
In an IT incident you isolate the infected machine. In a plant, isolating the wrong thing can blind the operators, stop the line or remove a safety layer. List your OT assets and zones, say how much the process depends on each and whether there is a manual fallback, and get a matrix: safe to isolate now, isolate with an operator on site, do not isolate — monitor, or requires a controlled shutdown decision, with the reasons.
- TypeSafety impactProcess dependencyManual fallbackCompromise
- TypeSafety impactProcess dependencyManual fallbackCompromise
- TypeSafety impactProcess dependencyManual fallbackCompromise
- TypeSafety impactProcess dependencyManual fallbackCompromise
- TypeSafety impactProcess dependencyManual fallbackCompromise
- TypeSafety impactProcess dependencyManual fallbackCompromise
- TypeSafety impactProcess dependencyManual fallbackCompromise
- TypeSafety impactProcess dependencyManual fallbackCompromise
The matrix — Northgate bottling plant
- Vendor remote-access jump host
- IT/OT DMZ (MES orders, reporting)
- Plant historian HIST-01
- Engineering workstation EWS-02
- Control-room HMI (filling line)
- Pasteuriser PLC
- Boiler safety system (SIS)
- Chlorine dosing PLC (logic differs from known-good)
Why, and how to isolate each one
- Isolate nowVendor remote-access jump hostRemote access / jump host
- Remote access is one of the most common ways into OT, and cutting it does not affect the running process.
How: Disable the accounts and the inbound VPN or remote-access rule; unplug cellular modems. Arrange on-site cover for any vendor support you lose.
- Isolate nowIT/OT DMZ (MES orders, reporting)IT/OT DMZ service
- The process keeps running without it, so isolating it costs visibility or reporting, not control.
How: Cut at the DMZ firewalls on both sides. List what stops working (orders, reports, licences, time sync) and tell operations before you pull it.
- Isolate nowPlant historian HIST-01Historian
- The process keeps running without it, so isolating it costs visibility or reporting, not control.
- Confirmed compromise: isolate it first, before it is used to reach anything else.
How: Block it at the IT/OT DMZ firewall rather than powering it off; collectors on the plant side usually buffer data for a while. Keep it powered for evidence.
- Isolate nowEngineering workstation EWS-02Engineering workstation
- The process keeps running without it, so isolating it costs visibility or reporting, not control.
- Confirmed compromise: isolate it first, before it is used to reach anything else.
How: Pull its network connection but keep it powered on for memory capture. Never use it to connect to a controller until it is cleared.
- With operatorControl-room HMI (filling line)HMI / SCADA server
- Operators use it to see or steer the process; isolating it means they work blind or from local panels.
- A tested manual fallback exists, so it can be isolated once operators are in position on local controls.
How: Isolate from the IT side and other zones while keeping its link to the controllers, if operators still need it. If it must come off entirely, have operators on local panels first.
- MonitorPasteuriser PLCPLC / controller
- It runs the process in real time; isolating it takes away supervisory view and control, and some designs depend on peer-to-peer traffic between controllers.
- No fallback: isolating it would stop or destabilise the process. Contain at the zone boundary, compare its logic read-only, and monitor.
How: Isolate at the switch or zone firewall upstream, not by power. The controller keeps running its logic; the HMI loses view and control of it.
- MonitorBoiler safety system (SIS)Safety instrumented system
- The safety instrumented system is the last line of defence; disconnecting or disabling it removes protection exactly when you may need it.
- Watch it closely: key-switch position, bypasses, program-mode changes and diagnostics. Escalate at once if any change.
How: Do not disconnect the safety system from the process. Only its engineering or network links may be cut, with the safety engineer present and confirmation it will not trip.
- Shutdown decisionChlorine dosing PLC (logic differs from known-good)PLC / controller
- It runs the process in real time; isolating it takes away supervisory view and control, and some designs depend on peer-to-peer traffic between controllers.
- Confirmed compromise and no way to run without it: the decision is whether to bring the process to a controlled stop. That belongs to operations and process safety.
How: Isolate at the switch or zone firewall upstream, not by power. The controller keeps running its logic; the HMI loses view and control of it.
What this tool is
- List your OT assets and zones — or start from a sample plant with a historian, engineering workstation, HMI, PLC, safety system, remote-access jump host and IT/OT DMZ.
- For each one, set the safety impact if it is lost, how much the process depends on it, whether a manual fallback exists, and whether it is compromised.
- The matrix sorts them into four groups: safe to isolate now, isolate with an operator on site, do not isolate — monitor, and requires a controlled shutdown decision.
- Every placement shows its reasons and how to isolate that kind of asset with the least disturbance. Copy the whole matrix as text for the incident log or the OT playbook.
- Free, in your browser, nothing uploaded. A planning aid: operations and your process-safety authority make the call.
Decide this before the incident
The worst time to work out what you can unplug is at 3 a.m. with ransomware spreading. The matrix is most useful as a planning exercise with operations and control engineering: agree, asset by asset, what can be cut on the security team's call, what needs an operator in position first, and what should only ever be watched. Then put the result in the OT incident response playbook.
The rules are deliberately conservative and shown openly. Remote access and the IT/OT DMZ come first, because they are the common ways in and cutting them does not touch the process. Systems the process depends on move toward “with an operator” or “monitor” depending on whether a tested manual fallback exists. The safety instrumented system is never isolated as a containment step. If you disagree with a placement for your plant, that disagreement is the conversation worth having.
Frequently asked questions
What does "safe to isolate" mean in OT?
That cutting an asset off the network will not stop, destabilise or blind the process in a way that creates a safety or production risk. Remote-access paths, the IT/OT DMZ and many historians fall in this group. Controllers, HMIs and safety systems usually do not, because the process or the operators depend on them in real time.
Should we ever isolate a safety instrumented system?
Not as a containment step. The safety system is what protects people and equipment if the process goes wrong, and disconnecting it removes that protection when it may be needed most. Its engineering or network links can sometimes be cut, with the safety engineer present and confirmation it will not trip. If its integrity is in doubt, the question becomes whether to bring the process to a controlled stop.
Why does the manual fallback matter so much?
Because isolation of a supervisory or control system is only safe if operators can still run or stop the process without it. A tested fallback (local panels, hand operation with written procedures and enough staff) turns "do not touch" into "isolate with an operator on site". An untested fallback is a plan nobody has practised, so the matrix treats it cautiously.
When is shutdown the answer?
When a system the process depends on is confirmed compromised, there is no workable fallback, and running on it cannot be shown to be safe. That decision belongs to operations and process safety, not to the security team. The matrix flags those assets so the decision is made deliberately and early, not in a panic.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.