dmz-architecture-for-otlisted

## When to Use - Designing the DMZ for a new OT network or a segment redesign. - Replacing direct IT-to-OT flows with brokered services. - Deciding between a data diode and a firewall for a specific flow. - Consolidating scattered boundary services into a defined L3.5. ## Prerequisites - Zone and conduit design from `ot-network-segmentation-design`. - List of flows crossing the IT-OT boundary today, from the discovery baseline. - Data direction and value per flow: which way data flows and what the enterprise does with it. - Budget envelope: diodes and unidirectional gateways cost more than firewall rules. - Credentials: none. This skill produces documents. - Authorization: operations manager and security manager review the completed design. - Upstream skills: `ot-network-segmentation-design` for the zone map. ### Safety This skill is passive. It produces design documents only. ## Workflow 1. Inventory every IT-to-OT flow. Requirement: the DMZ design covers all boundary traffic. Anchor: SR 5.1. Criteria: per flow, record data direction, source, destination, protocol, and the business function. Unnamed flows do not get DMZ services. They get denied. 2. Service placement decision. Requirement: every service that both IT and OT need lives in the DMZ, not in either network. Anchor: SR 5.2. Decision: historian replication target, patch staging server, antivirus signature distribution, file exchange, jump hosts, and vendor access termination all place in L3.5. Trade-off accep