ot-network-isolation-procedurelisted

## When to Use - Isolating a compromised segment from the rest of OT during an incident. - Executing an isolation decision from `ot-incident-triage` or `ransomware-response-in-ot`. - Cutting a DMZ or L3 host away from controllers. - Post-compromise quarantine of any OT zone. ## Prerequisites - Zone and conduit map with Purdue levels. - Observed flow baseline from `passive-ot-network-discovery` showing which process flows cross the proposed boundary. - Firewall or switch configuration access for the boundary device. - Operations manager contact available for the isolation decision. - Credentials: admin on the boundary firewall or switch. - Authorization: operations manager approves every isolation. The safety engineer confirms process flows that cross the boundary are not safety-critical. - Upstream skills: `ot-incident-triage` or `ransomware-response-in-ot` for the decision record. ### Safety This skill is active. Isolation changes live network enforcement and is gated in the Workflow section. - Active. Applies firewall or VLAN changes to live segments. Requires operations manager approval. A wrong boundary is a process outage. ## Workflow > SAFETY: If at any point the action risks human safety or process integrity, halt and escalate to the operations lead before continuing. 1. Confirm the decision authority and the isolation scope. The operations manager approves the boundary. Record the approved boundary in the report before any change. 2. Identify the isolation bo