ot-network-segmentation-designlisted

## When to Use - Designing segmentation for a new or expanded OT network. - Redesigning zones after an audit found cross-level traffic. - Setting SL-T targets per zone before a 62443-3-3 assessment. - Producing the zone map that downstream design skills consume. ## Prerequisites - Asset inventory from `passive-ot-network-discovery` or equivalent. - Process flow requirements from the control engineer: which functions depend on which flows. - Consequence-of-compromise statement per function: what happens if this zone is compromised. - Maintenance and operational constraints that bound the design. - Credentials: none. This skill produces documents. - Authorization: operations manager and security manager review the completed design. - Upstream skills: `passive-ot-network-discovery` for the asset baseline. ### Safety This skill is passive. It produces design documents only. ## Workflow 1. Group assets into candidate zones by function and consequence. Criteria: assets sharing a process function, a failure mode, and a consequence-of-compromise class share a zone. Zone by function first, protocol second. 2. Place zones on Purdue levels. L1 controllers, L2 supervision, L3 site operations, L3.5 DMZ, L4 enterprise. A zone never spans two levels. A zone that wants to span levels is two zones with a conduit. 3. Set SL-T per zone. Requirement: IEC 62443-3-2 risk assessment per zone. Anchor: 62443-3-2 zone and conduit design. Criteria: SL-T equals the highest security level the cons