CISA Industrial Control Systems (ICS) Security Guidance CISA-ICS-DID-24: ICS Network Architecture

Design ICS network architecture using defined zones, a demilitarised zone (DMZ) between the control network and the corporate/enterprise network, and VLAN segmentation to separate functions and contain compromise.

Other controls in CISA ICS: Defense-in-Depth Recommended Practice

CISA-ICS-DID-21 Risk Management for ICS
CISA-ICS-DID-22 Asset Inventory and Risk Characterization
CISA-ICS-DID-23 Physical Security
CISA-ICS-DID-25 Security Architecture (Perimeter, Firewalls, Diodes, Access)
CISA-ICS-DID-26 Host Security (Patch, Field Devices, Virtual Machines)
CISA-ICS-DID-27 Security Monitoring (IDS/IPS, Logging, SIEM)
CISA-ICS-DID-28 Vendor Management and Supply Chain Security
CISA-ICS-DID-29 The Human Element (Awareness and Training)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All CISA Industrial Control Systems (ICS) Security Guidance controls