Corpus sync: neutrality remakes, note hygiene, datasheet relocation, transformer-split cross-refs
---
title: Process Control Networks
…144 unchanged lines
### Personnel configuring managed switches, routers, and firewalls shall hold current manufacturer certification on the products supplied, and personnel performing fiber-optic termination and testing shall hold a recognized fiber-optic installer certification.
−### For water and wastewater projects, the integrator shall demonstrate prior experience with distributed telemetry and DNP3, which differ materially from a single-site plant network. {note}
+### For water and wastewater projects, the integrator shall demonstrate prior experience with distributed telemetry and DNP3, which differ materially from a single-site plant network.
## Component Security Certification {toc}
…37 unchanged lines
### The MICE classification of ISO/IEC 11801 and ISO/IEC 24702 (Mechanical, Ingress, Climatic, Electromagnetic) describes the installation environment and is the basis for selecting hardware and cabling rated for it. {note}
+### Active network devices installed outside a conditioned control room shall be industrially hardened, with a wide operating-temperature range, fanless convection cooling, DIN-rail mounting, and redundant DC power input.
+
+### Devices installed in wet wells, lift stations, outdoor cabinets, or washdown areas shall be rated for the ingress and climatic class of the location, and connectors in those locations shall be sealed (e.g., M12 industrial connectors) rather than standard RJ45.
+
```datasheet
label: Network Environment Classification (MICE)
…6 unchanged lines
```
−### Active network devices installed outside a conditioned control room shall be industrially hardened, with a wide operating-temperature range, fanless convection cooling, DIN-rail mounting, and redundant DC power input.
−
−### Devices installed in wet wells, lift stations, outdoor cabinets, or washdown areas shall be rated for the ingress and climatic class of the location, and connectors in those locations shall be sealed (e.g., M12 industrial connectors) rather than standard RJ45.
−
### Specifying office-grade switches for plant-floor or outdoor service is a frequent and costly error; commercial switches with fans and a narrow temperature range fail early in industrial heat, dust, and vibration. {note}
…41 unchanged lines
### A demilitarized zone (DMZ) shall be provided at Level 3.5 between the OT network (Levels 0 through 3) and the enterprise/IT network (Level 4).
−### No direct communication path shall exist between the OT network and the enterprise network; all cross-domain data exchange shall traverse the DMZ.
−
−### Data shared with the enterprise (historian replication, reporting, remote read-only views) shall be brokered by a server or data diode located in the DMZ, so that no enterprise host initiates a connection directly into the control network.
−
−### The DMZ is the single most important architectural control for protecting the control network; a flat network with the OT and enterprise systems on the same broadcast domain has no defensible boundary and is the condition that lets IT-side malware reach controllers. {note}
−
```datasheet
label: OT/Enterprise Boundary Architecture
…7 unchanged lines
```
+### No direct communication path shall exist between the OT network and the enterprise network; all cross-domain data exchange shall traverse the DMZ.
+
+### Data shared with the enterprise (historian replication, reporting, remote read-only views) shall be brokered by a server or data diode located in the DMZ, so that no enterprise host initiates a connection directly into the control network.
+
+### The DMZ is the single most important architectural control for protecting the control network; a flat network with the OT and enterprise systems on the same broadcast domain has no defensible boundary and is the condition that lets IT-side malware reach controllers. {note}
+
## Zones and Conduits {toc}
…38 unchanged lines
### Modbus TCP is a simple, widely supported register-based protocol used for device integration and for equipment that lacks a native EtherNet/IP or PROFINET interface. {note}
+### The primary control protocol shall be applied consistently within a zone; mixing real-time control protocols within a single zone without a documented reason complicates redundancy, time sync, and troubleshooting.
+
```datasheet
label: Primary Ethernet Control Protocol
…7 unchanged lines
```
−### The primary control protocol shall be applied consistently within a zone; mixing real-time control protocols within a single zone without a documented reason complicates redundancy, time sync, and troubleshooting.
−
### Where multiple protocols are unavoidable, they shall be bridged at a defined gateway, not by allowing unrelated protocols to share a control VLAN.
## Serial and Legacy Protocols {toc}
−### Modbus RTU and PROFIBUS DP serve serial-connected and legacy field devices and shall be brought onto the Ethernet network through a gateway at a defined point rather than extended as long serial trunks. {note}
+### Modbus RTU and PROFIBUS DP serve serial-connected and legacy field devices and shall be brought onto the Ethernet network through a gateway at a defined point rather than extended as long serial trunks.
```datasheet
…27 unchanged lines
## Copper or Fiber Selection {toc}
−### Network media between active devices shall be selected per segment based on distance, the need for galvanic isolation, electrical-noise exposure, and the routing environment. {note}
+### Network media between active devices shall be selected per segment based on distance, the need for galvanic isolation, electrical-noise exposure, and the routing environment.
### Balanced twisted-pair copper (Category 6 or 6A per ANSI/TIA-568) is appropriate for segments within a building or panel lineup that are within the 100 m channel limit and not exposed to severe electrical noise or ground-potential differences. {note}
### Optical fiber is required where the segment exceeds the copper distance limit, crosses between buildings or structures with different ground references, runs through or near medium- and high-voltage equipment, or passes through areas of severe electrical noise. {note}
+### Fiber shall be used for any segment that crosses between separately grounded structures, because fiber is a dielectric and breaks the metallic path that would otherwise carry damaging ground-potential differences and surge current between buildings.
+
```datasheet
label: Backbone / Inter-Building Media
…7 unchanged lines
```
+### Copper segments shall not exceed the 100 m channel length of ANSI/TIA-568; segments approaching the limit shall use fiber or an intermediate switch.
+
```datasheet
label: Horizontal / Device-Level Media
…7 unchanged lines
```
−### Fiber shall be used for any segment that crosses between separately grounded structures, because fiber is a dielectric and breaks the metallic path that would otherwise carry damaging ground-potential differences and surge current between buildings.
−
−### Copper segments shall not exceed the 100 m channel length of ANSI/TIA-568; segments approaching the limit shall use fiber or an intermediate switch.
−
### Running copper between buildings or near medium-voltage gear is a recurring source of equipment damage and communication faults; the galvanic isolation of fiber eliminates ground loops and induced noise that copper cannot. {note}
…24 unchanged lines
```
−### Unmanaged switches shall not be used on the control network because they provide no segmentation, no redundancy participation, no port security, and no diagnostics, and they cannot be hardened. {note}
+### Unmanaged switches shall not be used on the control network because they provide no segmentation, no redundancy participation, no port security, and no diagnostics, and they cannot be hardened.
## Routing and Firewalls {toc}
…15 unchanged lines
## Topology and Redundancy Protocol {toc}
−### The control-network backbone shall use a redundant topology (ring or redundant star) so that a single cable or switch failure does not isolate controllers from the supervisory layer. {note}
+### The control-network backbone shall use a redundant topology (ring or redundant star) so that a single cable or switch failure does not isolate controllers from the supervisory layer.
−### The redundancy protocol shall be selected to meet the recovery-time requirement of the controlled process. {note}
+### The redundancy protocol shall be selected to meet the recovery-time requirement of the controlled process.
```datasheet
…23 unchanged lines
### A ring topology shall have a designated ring manager (redundancy manager), and the role assignment shall be documented; client switches shall be configured consistently with the manager.
−### RSTP recovery is measured in seconds and is acceptable only where the process tolerates that interruption; processes requiring bumpless recovery shall use DLR, PRP, or HSR for seamless or near-seamless switchover. {note}
+### RSTP recovery is measured in seconds and is acceptable only where the process tolerates that interruption; processes requiring bumpless recovery shall use DLR, PRP, or HSR for seamless or near-seamless switchover.
−### Mixing redundancy protocols in one ring, or leaving two ring managers active, creates a network loop or a broadcast storm; the redundancy design shall be coherent across the ring. {note}
+### Mixing redundancy protocols in one ring, or leaving two ring managers active, creates a network loop or a broadcast storm; the redundancy design shall be coherent across the ring.
## Determinism and Latency {toc}
…11 unchanged lines
### All controllers, servers, switches, and instruments that timestamp data shall be synchronized to a common, traceable time source so that alarms, events, and trends across the system share one timeline. {note}
+### The time synchronization protocol shall be specified based on the timing accuracy required by the connected controllers, servers, and instruments.
+
```datasheet
label: Time Synchronization Protocol
…27 unchanged lines
## Telemetry for Distributed Sites {toc}
−### Geographically distributed water and wastewater facilities — remote pump stations, lift stations, wells, tanks, and metering sites — shall communicate with the central SCADA system over a wide-area telemetry bearer rather than plant cabling. {note}
+### Geographically distributed water and wastewater facilities — remote pump stations, lift stations, wells, tanks, and metering sites — shall communicate with the central SCADA system over a wide-area telemetry bearer rather than plant cabling.
```datasheet
…32 unchanged lines
### Polling and report-by-exception parameters shall be tuned to the bearer bandwidth so that the link is not saturated and data collisions are avoided.
−### Telemetry traffic crossing public networks (cellular, leased) shall be encrypted (VPN or DNP3 Secure Authentication) so that a remote site cannot be commanded by an unauthorized master. {note}
+### Telemetry traffic crossing public networks (cellular, leased) shall be encrypted (VPN or DNP3 Secure Authentication) so that a remote site cannot be commanded by an unauthorized master.
# OT Cybersecurity Baseline {toc}
…22 unchanged lines
### Every active network device shall be hardened before being placed in service: default credentials changed, unused physical ports and logical services disabled, secure management protocols enabled (e.g., SSH and HTTPS rather than Telnet and HTTP), and the device firmware updated to a tested, supported version.
−### Unused switch ports shall be administratively disabled, and port security (MAC limiting or sticky MAC) shall be enabled on access ports where the connected device set is fixed.
−
−### Default credentials and open management services are the most exploited weakness in OT devices; an unhardened switch on the control network is a foothold regardless of any firewall in front of it. {note}
−
```datasheet
label: Device Hardening Measures
…10 unchanged lines
```
+### Unused switch ports shall be administratively disabled, and port security (MAC limiting or sticky MAC) shall be enabled on access ports where the connected device set is fixed.
+
+### Default credentials and open management services are the most exploited weakness in OT devices; an unhardened switch on the control network is a foothold regardless of any firewall in front of it. {note}
+
## Account Management {toc}
…6 unchanged lines
### A patch-management process shall be established that identifies firmware and software updates for network devices, tests them in a non-production environment, and schedules their application during planned outages.
−### Patches shall not be applied to production OT devices without testing, because an untested firmware update can disrupt the controlled process; the patch process shall balance vulnerability exposure against availability. {note}
+### Patches shall not be applied to production OT devices without testing, because an untested firmware update can disrupt the controlled process; the patch process shall balance vulnerability exposure against availability.
```datasheet
…141 unchanged lines
### Spares shall be the same model and firmware-compatible with the installed devices, and the spare-parts list shall be included in the closeout documentation.