1) We separate machine networks from corporate IT and the internet.

2) We segment PLCs, HMIs, engineering workstations and safety systems where appropriate.

3) We restrict communication between network zones using firewalls and allowlists.

4) We prevent unnecessary inbound and outbound connections.

1) We change default passwords and eliminate shared accounts where feasible.

2) We disable unused ports, services, protocols and interfaces.

3) We use secure configurations for PLCs, HMIs, operating systems and industrial gateways.

4) We protect firmware and configuration changes against unauthorized modification.

1) We enforce least-privilege access and role-based permissions.

2) We use multifactor authentication for remote access and privileged accounts.

3) We use individual accounts instead of shared maintenance credentials.

4) We log privileged actions and revoke access when no longer needed.

1) We route vendor access through controlled VPNs or secure gateways.

2) We require MFA, time-limited authorization and session logging.

3) We disable remote access by default when it is not required.

4) We avoid permanent, unrestricted vendor connections to production networks.

1) We maintain an inventory of hardware, software, firmware and versions.

2) We monitor vendor advisories and vulnerability databases.

3) We assess vulnerabilities according to exploitability and operational impact.

4) We test patches before deployment and define compensating controls for systems that cannot be patched.

5) We establish a process for end-of-support equipment.