Direct implementation supportHigh confidence
Why: Placing publicly accessible components in their own subnetwork, separated from internal networks, is a specific application of the zoning this practice implements — a DMZ is a segmentation zone with a particular job.
What this does not claim: Supports implementation of the requirement rather than establishing it single-handedly. The requirement holds only when every publicly accessible component is separated: one web server, VPN appliance, or vendor portal left on the internal network reopens the gap however well the rest of the estate is zoned, and discovering everything that is publicly reachable is its own work the zone design does not do.
Practice-side activities- Enumerate publicly reachable components via external scanning, not memory
- Place them in a separated subnetwork with enforcement on both sides
- Limit DMZ-to-internal flows to defined, documented exceptions
Evidence this produces- DMZ diagram and enforcement-point configuration
- Rules restricting DMZ-to-internal traffic
- External scan results reconciled against the intended public footprint
Review status: Technical review complete · Reviewed by inDirectIT practitioner review — CUI security and NIST SP 800-171 engineering · updated 2026-08-06
Partial implementation supportModerate confidence
Why: The practice's separation of production networks from everything else applies the same physical-or-logical subnetwork discipline this requirement demands, and the industrial DMZ between IT and OT is its most common plant-floor expression.
What this does not claim: 3.13.5 is not a general-purpose IT/OT segmentation requirement — it is specifically about subnetworks for publicly accessible components, so this mapping is conditional: it applies only where an internet-facing or publicly reachable component (a historian, vendor portal, or jump host) is actually placed in a DMZ inside the assessed boundary. Moving such a component into a separated subnetwork is a production change: it gets a planned window, a rollback path, and vendor coordination, because a mis-scoped rule can stop the line. The general segmentation relationship lives in 3.13.1 and 3.13.6.
Practice-side activities- Identify any OT-adjacent component reachable from outside the plant
- Broker external reachability through an industrial DMZ rather than direct paths
- Qualify and schedule cutover with the operations team
Evidence this produces- Industrial DMZ design showing where externally reachable components sit
- Records of cutover windows and rollback plans for separation changes
Where this holds: Applies only where OT-adjacent systems are both publicly reachable and inside the assessed boundary — a narrow but high-consequence intersection.
Review status: Technical review complete · Reviewed by inDirectIT practitioner review — CUI security and NIST SP 800-171 engineering · updated 2026-08-06
