OT Network Segmentation Assessment: Scope, Deliverables, Timeline and Cost

By Denrich Sananda 26-10-2026 6 min read

Segmentation is the control most often recommended to industrial operators and least often implemented, and the reason is rarely disagreement about its value. It is that nobody can say what the work involves, how long it takes or what it costs, so it stays on the roadmap as a line item with no number next to it.

This post answers the buying questions. If you want the methodology instead, so your own team can run it, our guide to conducting an OT/IT network segmentation audit covers the how.

What the assessment answers

Three questions, and the third is the one that gets funded.

What does the network actually look like. Not the drawing. Observed reality, which is usually flatter than anyone expects.
Where are the boundaries that should exist but do not. Zones that are nominally separate and are bridged by a forgotten route, a dual-homed host or a vendor connection.
What would it take to fix, in what order. Sequenced, costed, with outage requirements named. This is the deliverable that turns an assessment into a project.

The method, and why it is mostly passive

Phase	What happens
Document review	Existing diagrams, firewall rulebases, switch configurations, prior assessments. Desk work, no site access needed.
Passive observation	Traffic capture at key points to establish what actually communicates with what. Non-disruptive. See our guide to non-disruptive asset discovery.
Configuration analysis	Switch, router and firewall configurations read and compared against the intended zone model.
Targeted validation	Confirming specific suspected paths. The only phase that may need active testing, and only with explicit agreement and a change window.
Analysis and reporting	Current state, gap against the intended model, sequenced remediation.

Active scanning of Level 1 and 2 equipment is not part of a competent segmentation assessment unless you specifically authorize it on specific assets. Any bidder proposing to scan the control network as a default method should be asked to explain why.

What we find almost every time

The network is flatter than the drawing says. Typically a handful of specific causes: a dual-homed engineering workstation bridging two zones, a vendor remote access appliance with broader reach than anyone realized, a VLAN that was separated logically but shares a path, and firewall rules permitting any-any between zones because a commissioning engineer needed it working in 2019. None of these are exotic. All of them defeat the segmentation you believe you have, and none appear on a diagram.

Deliverables to insist on

Current-state zone and conduit diagram, editable. Not a PDF. You will maintain this for years.
Observed communication matrix. What actually talks to what. The most reusable artifact from the whole engagement.
Gap register. Each unintended path, with evidence, affected assets and consequence.
Sequenced remediation plan. Ordered by consequence and effort, with outage requirements flagged per item.
Target-state architecture. Mapped to IEC 62443 zones and conduits if that is your framework.
The raw capture data. Yours. It is the baseline your next assessment measures against.

Realistic timeline

For a single plant of moderate complexity, expect document review and planning to take one to two weeks, passive observation two to four weeks because it must span a representative operating period, analysis and reporting another two to three weeks. Call it six to nine weeks end to end, with only a few days of that requiring site presence.

The observation window is the part people try to compress and the part that should not be compressed. Traffic during a maintenance period or a turnaround differs substantially from steady state, and an assessment that misses it will miss the paths that only open during that work. Multi-site engagements do not scale linearly, because the second site benefits from the first site's model.

What drives the cost

Number of sites and zones. The main driver.
Quality of existing documentation. Good diagrams and a current asset inventory reduce the effort materially. No documentation means building the baseline first, which is real work.
Number of observation points. More conduits means more capture and more analysis.
Whether remediation design is included. Assessment and design are different scopes and should be priced separately so you can decide.
Site access logistics. Remote sites, permit requirements and escort rules add days.

Worth knowing: an existing asset inventory is the single biggest lever on the price. If you have one, say so in the RFP. If you do not, expect the first phase to build one.

Why Choose Arista Cyber

We run these assessments passively by default, we hand over the editable artifacts and the raw data, and we price assessment separately from remediation design so you are not committed to the fix before you have seen the findings. Our consultants hold functional safety credentials alongside OT security certification, so remediation touching protective systems gets safety review. See our OT risk assessments and our case studies.

Next Steps

Check whether you have a current asset inventory before you request quotes. That single answer changes both the scope and the price more than anything else you can tell a bidder.

Common Questions

How long does an OT segmentation assessment take?

For a single plant of moderate complexity, typically six to nine weeks end to end, with only a few days on site. The passive observation window of two to four weeks is the part that should not be compressed.

Does the assessment disrupt production?

A competent one is passive by default. Document review, traffic observation and configuration analysis are non-disruptive. Active validation happens only on specific assets with explicit authorization and a change window.

What drives the cost?

Number of sites and zones first, then the quality of your existing documentation. An existing asset inventory is the single biggest lever, because without one the first phase is building the baseline.

What should we receive at the end?

An editable current-state zone diagram, an observed communication matrix, a gap register with evidence, a sequenced remediation plan with outage requirements flagged, a target-state architecture and the raw capture data.

What do assessments usually find?

That the network is flatter than the drawing. Dual-homed workstations bridging zones, vendor access with unexpected reach, logically separated VLANs sharing a path, and any-any firewall rules left from commissioning.

Segmentation on the roadmap with no number next to it?

Arista Cyber runs passive OT segmentation assessments with a fixed artifact list: editable zone diagram, observed communication matrix, evidenced gap register and a sequenced remediation plan priced separately from the design.

Request assessment scope and pricing