IT networks play an important role in all environments involving digital information – in critical infrastructure and operational technology (OT) environments, however, they directly support operationally critical or indispensable processes. This includes the production and processing of essential goods as well as key building automation, safety, and control systems for the respective facilities. System reliability – and therefore the reliability of the IT networks themselves – is the highest priority.
To achieve the required high availability, operational reliability, and resilience for critical infrastructure and OT networks, a clearly segmented architecture following defined principles is fundamental. We have visualized this in the R&S Networks and Cybersecurity IT reference architecture for critical infrastructure and OT environments, which incorporates compliance requirements, legal regulations, and recommendations from the very beginning:
The R&S Networks and Cybersecurity IT reference architecture for critical infrastructure and OT networks provides a secure foundation for operators, planners, and technical stakeholders during planning, operations, audits, change management, and incident scenarios, serving as a proven practical blueprint for successful IT network implementation.
Latest BSI recommendations (October 2026)
In October 2026, the German Federal Office for Information Security (BSI) issued an urgent cybersecurity advisory for industrial control systems (Operational Technology, OT). The advisory was prompted by a devastating cyber sabotage attack on refrigeration systems in hundreds of French supermarkets, in which attackers exploited unpatched control software to manipulate temperatures and cause fires.
The recommendations explicitly target operators of small and medium-sized industrial facilities (e.g., food refrigeration, local power generation, and drinking water supply systems), which are not necessarily subject to critical infrastructure (KRITIS) regulations.
Key immediate measures recommended by the BSI
The BSI emphasizes that the most important protective measures are straightforward to implement and should become routine practice:
- Block all direct internet access: Any direct access from the public internet to programmable logic controllers (PLCs) and process control systems must be strictly prohibited.
- Secure remote maintenance: Administrative connections must exclusively use encrypted virtual private networks (VPNs) combined with multi-factor authentication (MFA).
- Patch management: Security-related software patches and firmware updates provided by component manufacturers must be applied promptly to address known vulnerabilities.
- Check network exposure: Operators should proactively check whether their systems or control devices are unintentionally exposed to the internet (e.g., using specialized search tools for OT systems).
- Access rights management: Access permissions should be granted restrictively using allowlists.
Application areas of IT networks for critical infrastructure and OT
Our dedicated topic pages each describe typical use cases for critical infrastructure and OT environments. The individual application areas are: 1. Fundamental IT/OT architecture, 2. Modern IT networks for security systems, 3. Networking for building automation, 4. Secure Edge Computing, and 5. Control and signaling systems for transportation.
IT networks in OT and critical infrastructure
Anyone planning or modernizing critical infrastructure or OT environments primarily needs a resilient foundational model: clear separation between IT and OT, defined transition points, logging, and resilient operational processes. This topic page explains which architectural principles have proven effective and how the R&S Networks and Cybersecurity IT reference architecture can be used as a technical framework. Learn more about the key design factors as well as secure remote maintenance, data decoupling, and update management for critical infrastructure and OT networks.
Security systems
Modern IT networks connect camera systems, access control, locking systems, as well as alarm and notification technologies. In critical infrastructure and OT environments, security systems require separated zones for the different security domains, encrypted and controlled communication paths, and modular scalability for autonomous and resilient operations. Together with our partners MOBOTIX and KENTIX, we provide holistic, standards-compliant solutions for the IT networking infrastructure behind security systems.
Building automation
Building automation becomes an IT architecture topic wherever HVAC (heating, ventilation, and cooling), energy systems, monitoring, and other building services must be operated securely, resiliently, and sustainably over the long term. This is implemented, among other things, through local control logic and edge computing, standardized interfaces and controlled rollouts, as well as hardened network devices and encrypted protocols. Our solution demonstrates how IT networks support modern building control within the context of a segmented and serviceable building management system.
Secure Data for Control Systems
In transportation-related control and signaling systems, security, integrity, and availability must be implemented in a way that preserves safety requirements, deterministic behavior, and non-interference. Appropriate security measures, such as encrypting data connections that require particularly high levels of protection, play an important role in this context. For such Ethernet connections, the R&S®SITLine ETH Layer 2 network encryptor can be used, for example. At the same time, the applicable functional safety requirements, such as those defined by Safety Integrity Level (SIL) 3 or SIL 4, must be taken into account.
Secure Edge Computing
Secure Edge Computing is one of the most important technologies in critical infrastructure and OT networks: it enables security-critical and time-critical processes to be processed and protected directly where the data is generated – at the edge of the network. Local firewalls provide network protection while also serving as a secure platform for isolated software applications. This allows sensitive data to be processed locally, reduces latency, and better protects critical infrastructures against cyberattacks and outages. Learn how the R&S Networks and Cybersecurity Secure Edge Computing solution delivers higher speed, greater resilience, and stronger protection for confidential information.
In our whitepaper, we have summarized the specific characteristics of IT networks in critical infrastructure and OT environments and explained how to appropriately address them when planning and implementing networks.
Topics include:
- How do IT and OT security differ, and how do they complement each other?
- What guiding principles define a secure network architecture for critical infrastructure and OT environments?
- What does a suitable target network architecture for critical infrastructure and OT environments look like in practice?
- Where are the most critical access paths, and how can they be adequately secured?
- What approach is recommended for the four most common access paths and scenarios (remote maintenance, data decoupling, updates / patches, security incidents)?
- What role do different network components play in critical infrastructure and OT security?
See for yourself how you can strengthen the resilience of your critical IT networks:
Whitepaper: Secure Networks for Critical Infrastructures and OT
Basic knowledge about IT networks in critical infrastructure and OT: Frequently asked questions and answers
What is OT security in critical infrastructure environments?
OT security in critical infrastructure environments protects networks and systems that control operationally critical or mission-critical processes. The primary focus is on availability, operational reliability, traceability, and controlled communication relationships.
Learn more about IT networks for critical infrastructure and OT
How can IT and OT be securely separated?
IT and OT are securely separated when productive OT environments cannot be accessed directly from the corporate IT network. Proven approaches include zone models with IT, IT DMZ, OT DMZ, and productive OT, as well as clearly defined control points for access, data flows, and changes.
Do critical infrastructure networks require a dedicated network architecture?
Yes, because historically evolved direct connections, uncontrolled data flows, and open service paths in OT environments represent operational and security risks. A dedicated IT architecture creates the foundation for clear zones, defined transition points, and resilient operational processes.
Learn more about the reference architecture for critical infrastructure and OT
How does OT security differ from traditional IT security?
OT security must protect the stable and safe operation of industrial systems and technical processes. For this reason, changes are more strictly controlled, remote access is more tightly restricted, and local operational capability is more important than in traditional office IT environments.
Why is a VPN alone not sufficient for remote maintenance in critical infrastructure environments?
Because remote maintenance in OT is not just about establishing a connection — it must be a controlled process. This includes strong identity verification, defined entry points, jump hosts, maintenance windows, and complete logging instead of direct access to productive zones.
Learn more about secure remote maintenance in critical infrastructure and OT networks
What are the benefits of an IT reference architecture for critical infrastructure and OT networks?
An IT reference architecture structures critical infrastructure and OT networks using clear zones, defined transition points, and controlled operational processes, serving as a clear implementation framework. This makes security, traceability, operational reliability, and recovery in complex environments easier to plan and manage.
Learn more about the IT reference architecture for critical infrastructure and OT
