Begin with operational priorities
Work with operations and safety teams to understand processes, critical dependencies and unacceptable changes.
Use passive discovery first
Map assets, zones, vendor entry points and data transfers without aggressive scanning of sensitive control systems.
Establish conduits and ownership
Design controlled access between enterprise IT, industrial DMZ and plant networks with explicit owner, approval and monitoring.
Secure vendor remote access
Use time-bounded access, multifactor authentication, monitored jump environments and session records where supported.
Test recovery, not just perimeter rules
Protect controller and engineering workstation configuration backups and exercise restoration with production-aware procedures.
Primary sources
Further reading: NIST SP 800-82 Rev. 3 and IEC 62443.