OT security is the practice of protecting operational technology, the hardware and software that runs physical processes on plants, sites and utilities, from failure and attack. Its priority ranking is availability first, then integrity, then confidentiality, because an unavailable plant is a safety event rather than just an outage.

What is OT/ICS cybersecurity?

OT/ICS cybersecurity covers the security of industrial control systems (PLCs, RTUs, DCS and SCADA) and the wider operational technology estate they run on. The core design goals are safety, availability and rapid recovery from destructive incidents, which is why an offline gold copy is central to modern OT/ICS security programmes.

How is OT security different from IT security?

IT security prioritises confidentiality of data. OT security prioritises availability of the process, because downtime translates directly to safety and revenue impact. That inversion changes almost every design decision, from patch cadence to backup architecture, and it is why immutable cloud backup alone is a poor fit for OT.

What is the Purdue Model and where does an air gap fit?

The Purdue Model is a reference architecture that splits an industrial estate into levels, from field devices at Level 0 up to enterprise IT at Level 5, with an industrial DMZ at Level 3.5. Firevault Offline Secure Storage sits at Level 3.5 or in a dedicated bunker, physically isolated from Levels 4 and 5 so that a compromised enterprise domain cannot reach the OT gold copy.

How do I secure an OT network against ransomware?

Combine network segmentation between Purdue levels, strict identity boundaries at Level 3.5, hardened backup for fast operational recovery and a physical air gap for the gold copy. The air gap is the layer that remains true when the segmentation is misconfigured, the identity boundary is bypassed or the backup platform itself is targeted.

What OT security standards should we align to?

The core references are IEC 62443 for industrial control system security, NIST SP 800-82 for OT, NIS2 for critical entities operating in the EU and the NCSC CAF for UK operators of essential services. All four call for demonstrably resilient recovery of critical data, which is what a physical air gap provides.

Does immutable cloud backup satisfy OT/ICS requirements?

Not on its own. Immutable cloud backup is a logical control on a reachable network, and OT sites often lack the bandwidth to restore from it at the required speed. The recommended pattern is immutable cloud or a hardened appliance for fast operational recovery, plus a physical air gap as the offline gold copy that survives when the rest is touched.

How does Firevault map to the 3-2-1-1-0 backup rule for OT?

Firevault is designed specifically as the one offline copy in the 3-2-1-1-0 rule. Your existing ICS backup platform provides the three copies on two media with one offsite; Firevault provides the one offline copy and the tamper evident evidence needed to prove zero recovery errors.

Why OSS

OT and ICS Security,
Air Gap Storage for the Purdue Model

An OT estate cannot restore from a cloud copy it cannot reach and cannot afford to egress. Firevault is the physical air gap that sits at Purdue Level 3.5, isolated from the domain that ransomware compromises first.

What OT and ICS security means

OT, ICS and the Priority Inversion

Clean definitions for OT, ICS and the security priority ranking that separates industrial estates from IT.

The kit that runs the physical world

Operational technology (OT)

Operational technology is the hardware and software that monitors and controls physical processes: valves, motors, robots, breakers, conveyors and the sensors that report on them. It is the plant floor, the substation, the pipeline and the water works, not the office LAN.

Plant floor, not officePhysical outcomes, not ticketsUptime measured in years

The category name for OT control kit

Industrial control systems (ICS)

Industrial control systems is the umbrella term for the software and hardware that make OT run: PLCs, RTUs, DCS, SCADA and their engineering workstations. When practitioners say OT/ICS, they mean the whole stack from field devices up to the supervisory layer.

PLC, RTU, DCS, SCADAEngineering workstationsSupervisory HMI and historians

Availability first, then integrity, then confidentiality

OT/ICS security, defined

OT/ICS security protects the availability and integrity of industrial control systems from failure and attack. The priority ranking is inverted from IT: an unavailable plant is a safety event, so recovery from a destructive incident is the top design goal.

Availability is the prioritySafety cases drive designRecovery is not optional

Where a physical air gap belongs

Mapping Firevault to the Purdue Model

The Purdue Model splits an industrial estate into levels. The Firevault gold copy sits at Level 3.5 or in a dedicated bunker, isolated from the enterprise domain.

Field devices, controllers and HMI

Levels 0 to 2, the plant

The lower Purdue levels are sensors, actuators, PLCs, RTUs and the HMI that supervises them. These systems are engineered for uptime and predictable behaviour, not for defence in depth. Ransomware that reaches this layer stops production and can trigger safety events.

Level 0 field devicesLevel 1 PLCs and RTUsLevel 2 HMI and historians

Where OT meets IT

Level 3 and 3.5, operations and DMZ

Level 3 hosts the site operations systems and Level 3.5 is the industrial DMZ. This is where OT talks to IT for reporting, dispatch and remote support, and where most OT ransomware incidents enter. The Firevault gold copy for an OT estate sits at 3.5, isolated from both sides.

Site historians and MESIndustrial DMZ boundaryHighest attacker footfall

Corporate estate, cloud, SaaS

Level 4 and 5, IT and enterprise

The upper Purdue levels are the enterprise IT and cloud. These systems have far more attack surface than the plant, and they are the origin of most OT ransomware. A physical air gap between the enterprise estate and the OT gold copy is the boundary of last resort.

Enterprise IT and cloudSaaS and remote accessOrigin of most OT incidents

Why immutable cloud alone is not enough

What Breaks Immutable Backup Inside an OT Estate

The failure modes cloud immutability hits when it meets a real OT site, a real cyber underwriter and a real ransomware operator with domain admin.

Cloud restores do not scale to OT sites

Bandwidth ceilings on the plant

OT sites are often on constrained links: microwave, cellular or single fibre. A cloud restore of a compromised historian can take days over that pipe, at a cost per GB that finance did not budget for. A physically local air-gapped copy restores at disk speed instead.

Constrained site linksEgress cost per GBRTO measured in days not hours

Object Lock does not survive a domain compromise

Immutable is still on the network

Cloud Object Lock and hardened repositories are logical controls on a network that remains reachable. In an OT estate the attacker often already has domain admin on the IT side. The same credentials weaken the retention policy before the plant is hit.

Reachable from IT planeRetention weakened by adminSame identity system as target

Offline, isolated, provable

Insurers now specifically ask

Cyber underwriters have tightened OT wording. Renewals now ask whether an offline copy exists, whether it is isolated from production identity and whether the isolation is provable. A physical air gap with a tamper evident connection log answers all three in one line.

Offline copy requiredIsolated from identityEvidence, not assertion

Buyer checklist

Ten Questions for Any OT/ICS Backup Vendor

Use this list to separate a genuine physical air gap from a hardened appliance sold as one.

The gold copy has no network interface enabled while offline (Layer 1, not VLAN)
Connection windows are switched out of band, not from the OT or IT domain
Every connect and disconnect event is logged on a separate management plane
The copy sits at Purdue Level 3.5 or a dedicated bunker, isolated from Levels 4 and 5
Restore path does not depend on cloud egress or a rebuild of the domain
Encryption keys are held separately from the storage hardware
Chain of custody is provable to IEC 62443, NIS2 and NCSC CAF assessors
The vendor will attend an incident on site and provide the clean copy in person
Pricing is fixed monthly, VAT inclusive, with no egress or restore fees
The pattern layers over existing Veeam, Rubrik, Commvault or native ICS backups

Continue reading on the deployment maps, the standards and the compare set.

The Purdue Model for OT/ICS security OT network segmentation Module deployment maps What is OT security OT vs IT security Physical air gap for ransomware protection The 3-2-1-1-0 backup rule

OT and ICS Security, Common Questions

Add a physical air gap to your OT recovery plan

Talk to the Firevault team about a Layer 1 offline gold copy for your industrial estate, isolated from the enterprise domain that ransomware compromises first.

Takes about 2 minutes. No account needed.

Free2 minsNo sign-up

OT and ICS Security,Air Gap Storage for the Purdue Model