--- title: "OT and ICS Security, Air Gap Storage for the Purdue Model" description: "How Firevault air gap storage fits OT and ICS security: Purdue Model mapping, IEC 62443 alignment, a buyer checklist and the FAQ operators actually ask." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/learn/ot-ics-security-air-gap-storage#webpage", "url": "https://fire-vault.com/learn/ot-ics-security-air-gap-storage", "name": "OT and ICS Security, Air Gap Storage for the Purdue Model", "description": "How Firevault air gap storage fits OT and ICS security: Purdue Model mapping, IEC 62443 alignment, a buyer checklist and the FAQ operators actually ask.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-learn.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/learn/ot-ics-security-air-gap-storage#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/learn/ot-ics-security-air-gap-storage#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "OT and ICS Security, Air Gap Storage for the Purdue Model", "item": "https://fire-vault.com/learn/ot-ics-security-air-gap-storage" } ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "OT and ICS Security, Air Gap Storage for the Purdue Model", "author": { "@type": "Person", "name": "Mark Fermor" }, "publisher": { "@type": "Organization", "name": "Firevault" }, "mainEntityOfPage": "/learn/ot-ics-security-air-gap-storage" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is OT security?", "acceptedAnswer": { "@type": "Answer", "text": "OT security is the practice of protecting operational technology, the hardware and software that runs physical processes on plants, sites and utilities, from failure and attack. Its priority ranking is availability first, then integrity, then confidentiality, because an unavailable plant is a safety event rather than just an outage." } }, { "@type": "Question", "name": "What is OT/ICS cybersecurity?", "acceptedAnswer": { "@type": "Answer", "text": "OT/ICS cybersecurity covers the security of industrial control systems (PLCs, RTUs, DCS and SCADA) and the wider operational technology estate they run on. The core design goals are safety, availability and rapid recovery from destructive incidents, which is why an offline gold copy is central to modern OT/ICS security programmes." } }, { "@type": "Question", "name": "How is OT security different from IT security?", "acceptedAnswer": { "@type": "Answer", "text": "IT security prioritises confidentiality of data. OT security prioritises availability of the process, because downtime translates directly to safety and revenue impact. That inversion changes almost every design decision, from patch cadence to backup architecture, and it is why immutable cloud backup alone is a poor fit for OT." } }, { "@type": "Question", "name": "What is the Purdue Model and where does an air gap fit?", "acceptedAnswer": { "@type": "Answer", "text": "The Purdue Model is a reference architecture that splits an industrial estate into levels, from field devices at Level 0 up to enterprise IT at Level 5, with an industrial DMZ at Level 3.5. Firevault Offline Secure Storage sits at Level 3.5 or in a dedicated bunker, physically isolated from Levels 4 and 5 so that a compromised enterprise domain cannot reach the OT gold copy." } }, { "@type": "Question", "name": "How do I secure an OT network against ransomware?", "acceptedAnswer": { "@type": "Answer", "text": "Combine network segmentation between Purdue levels, strict identity boundaries at Level 3.5, hardened backup for fast operational recovery and a physical air gap for the gold copy. The air gap is the layer that remains true when the segmentation is misconfigured, the identity boundary is bypassed or the backup platform itself is targeted." } }, { "@type": "Question", "name": "What OT security standards should we align to?", "acceptedAnswer": { "@type": "Answer", "text": "The core references are IEC 62443 for industrial control system security, NIST SP 800-82 for OT, NIS2 for critical entities operating in the EU and the NCSC CAF for UK operators of essential services. All four call for demonstrably resilient recovery of critical data, which is what a physical air gap provides." } }, { "@type": "Question", "name": "Does immutable cloud backup satisfy OT/ICS requirements?", "acceptedAnswer": { "@type": "Answer", "text": "Not on its own. Immutable cloud backup is a logical control on a reachable network, and OT sites often lack the bandwidth to restore from it at the required speed. The recommended pattern is immutable cloud or a hardened appliance for fast operational recovery, plus a physical air gap as the offline gold copy that survives when the rest is touched." } }, { "@type": "Question", "name": "How does Firevault map to the 3-2-1-1-0 backup rule for OT?", "acceptedAnswer": { "@type": "Answer", "text": "Firevault is designed specifically as the one offline copy in the 3-2-1-1-0 rule. Your existing ICS backup platform provides the three copies on two media with one offsite; Firevault provides the one offline copy and the tamper evident evidence needed to prove zero recovery errors." } } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Why OSS # OT and ICS Security, Air Gap Storage for the Purdue Model An OT estate cannot restore from a cloud copy it cannot reach and cannot afford to egress. Firevault is the physical air gap that sits at Purdue Level 3.5, isolated from the domain that ransomware compromises first. Book a demo ![Corridor of offline storage racks inside a Firevault bunker](/assets/hero-square-bunker-BC9Flanh.jpg) R5 What OT and ICS security means ## OT, ICS and the Priority Inversion Clean definitions for OT, ICS and the security priority ranking that separates industrial estates from IT. 01 The kit that runs the physical world ### Operational technology (OT) Operational technology is the hardware and software that monitors and controls physical processes: valves, motors, robots, breakers, conveyors and the sensors that report on them. It is the plant floor, the substation, the pipeline and the water works, not the office LAN. - Plant floor, not office - Physical outcomes, not tickets - Uptime measured in years 02 The category name for OT control kit ### Industrial control systems (ICS) Industrial control systems is the umbrella term for the software and hardware that make OT run: PLCs, RTUs, DCS, SCADA and their engineering workstations. When practitioners say OT/ICS, they mean the whole stack from field devices up to the supervisory layer. - PLC, RTU, DCS, SCADA - Engineering workstations - Supervisory HMI and historians 03 Availability first, then integrity, then confidentiality ### OT/ICS security, defined OT/ICS security protects the availability and integrity of industrial control systems from failure and attack. The priority ranking is inverted from IT: an unavailable plant is a safety event, so recovery from a destructive incident is the top design goal. - Availability is the priority - Safety cases drive design - Recovery is not optional Where a physical air gap belongs ## Mapping Firevault to the Purdue Model The Purdue Model splits an industrial estate into levels. The Firevault gold copy sits at Level 3.5 or in a dedicated bunker, isolated from the enterprise domain. 01 Field devices, controllers and HMI ### Levels 0 to 2, the plant The lower Purdue levels are sensors, actuators, PLCs, RTUs and the HMI that supervises them. These systems are engineered for uptime and predictable behaviour, not for defence in depth. Ransomware that reaches this layer stops production and can trigger safety events. - Level 0 field devices - Level 1 PLCs and RTUs - Level 2 HMI and historians 02 Where OT meets IT ### Level 3 and 3.5, operations and DMZ Level 3 hosts the site operations systems and Level 3.5 is the industrial DMZ. This is where OT talks to IT for reporting, dispatch and remote support, and where most OT ransomware incidents enter. The Firevault gold copy for an OT estate sits at 3.5, isolated from both sides. - Site historians and MES - Industrial DMZ boundary - Highest attacker footfall 03 Corporate estate, cloud, SaaS ### Level 4 and 5, IT and enterprise The upper Purdue levels are the enterprise IT and cloud. These systems have far more attack surface than the plant, and they are the origin of most OT ransomware. A physical air gap between the enterprise estate and the OT gold copy is the boundary of last resort. - Enterprise IT and cloud - SaaS and remote access - Origin of most OT incidents Why immutable cloud alone is not enough ## What Breaks Immutable Backup Inside an OT Estate The failure modes cloud immutability hits when it meets a real OT site, a real cyber underwriter and a real ransomware operator with domain admin. 01 Cloud restores do not scale to OT sites ### Bandwidth ceilings on the plant OT sites are often on constrained links: microwave, cellular or single fibre. A cloud restore of a compromised historian can take days over that pipe, at a cost per GB that finance did not budget for. A physically local air-gapped copy restores at disk speed instead. - Constrained site links - Egress cost per GB - RTO measured in days not hours 02 Object Lock does not survive a domain compromise ### Immutable is still on the network Cloud Object Lock and hardened repositories are logical controls on a network that remains reachable. In an OT estate the attacker often already has domain admin on the IT side. The same credentials weaken the retention policy before the plant is hit. - Reachable from IT plane - Retention weakened by admin - Same identity system as target 03 Offline, isolated, provable ### Insurers now specifically ask Cyber underwriters have tightened OT wording. Renewals now ask whether an offline copy exists, whether it is isolated from production identity and whether the isolation is provable. A physical air gap with a tamper evident connection log answers all three in one line. - Offline copy required - Isolated from identity - Evidence, not assertion Buyer checklist ## Ten Questions for Any OT/ICS Backup Vendor Use this list to separate a genuine physical air gap from a hardened appliance sold as one. - The gold copy has no network interface enabled while offline (Layer 1, not VLAN) - Connection windows are switched out of band, not from the OT or IT domain - Every connect and disconnect event is logged on a separate management plane - The copy sits at Purdue Level 3.5 or a dedicated bunker, isolated from Levels 4 and 5 - Restore path does not depend on cloud egress or a rebuild of the domain - Encryption keys are held separately from the storage hardware - Chain of custody is provable to IEC 62443, NIS2 and NCSC CAF assessors - The vendor will attend an incident on site and provide the clean copy in person - Pricing is fixed monthly, VAT inclusive, with no egress or restore fees - The pattern layers over existing Veeam, Rubrik, Commvault or native ICS backups Continue reading on the deployment maps, the standards and the compare set. [The Purdue Model for OT/ICS security](/learn/purdue-model-ot-ics-security) [OT network segmentation](/learn/ot-network-segmentation) [Module deployment maps](/control) [What is OT security](/learn/what-is-ot-security) [OT vs IT security](/learn/ot-vs-it-security) [Physical air gap for ransomware protection](/learn/physical-air-gap-ransomware-protection) [The 3-2-1-1-0 backup rule](/learn/3-2-1-1-0-backup-rule) Questions ## OT and ICS Security, Common Questions Straight answers on how Offline Secure Storage® behaves in practice. ### What is OT security? ### What is OT/ICS cybersecurity? ### How is OT security different from IT security? ### What is the Purdue Model and where does an air gap fit? ### How do I secure an OT network against ransomware? ### What OT security standards should we align to? ### Does immutable cloud backup satisfy OT/ICS requirements? ### How does Firevault map to the 3-2-1-1-0 backup rule for OT? ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) ![David Bailey](/assets/david-bailey-CnLw95Ao.jpg) ![Kenny Phipps](/assets/kenny-phipps-DxIqwaIL.jpg) Online Now Concierge ## Add a physical air gap to your OT recovery plan Talk to the Firevault team about a Layer 1 offline gold copy for your industrial estate, isolated from the enterprise domain that ransomware compromises first. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up