> For the complete documentation index, see [llms.txt](https://intelfactor.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intelfactor.gitbook.io/docs/home/security/ot-security-posture.md).

# OT security posture

OT-safe defaults aligned to industrial segmentation patterns.

IntelFactor assumes an OT environment.

It is designed around segmentation, least privilege, and auditability.

### Network boundaries

* Production Zone stays isolated.
* Site Data Zone is the only approved aggregation point.
* Remote access is optional and separable.

### Default communication stance

* No outbound internet required for inspection.
* No inbound connectivity into OT by default.
* Only explicitly approved conduits are allowed.

### Identity and access

* Role-based access (operator vs QA vs admin).
* MFA for any remote access.
* Service-to-service auth uses short-lived credentials when possible.

### Audit expectations

* Evidence artifacts are traceable to outcomes.
* Admin actions are logged.
* Updates are signed and verifiable.

{% hint style="info" %}
If your security team maps to IEC 62443, IntelFactor fits typical zone/conduit reviews. The exact hardening checklist is site-specific.
{% endhint %}