The challenge
An industrial group with five production plants across the peninsula, each with its own OT network deployed over the last twenty years by different integrators. Siemens and Schneider PLCs connected to the same VLAN as the office printers, SCADAs reachable from the corporate network without authentication, and control systems on Windows XP impossible to update due to factory-equipment compatibility.
With the NIS2 directive coming into force and a ransomware incident at a sector competitor that halted a line for 11 days, management decided to act. The requirement was clear: isolate and protect without touching operations, with no planned downtime and availability kept above 99.9%.
The solution
We tackled the project in three phases coordinated with production:
- OT diagnosis and mapping. Full inventory of industrial assets plant by plant, identification of the protocols in use (Modbus, Profinet, OPC-UA) and a map of the real communications between devices.
- Segmentation with Fortinet. FortiGate deployed at each plant to create separate IT/OT zones following the Purdue model. Explicit rules per industrial protocol, monitoring with FortiAnalyzer and default-deny for any unregistered communication.
- Continuity and immutable backup. Veeam backup with an immutable off-plant repository and a tested recovery plan for the critical SCADA systems. Operational documentation ready for a NIS2 audit.
Each plant was worked on in change windows coordinated with the production manager. The rollout was completed without stopping a single line.
We maintain the managed-services contract with 24/7 on-call for the critical OT environments and a quarterly security-posture review.