Corporate business systems, ERP, SOC — no direct OT access

Secure buffer between IT and OT — log forwarding, event normalization, no direct control

Site-wide operations — passive monitoring, historians, application servers

Operator workstations — real-time monitoring, SCADA displays, control commands

Local controllers — execute control logic, read sensors, drive actuators

Physical field devices — sensors, actuators, IoT endpoints generating raw process data