System Partitioning into Zones, To Zone or Not to Zone?

System partitioning using zones and conduits is a foundational requirement in known cybersecurity standards such as IEC 62443-based risk assessments. But while it enables more precise Security Level Target (SL-T) assignments and better alignment between threats and mitigations, it's often misunderstood, misapplied, or over-engineered in practice.

In this talk, we’ll go beyond the theory and into the real-world implications of system partitioning. We’ll examine why poor or missing segmentation undermines risk assessments and why blindly partitioning every system can fragment your control strategy, introduce unnecessary complexity, and create compliance blind spots.

Using IEC 62443-3-2 as a technical case study, I’ll walk through what zones and conduits are meant to achieve, what they actually do in operational environments, and how they can both solve and introduce challenges in security architecture.

You’ll learn how partitioning affects SL-Ts, how shared controls lose effectiveness across zone boundaries, and why over-partitioning without operational maturity leads to implementation debt. More importantly, we’ll confront a critical misconception: that every supplier system must fully meet all security (SL-T) requirements internally. In reality, system owners must architect for gaps by using compensating controls at the infrastructure level, not penalise vendors for honesty. We’ll explore how to design architectures that assume variability in
supplier security capabilities while still achieving compliance and resilience. This talk is targeted at engineers, architects, and risk professionals working with ICS/OT systems or complex hybrid environments. Whether you're applying IEC 62443, NIST 800-82, ISO/IEC 27005, or working with cloud-native control domains, this session will give you a deeper understanding of partitioning as a strategic architectural tool and how to use it responsibly.