narrowin — IT/OT Strategy. One pragmatic plan for IT and OT.

[ Why it matters ]

When the question is bigger than "which firewall?"

Strategy work is the right move when the decision is organisational, not technical: when the question isn't a product choice but how IT and OT operations should be structured across the company.

01

IT/OT convergence, no plan

The two are growing together, but nobody has defined how they should be organised. Responsibilities overlap, processes are missing, decisions get stuck.

02

Unclear responsibilities

Who owns the OT network? Who decides on changes? Without clear mandates, things either don't get done, or get done twice.

03

Regulatory pressure

NIS2 and the IKT-Minimalstandard require documented governance. You need a model that satisfies auditors and actually works in practice.

04

Technology decisions need direction

Before choosing products, you need to know the target. A strategy defines the architecture and operating model that technology decisions should serve.

[ How we work ]

From where you are today to a roadmap your organisation can follow.

Five steps, grounded in the technical reality of your network.

1

Current state

Where the organisation stands today: IT, OT, governance, processes. We map the reality.

2

Target model

A coordinated or integrated IT/OT operating model: whatever fits your organisation, size and constraints.

3

Governance & roles

Who decides what, who is responsible for what: clear mandates that prevent conflicts and gaps.

4

Network architecture

The technical foundation: zone model, segmentation concept, infrastructure design that implements the strategy.

5

Roadmap

Concrete steps, priorities and sequencing: what comes first, what can wait, what depends on what.

Exemplary Road Map

34 work packages · 6 completed · 11 categories → based on priority matrix, quick wins first

Q3 2026Q4 2026Q1 2027Q2 2027Q3 2027

Network Infrastructure

Network Documentation

Disable Unused Services

L2/L3 Security Hardening

Network Redundancy Review

Segmentation

Target Design

Risk Analysis & Zone Concept

IT/OT DMZ Implementation

Monitoring & Detection

Central Log Collection

OT Anomaly Detection

Access & Hardening

Credential Hygiene

802.1X Rollout

Backup & Recovery

Config Backup Automation

Restore Drills

Governance & Compliance

RACI & Roles

NIS2 Gap Analysis

Network Redundancy Review (HSRP/VRRP)

Network Infrastructure

Review first-hop redundancy across core and distribution: verify HSRP/VRRP group priorities, preemption and timers, confirm active and standby paths match the intended design, and retire overlapping or orphaned groups. Establishes a predictable failover baseline before segmentation touches the core.

target

Q2 2026

owner

Network Eng.

effort

benefit

depends on

Network Documentation

completed in progress planned

In practice: a strategy only holds if it becomes a plan someone can follow — priorities, dependencies and owners, quarter by quarter.

[ Proof ]

Strategy and architecture in an operational environment.

Energy · utility · Switzerland

Eniwa

An IT/OT convergence strategy for a Swiss utility: an overarching network and security architecture that set the direction, followed by Explorer for ongoing visibility and an OT Connect design for the distributed sites. The strategy wasn't a slide deck: it was backed by real network data and turned into infrastructure.

[ Frequently asked ]

The specifics.

How is this different from a consulting firm's IT/OT strategy?

We ground everything in technical architecture: real network data, implementable designs, and products that turn decisions into infrastructure. We build what we recommend.

Do we need this before an assessment?

Not always. If the question is purely technical ("what's on our network?"), start with an assessment. If it's organisational ("how should IT and OT work together?"), start here. Both can run in parallel.

How long does a strategy engagement take?

Typically 6–12 weeks from kickoff to roadmap, depending on organisation size and complexity. The work often overlaps with an assessment running in parallel.

Who from our side needs to be involved?

IT and OT leadership, plus the teams that will implement and operate the result. The strategy needs buy-in from both sides. We facilitate that process.

[ Related work ]