TroutTrout
Blog

Insights & Resources

Guidance on CMMC compliance, industrial cybersecurity, and OT network protection.

329 articles

MITRE ATT&CKICS threat detection

How to Use MITRE ATT&CK for ICS Threat Detection

Securing Industrial Control Systems (ICS) is critical. MITRE ATT&CK is a comprehensive framework designed to document and share knowledge about a...

ICS network designBest practices

Best Practices for Designing a Secure ICS Network

ICS network security is critical. As the backbone of critical infrastructure, ICS networks demand robust security measures to protec...

SegmentationNetwork Design

Breaking Down Broadcast Storms How Layer 3 Segmentation Saves Your Network

Broadcast storms are the silent saboteurs of network performance, wreaking havoc by flooding your system with an overwhelming amount of traffic. These storms can lead to significant downtime, producti...

OT SecurityBusiness Case

Building the Business Case for OT Network Segmentation

Your CISO knows segmentation matters. Your CFO wants to know what it costs and what it prevents. Here's how to build the business case.

CMMCManufacturing

CMMC Level 2 for Manufacturers: Why VLANs Are Not Enough for Shop Floor OT

VLANs segment traffic at the switch level. CMMC Level 2 requires identity-based access control, audit logging, and encryption. VLANs provide none of these. Here is what assessors actually look for on the shop floor.

CMMCNIS2

CMMC vs NIS2: One Compliance Architecture for Both Frameworks

Defense contractors operating in both the US and EU face CMMC and NIS2 simultaneously. The good news: a single on-premise architecture can satisfy both.

Flat networksSegmented networks

Flat Network vs Segmented Network in Industrial Environments

Flat network vs segmented network in OT: lateral-movement risk, compliance under CMMC, NIS2, and IEC 62443, and a migration path without production downtime.

CMMCEnduring Exception

How CMMC Handles Exceptions and Compensating Controls

CMMC Level 2 requires all 110 NIST 800-171 Rev 2 controls — but your CNC machines, PLCs, and legacy HMIs can't implement most of them. The Enduring Exception and Compensating Control mechanisms are how the framework handles that reality. Here's what the rule actually says, what a C3PAO will ask for, and what the Affirming Official is personally signing.

CMMCSSP

How to Write an SSP Section for a Network with Legacy PLCs

Your System Security Plan needs to describe how you protect assets that cannot protect themselves. Here is a practical template for documenting legacy PLC networks in your CMMC SSP.

Remote accessLegacy systems

Secure Remote Access for Legacy Systems

Securing remote access for legacy systems in operational technology (OT) environments presents unique challenges. These systems are crucial for industrial connectivity but often lack modern security f...

CMMCCompliance

What the CMMC Enduring Exception Actually Requires You to Document

The Enduring Exception is not a waiver. It requires specific documentation, compensating controls with evidence, and an Affirming Official signature. Miss any of it and you face False Claims Act exposure.

OT SecurityZero Trust

Why Your OT Network Has No Identity Layer (And What Happens When an Attacker Notices)

The moment an attacker reaches your OT network, they stop having to prove who they are. Flat Layer 2, PLCs that can't do MFA, trust-by-location — it's a lateral movement playground. The fix isn't rewiring the plant. It's putting an identity layer in front of the assets that can't enforce one themselves.

›Browse all posts (329)