A micro-DMZ is a narrow demilitarized zone scoped to a single asset or data path rather than an entire network zone. It sits between an untrusted segment and a protected OT device, terminating transport, authenticating the session, and enforcing a policy check before any traffic reaches the device.
How micro-DMZ differs from industrial DMZ
An industrial DMZ (iDMZ) is a Purdue-model construct: a horizontal zone between the enterprise network (Level 4/5) and the process-control network (Level 2/3) that brokers shared services — historians, jump servers, patch relays. It is typically a whole subnet with multiple hosts and dozens of flows.
A micro-DMZ is vertical and small. It protects one asset or one protocol. The scope is a single PLC, a single file transfer endpoint, or a single Modbus TCP session. Inside the micro-DMZ, the proxy terminates encrypted transport and re-emits traffic to the protected device in whatever plaintext protocol the device speaks. Outside the micro-DMZ, nothing reaches the device directly.
Why this matters for CMMC
Many OT assets cannot implement MFA, TLS, or audit logging natively. The iDMZ pattern does not solve this — it segments broadly but still exposes the asset to any authenticated host inside the control zone. A micro-DMZ closes the last hop: even authenticated hosts must traverse the proxy, and the proxy enforces per-session identity, encryption termination, and logging.
This turns the OT asset into a compensating-control target. The SSP can document that the asset itself cannot authenticate, but that every session reaching it has been authenticated, encrypted, and logged at the micro-DMZ boundary.
Deployment shape
A micro-DMZ is typically implemented as a proxy appliance or overlay-network enforcement point with three properties:
- Per-asset policy. Rules bind to the asset, not the subnet.
- Protocol-aware termination. The proxy understands the application protocol (Modbus, DNP3, SFTP, HTTP) enough to enforce command-level restrictions, not just port-level allow/deny.
- Deny-by-default. Unlisted flows are dropped and logged.
Related terms
- Industrial DMZ
- Purdue Model
- Overlay Networking (OT context)
- Protocol Filtering (OT)
- Deny-by-Default (OT)
Access Gate connection
Access Gate creates micro-DMZs around individual OT assets — a per-device proxy boundary that terminates transport, enforces identity, and logs every session without modifying the protected device. See Industrial DMZ Design Patterns.
