A micro-DMZ is a narrow demilitarized zone scoped to a single asset or data path rather than an entire network zone. It sits between an untrusted segment and a protected OT device, terminating transport, authenticating the session, and enforcing a policy check before any traffic reaches the device. Think of it as a per-device airlock instead of a shared one.
What is a micro-DMZ?
It is a boundary that protects one thing: a single PLC, a single file-transfer endpoint, a single Modbus TCP session. Inside the micro-DMZ, a proxy terminates encrypted transport and re-emits traffic to the protected device in whatever plaintext protocol the device speaks. Outside it, nothing reaches the device directly. The device does not have to change, because the enforcement lives at the boundary, not on the asset.
How is a micro-DMZ different from an industrial DMZ?
Scale and orientation. An industrial DMZ (iDMZ) is a Purdue-model construct: a horizontal zone between the enterprise network (Level 4/5) and the process-control network (Level 2/3) that brokers shared services like historians, jump servers, and patch relays. It is typically a whole subnet with multiple hosts and dozens of flows.
A micro-DMZ is vertical and small. It protects one asset or one protocol. Where the iDMZ segments broadly, the micro-DMZ closes the last hop, so even an authenticated host inside the control zone still has to traverse the proxy to reach the device. The two are complementary, not competing. See the Purdue Model for where each fits.
Why does a micro-DMZ matter for CMMC?
Many OT assets cannot implement MFA, TLS, or audit logging natively. The iDMZ pattern does not solve that on its own, because it still exposes the asset to any authenticated host inside the control zone. A micro-DMZ closes the gap: every session must traverse the proxy, and the proxy enforces per-session identity, encryption termination, and logging.
That turns the OT asset into a compensating-control target. The system security plan can document that the asset itself cannot authenticate, but that every session reaching it has been authenticated, encrypted, and logged at the micro-DMZ boundary. It is a practical answer for NERC CIP electronic security perimeters too, where per-asset enforcement is exactly what auditors look for.
What does a micro-DMZ look like in deployment?
It is typically a proxy appliance or an overlay-network enforcement point with three properties:
- Per-asset policy. Rules bind to the asset, not the subnet.
- Protocol-aware termination. The proxy understands the application protocol (Modbus, DNP3, SFTP, HTTP) enough to enforce command-level restrictions, not just port-level allow/deny. See protocol filtering.
- Deny-by-default. Unlisted flows are dropped and logged.
Related terms
- Industrial DMZ
- Purdue Model
- Overlay networking (OT context)
- Protocol filtering (OT)
- Deny-by-default (OT)
How Access Gate helps
Access Gate creates micro-DMZs around individual OT assets: a per-device proxy boundary that terminates transport, enforces identity, and logs every session without modifying the protected device. See Industrial DMZ Design Patterns.
