FR 5 — Restricted Data Flow (RDF)

Constrain communications to approved flows between zones and components; minimize paths and blast radius.

• Zones & conduits modeled as segmentation policies
• Allow-list flows by identity, protocol, and service
• Observe-to-enforce rollout to avoid OT downtime
• Automated containment by restricting egress/inbound on compromise

• Scope by zone: identify where this FR is most critical (e.g., safety zone, engineering access, remote vendor conduit).
• Start in observe mode: baseline behavior and identify necessary exceptions.
• Enforce gradually: enable controls in phases aligned to maintenance windows; document exceptions.
• Continuously verify: monitor drift and anomalies; automate response where safe.

• Conduit policy definitions and change approvals
• Blocked/allowed flow telemetry and trends
• Containment actions and outcomes