iShield Solutions Series, Platform & AI · OT / Industrial
OT/IT Convergence & Industrial Integration
Bring the Plant Floor into the Enterprise, One Zone at a Time
OT/IT Convergence & Industrial Integration carries plant-floor signals up through defined zones to the enterprise, so manufacturing and maintenance in iShield One can act on them and iShield Nexus can see the combined estate it supports — designed so that no direct path is opened down to the controllers.
Plant floor to ERP and technology operations — industrial connectivity with zone-based guardrails as the design principle.
Who leads, who contributes
- LeadiShield Link
- ContributoriShield One
- ContributoriShield Nexus
Integration and connectivity between plant and enterprise: industrial connectivity, edge runtime, tag normalization and zone policy, as listed in the published composition.
The enterprise challenge
Convergence doubles the value of plant data — and the paths an attacker can use.
Plant data is valuable to the enterprise: production counts, machine states and quality readings drive planning, maintenance and reporting. But every new connection from the plant floor to the business network is also a new path that must be governed.
A layered model keeps both truths in view. Signals move up through defined zones; nothing reaches down without passing a policy; the enterprise knows which plant assets depend on which technology; and when something goes wrong, OT and IT respond under one command.
Where iShield Nexus contributes
iShield Nexus contributes technology operations and service management: the combined asset and dependency record, security incident handling and crisis command (Asset Management, Security Operations, Crisis Management). iShield Link leads integration and connectivity; iShield One contributes the relevant ERP and operational business processes.
The Nexus angle
Converging OT and IT expands the attack surface and dependency chain.
- Technology services and controls are managed apart from the business process
- Evidence and ownership are fragmented
Solution overview. Bring the plant floor into the enterprise with OT safety as a design constraint. iShield Link is intended to connect industrial systems and expose normalized events to iShield One manufacturing and maintenance processes and to iShield Nexus technology operations, with zone policy between plant and enterprise.
Buyer challenges
Protocols the enterprise cannot read
Industrial protocols and tag names differ by line and vendor, so plant data needs bespoke translation for every use.
Flat networks
Convenience connections bypass zone boundaries, so a compromise on the business network can reach controllers.
Invisible dependencies
Nobody can say which plant processes depend on which servers, switches and gateways until one fails.
Two incident cultures
OT teams prioritize safety and uptime; IT security prioritizes containment. Without shared command, they work against each other.
Decision owners
- OT operations lead
- Which plant data may leave each zone, and when a process is isolated.
- Enterprise architect
- Zone boundaries, gateways and permitted flows between levels.
- Security operations lead
- Containment actions and when OT teams are engaged.
- Crisis lead
- When a converged incident becomes a crisis, and how safety and recovery are balanced.
Cross-platform journey
Up through the zones, never straight down
Follow a plant signal from the field to the enterprise and back to command. Each band is a zone; each step happens at the level where it belongs.
- Capture at the edge · Edge Runtime · OT Bridge iShield Link
- Normalize · Asset / Tag Normalizer iShield Link
- Cross the zone · Purdue-Zone Policy Engine iShield Link
- Act on plant events · Manufacturing Execution · EAM · Quality iShield One
- Map dependencies · Asset Management iShield Nexus
- Watch and respond · Security Operations iShield Nexus
- Command · Crisis Management iShield Nexus
Stage 1 of 7 · iShield Link Capture at the edge
Signals are read from controllers in their own protocols and buffered at the edge.
- Decision
- OT operations decide which tags are read.
- Exception path
- When the uplink fails, data is stored and forwarded later.
- Recorded as
- Buffered plant signal
Next: Normalize in Asset / Tag Normalizer (iShield Link)
This journey shows how responsibilities are intended to divide between the platforms. It describes an operating model, not a pre-built integration between them.
Who leads, who contributes, and where each stops
This is a cross-product solution. Each platform keeps its own responsibility and boundary; none is presented as a module of another.
- iShield LinkLead
Owns
Integration and connectivity between plant and enterprise: industrial connectivity, edge runtime, tag normalization and zone policy, as listed in the published composition.
Boundary
Governs the flows; it does not run production or security operations.
- iShield OneContributor
Owns
Relevant ERP and operational business processes — manufacturing execution, plant maintenance and quality — acting on normalized plant events.
Boundary
Does not connect directly to controllers.
- iShield NexusContributor
Owns
Technology operations and service management for the combined estate: the asset and dependency record, security incidents and vulnerabilities, and crisis command.
Boundary
Does not control plant equipment.
Module responsibilities
| Module | Platform | Responsibility in this solution | Hands on |
|---|---|---|---|
| Asset Management | iShield Nexus | Relates plant technology to the services and processes that depend on it. | Dependency map |
| Security Operations | iShield Nexus | Investigates security events and tracks vulnerability remediation. | Security incidents |
| Crisis Management | iShield Nexus | Leads converged incident command. | Decision log and communications |
Published composition, by owning platform
The modules in the solution's published composition, grouped by the platform that owns them.
iShield Nexus
Why this composition
OT telemetry without ERP context is hard to act on; ERP without plant signals is blind. iShield Link normalizes plant data, iShield One uses the events in manufacturing and maintenance processes, and iShield Nexus adds technology operations and service-management context. Zone policy is defined by the organization's architects and OT owners.
Decisions, exceptions and who owns them
Security exceptions and crisis decisions are recorded.
| Decision | Accountable owner | Evidence recorded | Exception path |
|---|---|---|---|
| Define permitted flows | Enterprise architect with OT operations | Zone and flow definitions | Undefined flows are blocked and reported. |
| Contain a converged incident | Security operations lead with OT operations | Investigation with asset context | Containment that affects safety is escalated to crisis command. |
| Accept an OT security risk | Risk owner | Exception with compensating measures and expiry | Expired exceptions return for decision. |
| Declare and stand down a crisis | Crisis lead | Decision log | Stand-down is logged with its reason. |
How zone and security requirements are governed
Zones, conduits and permitted flows are defined by the organization's architects and OT owners and enforced by the iShield Link policy engine. Nexus records converged assets, incidents and exceptions against those definitions; no industrial security mapping is pre-built.
- Every permitted flow has an owner and a documented purpose.
- Security exceptions name the zone requirement they depart from and their expiry.
- Applicability of industrial security standards is decided by the security owner.
Regulatory context
Regulations and frameworks organizations in this domain commonly work with. Listed as context for planning, not as a certification, attestation or pre-built mapping.
Recognized practice behind the operating model
Mappings describe how the operating model aligns with recognized practice. They are not attestations or certifications.
Security incident handling and crisis command follow NIST CSF 0 and ISO 22320, both mapped on accepted Nexus module pages.
| Framework | Practice | How the solution operates | Relationship |
|---|---|---|---|
| NIST CSF 2.0 | Detect (DE) and Respond (RS) functions | Security events on converged assets are detected, investigated and responded to with asset context.Mapped on the accepted Security Operations page. | Compliance-supporting capability |
| ISO 22320:2018 | Emergency management — command and control | Converged incidents are commanded jointly by OT and IT.Mapped on the accepted Crisis Management page. | Aligned practice |
Intelligence in explicit modes, by platform
Nexus AI capabilities assist the people involved; decisions remain with accountable owners.
- Assistance drafts, answers or summarizes
- Recommendation proposes for a person to accept
- Predictive anticipates or flags
- Workflow-triggered runs only as configured and approved
Investigation summaries
AssistanceSummarizes related alerts, assets and intelligence for analysts.
Security Operations — Investigation summariesRelationship suggestions
RecommendationProposes likely dependencies between plant technology and services for owners to confirm.
Asset Management — Relationship suggestionsCommunication drafts
AssistancePrepares crisis updates for approval.
Crisis Management — Communication drafts
What changes for the organization
Outcomes are described qualitatively. Figures are published only once evidenced.
Plant data the enterprise can use
Normalized events reach manufacturing and maintenance without bespoke translation.
No unplanned paths down
The model is designed so that only defined flows cross the zone boundary.
Dependencies known before failure
Plant processes are related to the technology they rely on.
One response culture
OT and IT respond under joint command with safety decisions logged.
What sets this solution apart
One dependency model
Plant technology and enterprise services are related in the same asset model.
Joint command
Converged incidents are commanded with safety, containment and recovery in one decision log.
Delivery and industry context
Planning information carried over from the solution record.
30 / 60 / 90-day value plan
Days 0–30 — Foundation
Stand up the iShield workspace, integrate sources of truth, ingest baseline data.
- Tenant provisioned in chosen region (KSA / UAE / EU / US)
- SSO + RBAC mapped to enterprise identity (Entra ID / Okta)
- Top 5 integrations connected and reconciled
- Baseline KPIs measured before any change
Days 31–60 — Activation
Turn on automation, AI agents and guardrails for the priority value stream.
- Workflows live for the top 3 use cases
- Link AI agents enabled with explicit guardrails and approvals
- Power-user enablement and admin training complete
- First measurable KPI improvement vs baseline
Days 61–90 — Scale
Industrialize, roll out to additional teams, prove ROI to the steering committee.
- Solution rolled out to additional business units / geos
- Executive dashboard with target vs actual outcomes
- Continuous improvement backlog established
- Signed ROI memo and renewal / expansion plan
Personas served
Illustrative industry scenarios
Representative situations by industry. Regulations named here are context, not certifications or commitments.
Oil & Gas
Plant historian and controller data normalized for maintenance and security operations, with segmentation requirements set by the operator.
Utilities
SCADA telemetry turned into ERP work orders, with zone boundaries defined by the utility.
Discrete & Process Manufacturing
Plant tag normalization feeding manufacturing execution, maintenance and quality without direct OT egress as a design goal.
Smart Cities & Infrastructure
Building management and transport telemetry related in one asset model, with NCA OTCC-1:2022 as regulatory context for the operator.
Related Platform & AI solutions
API, Integration & Event Platform
API gateway, iPaaS, event bus, connectors and EDI on one sovereign runtime.
OpenMulti-Tenant SaaS Enablement
Tenant lifecycle, isolation, metering, entitlements and per-tenant residency for SaaS builders.
OpenSovereign AI Gateway & Agent Governance
Governed LLM access, agent orchestration, prompt firewall and human-in-the-loop approvals.
Open
