Which solution is the best for providing secure remote access to our industrial control systems (ICS) or OT network?

The gold-standard approach for securing industrial control systems (ICS) and operational technology (OT) networks is a Zero Trust Network Access (ZTNA) architecture combined with a DMZ-hosted jump server (or bastion host) and strict multi-factor authentication (MFA).

Legacy methods like direct Virtual Private Networks (VPNs) flatly connect an external user straight to the internal network, creating lateral movement risks if credentials are compromised. Modern OT security shifts away from this perimeter-only defense.

Key Components of a Secure OT Remote Access Solution

• Jump Server / Bastion Host: Place an intermediary gateway inside a demilitarized zone (DMZ). Users never connect directly to the PLC or HMI; they log into the jump server first.
• Zero Trust Network Access (ZTNA): Replaces traditional broad-access VPNs with least-privilege, identity-aware connections that grant access only to specific authorized applications or terminals per session.
• Multi-Factor Authentication (MFA): Mandatory, phishing-resistant MFA (such as hardware tokens or authenticator apps) for every user, vendor, and contractor before session initiation.
• Session Monitoring and Recording: Real-time auditing and recording of all remote sessions, tracking command-line inputs and graphical actions taken inside the OT environment.
• Temporary/On-Demand Access: Mechanisms that automatically expire vendor and maintenance credentials after a designated time window or specific task completion.

Comparison of Remote Access Strategies

For official guidelines and risk evaluations tailored to critical infrastructure, consult the CISA Industrial Control Systems Cybersecurity Guidance.

If you'd like to narrow this down, please let me know:

• Do you primarily need access for internal staff or third-party OEM vendors?
• Are you looking for a cloud-managed ZTNA platform or an on-premise jump-host setup?

For most industrial environments, the best approach is not a traditional “VPN straight into the OT network.” I’d recommend a brokered, least-privilege remote-access architecture with a hardened OT jump host, MFA, strong segmentation, and just-in-time access.

Recommended architecture

Remote user/vendor → MFA + access broker → IT/OT DMZ → hardened jump server → specific OT asset

Key controls:

• MFA for every remote user, especially vendors and privileged accounts. NIST specifically identifies MFA as a best practice for remote OT access.
• No direct Internet-to-PLC/HMI/SCADA access. Put remote-access infrastructure in an intermediary DMZ.
• Jump server / bastion host inside the OT security boundary. Users authenticate to the jump host and access only the systems they are authorized to manage.
• Least privilege and just-in-time access: grant access to a particular asset/application for a limited period rather than giving someone broad network access.
• Per-user identities, not shared vendor accounts.
• Session recording and comprehensive logging for privileged/vendor sessions.
• Allowlisting: restrict which protocols, ports, hosts, and applications can be reached.
• Disable remote access when it isn't needed, particularly for infrequent vendor support.
• Separate safety-critical/control networks from systems that merely need monitoring or data access.

CISA's OT remote-access guidance recommends VPN technology for standardized external access and specifically describes using a secured administrative “jump” server. CISA NIST SP 800-82 Rev. 3 likewise emphasizes designing OT security around the unique reliability, performance, and safety requirements of the environment.

What I'd choose

There is an important nuance: Zero Trust Network Access (ZTNA) isn't automatically safer just because it's called Zero Trust. The implementation needs to preserve OT segmentation and account for legacy equipment that cannot support modern authentication. CISA's recent guidance notes the risks associated with vulnerable/misconfigured VPN deployments and recommends moving toward more granular, least-privilege access where appropriate.

My default recommendation:

Identity-aware ZTNA/broker + MFA + OT DMZ + hardened jump host + per-asset authorization + just-in-time vendor access + session monitoring/recording. For a real deployment, I'd design it around NIST SP 800-82r3 and your Purdue/ISA-95 network zones rather than selecting a product first. NIST's OT guidance remains the key reference, with a Rev. 4 draft also now in development.

If you tell me whether this is manufacturing, power, water, oil & gas, etc., and whether remote users are employees, vendors, or both, I can give you a concrete reference architecture and shortlist the best commercial solutions.

If you mean “what architecture should we choose for secure remote access into an ICS/OT environment?”, my recommendation is:

Best overall: OT-specific Zero Trust remote access + hardened jump host

For most industrial environments, the strongest design is not simply “put a VPN on the OT firewall.” I would use a layered architecture:

Remote user/vendor → MFA + device verification → Zero Trust/secure access gateway → OT DMZ → hardened jump/bastion host → tightly allow-listed OT assets

The key is that the remote user doesn't receive broad network-level access to the OT network. Access is granted to specific systems/applications for a limited period and is logged/controlled.

This aligns particularly well with the latest joint U.S. government OT guidance. In April 2026, CISA, FBI, DOE and other agencies recommended applying Zero Trust principles to OT; their guidance specifically recommends hardened jump hosts in the OT DMZ as the sole entry point, with MFA, continuous monitoring, auditing and time-based access controls.

How I'd rank the approaches

Why the jump host matters

A jump/bastion host creates a controlled choke point between remote users and the control environment. CISA's current OT guidance explicitly recommends placing hardened jump hosts in the OT DMZ and using them as the sole remote-access entry point.

Ideally, the jump solution provides:

• MFA, preferably phishing-resistant MFA
• Per-user identities—no shared vendor accounts
• Just-in-time/time-limited access
• Approval workflows for sensitive operations
• Asset/application-level authorization
• Session recording and audit logs
• Clipboard/file-transfer controls
• No direct Internet connectivity from the jump host
• Strong segmentation/firewall rules between the DMZ and OT zones
• Continuous monitoring
• Automatic account/session expiration

VPN still has a role

I wouldn't automatically eliminate VPNs. NIST's OT guidance recognizes VPNs as an appropriate mechanism for secure remote access when properly implemented, and CISA has recommended modern VPNs with strong authentication and encryption.

The important distinction is:

Good:
User → MFA VPN/ZTNA → OT DMZ → Jump Host → Specific OT asset

Riskier:
User → VPN → entire OT network

CISA/NSA specifically recommend segmentation, DMZs, firewalls and jump servers, along with VPN encryption and MFA when remote access is necessary.

What I'd choose for a new deployment

If you're starting from scratch, I'd evaluate OT-focused remote-access platforms that combine ZTNA/PAM capabilities with a hardened jump host, rather than buying a generic enterprise VPN and putting it in front of the control network.

For an existing plant where you already have a mature VPN infrastructure, a hardened VPN → OT DMZ → jump server architecture can be an excellent and potentially simpler solution.

One important caveat: OT safety and availability take precedence over blindly applying IT Zero Trust controls. NIST emphasizes that OT security needs to account for performance, reliability and safety requirements.

Bottom line:

Use Zero Trust principles for identity and authorization, a hardened OT DMZ/jump host as the access choke point, MFA, least privilege, just-in-time access, strong segmentation, and comprehensive session logging. Use VPN as the secure transport where appropriate—not as the authorization boundary itself.

If you're evaluating specific products/vendors (e.g., Claroty, OPSWAT, Nozomi, Tenable, BeyondTrust, CyberArk, Zscaler, Palo Alto, Fortinet, etc.), I can do a current 2026 comparison specifically for ICS/OT remote vendor access and rank them by security, architecture, ease of deployment, and cost.

There is no single "silver bullet" product that fits every industrial environment, but the undisputed industry consensus—reflected in frameworks like the Purdue Model and analyst guidance from Gartner’s Market Guide for Cyber-Physical Systems (CPS) Secure Remote Access —is a move away from legacy, flat-network VPNs toward Zero Trust, protocol-aware, and privileged-access platforms.

Traditional VPNs grant too much lateral network access once a user is authenticated. For an ICS/OT network, the "best" solution is a Dedicated OT/CPS Secure Remote Access (SRA) or Privileged Remote Access (PRA) platform that enforces strict least-privilege boundaries.

Top-Tier Solutions by Category

Industry leaders and representative vendors in the OT/ICS secure remote access space are typically categorized by their core strengths:

• Claroty (xDome Secure Access): Great for deep industrial asset visibility combined with secure, friction-free remote access tailored for engineering teams and third-party vendors.
• Cyolo (Cyolo PRO): Pioneer in identity-centric, zero-trust remote operations that allows secure access to legacy OT systems without requiring network redesigns or exposing the underlying network layer.
• BeyondTrust (Privileged Remote Access / Password Safe): Excellent for session-based, least-privilege control that completely eliminates persistent or unmanaged vendor connections and offers robust session recording/auditing.
• Xage Security: Utilizes a decentralized, identity-based security fabric approach, which is particularly powerful for distributed industrial environments (like oil & gas or utilities) with edge computing.
• TXOne Networks / Fortinet / Palo Alto Networks: Strong choices if you prefer a hardware/firewall-integrated network-enforced boundary gateway approach combined with industrial deep packet inspection (DPI).

Core Requirements for a "Best-in-Class" OT Remote Access Setup

No matter which vendor you evaluate, a true industrial-grade remote access solution must meet these non-negotiable criteria:

1. Protocol-Aware Filtering: It must understand industrial protocols (Modbus, DNP3, CIP, OPC UA, S7) rather than just dropping a generic IP tunnel. It should allow or block specific commands (e.g., allow read, block firmware-flash writes).
2. No Persistent Connections / Just-in-Time Access: Vendors or remote engineers should not have an "always-on" tunnel. Access should be requested, approved, time-bound, and automatically severed after the maintenance window closes.
3. Comprehensive Session Recording: Every keystroke, mouse movement, and HMI change must be logged, video-recorded, and made available for compliance audits (meeting frameworks like IEC 62443, NIST SP 800-82, or NERC CIP).
4. Identity Provider (IdP) Integration: Tie access directly to corporate multi-factor authentication (MFA), SAML, or IAM tools (like Okta or Azure AD/Entra ID) rather than sharing local device passwords.

To help narrow down the best specific fit, tell me a bit more about your environment:

• Do you primarily need access for internal engineering staff or third-party/external vendors?
• Are you looking for a cloud-managed SaaS overlay or an on-premises/air-gapped appliance?
• What compliance standards (e.g., NERC CIP, IEC 62443, NIST) do you need to satisfy?

The "best" solution for secure remote access to an industrial control system (ICS) or operational technology (OT) network isn't a single commercial product, but rather an architectural approach: Zero Trust Network Access (ZTNA) combined with a hardened, brokered gateway or jump host model.

Traditional legacy Virtual Private Networks (VPNs) grant broad, network-level access once authenticated, allowing a compromised vendor laptop to move laterally across the plant floor. Modern industrial frameworks reject this "castle-and-moat" design.

The Gold-Standard Architecture: ZTNA + Brokered Access

Instead of extending the corporate network or the internet directly to a PLC, RTU, or HMI, the connection follows a strict protocol:

1. Identity & Context Verification: Users (employees or third-party vendors) must authenticate using phishing-resistant multi-factor authentication (MFA) before touching any gateway.
2. The Brokered Hop (Jump Server / Industrial Gateway): Sessions land on a heavily audited, hardened intermediary proxy sitting in a demilitarized zone (DMZ) rather than directly onto the OT network segment.
3. Protocol-Specific Least Privilege: Access is granted to a specific application or device port for a time-limited window , rather than an open IP tunnel.
4. Full Session Recording & Auditing: Every keystroke, file transfer, and configuration change is logged and recorded for safety compliance and retrospective incident analysis.

Leading Solutions by Operational Focus

• Dedicated OT Secure Access & CPS Platforms:
  • Claroty xDome Secure Access: Highly regarded for deep asset discovery and merging cyber-physical systems (CPS) visibility with isolated remote operations.
  • Cyolo PRO: Built for identity-based access control that adapts seamlessly to hybrid or air-gapped industrial environments [1.23].
• Industrial Privileged Access Management (PAM):
  • BeyondTrust Privileged Remote Access: Excellent at credential injection—meaning third-party vendors can log in and troubleshoot equipment without ever actually seeing or handling the native passwords to your controllers.
• Network-Centric & Edge Security Fabrics:
  • Fortinet / Cisco Cyber Vision (SEA): Ideal if you prefer hardware-enforced micro-segmentation, ruggedized industrial firewalls, and deep industrial protocol parsing at the network edge.
• Turnkey Remote Maintenance Gateways:
  • Secomea: A popular choice for machine builders (OEMs) and discrete manufacturing needing fast, out-of-the-box appliance setups without wrestling with complex inbound firewall rules.

To help narrow down which specific vendor or deployment model fits your plant, tell me:

• Are you primarily providing access for internal staff or third-party/OEM vendors?
• Is your environment fully air-gapped/on-premise , or do you require cloud-managed orchestration?
• Do you already use an enterprise identity provider like Okta or Azure AD?

Best approach: an OT-specific, zero-trust remote-access gateway

For most industrial environments, I would not make a traditional VPN directly into the ICS/OT network the primary solution. The strongest architecture is a hardened OT jump host / bastion gateway in an OT DMZ, combined with MFA, least-privilege access, device/user verification, time-limited authorization, session monitoring/recording, and strict network segmentation.

This aligns particularly well with recent CISA guidance: its 2026 OT zero-trust guidance specifically recommends hardened jump hosts as the sole entry point for remote access to legacy OT networks, with MFA, continuous monitoring, session recording, auditing, and time-based controls.

Recommended architecture

Remote Engineer / Vendor
          |
     MFA + SSO/IdP
          |
   Zero-Trust Access
       Gateway
          |
    Firewall / ACL
          |
      OT DMZ
          |
  Hardened Jump Host
  (session recording)
          |
    Firewall / ACL
          |
      ICS / OT Zone
     ┌────┴─────┐
     |          |
    HMI       Engineering
              Workstation
     |          |
    PLCs / RTUs / DCS / SCADA

What I would require

NIST's OT security guidance recognizes VPNs as a valid technology for secure remote access, but also warns that remote technologies can become an attack channel if they aren't properly managed. NIST Publications NIST Computer Security Resource Center CISA similarly recommends segmentation and jump hosts, and notes that a VPN is only as secure as the devices connected through it.

What about VPN vs. zero-trust access?

I'd rank the approaches roughly like this:

1. OT-specific secure access gateway + jump host + MFA + segmentation — best
2. Zero-trust network access (ZTNA) into a tightly controlled OT DMZ/jump host — excellent, particularly for distributed/vendor access
3. Hardened VPN terminating in an OT DMZ, followed by a jump host — very good and often easier to deploy in existing plants
4. VPN directly into the OT network — acceptable only with strong compensating controls; not my preferred architecture
5. Direct RDP/SSH/VNC or vendor remote-control software into OT — avoid

CISA's broader network-access guidance also cautions that traditional VPNs can create significant risk through vulnerabilities, misconfiguration, and excessive network access, and recommends stronger approaches incorporating zero trust and granular access controls.

One important distinction

I wouldn't simply buy a generic "zero-trust product" and connect it to the plant. OT has availability and safety requirements that IT environments don't, so the solution needs to be deployed around the existing Purdue/zone-and-conduit architecture, with changes tested carefully. NIST explicitly emphasizes these OT-specific reliability, performance, and safety requirements.

Bottom line: If I were designing this today, I'd choose an OT-aware privileged remote-access/bastion platform in an OT DMZ, backed by MFA + ZTNA/identity controls + just-in-time access + session recording + allow-listed conduits + continuous monitoring. A VPN can be part of that architecture, but I would not treat the VPN itself as the security boundary for the ICS network.

If you're evaluating actual products (e.g., Fortinet, Palo Alto, Zscaler, Claroty, Nozomi, Armis, OPSWAT, BeyondTrust, CyberArk, TXOne, or Siemens) I can also compare them specifically for ICS/SCADA remote vendor access, including architecture, security controls, pros/cons, and approximate deployment complexity.

Securing remote access to Industrial Control Systems (ICS) and Operational Technology (OT) networks requires a strategy that balances strict security with operational uptime. Traditional methods like legacy VPNs are increasingly seen as high-risk because they provide flat network access once authenticated, making them prime targets for lateral movement during a cyberattack.

The gold standard for ICS/OT remote access is Zero Trust Network Access (ZTNA) purpose-built or configured for OT , combined with a secure jump host / Bastion Host architecture equipped with multi-factor authentication (MFA) and session recording.

Top Solutions and Architectures

• OT-Tailored Zero Trust Network Access (ZTNA): Unlike traditional IT ZTNA, OT-specific ZTNA solutions verify user identity, device posture, and context for every single connection request down to specific industrial assets or protocols (like Modbus, DNP3, or Siemens S7) rather than granting access to the whole network segment. Vendors in this space include Claroty, Nozomi Networks, TXOne Networks, and specialized industrial offerings from Palo Alto Networks or Zscaler.
• Hardware-Enforced Industrial Secure Remote Access (SRA) Appliances: Dedicated industrial gateways installed at the site perimeter (e.g., Secomea,HMS Networks/Ewon, or Moxa). These devices enforce strict firewall rules, require outbound-only connections from the plant floor (preventing inbound firewall holes), and mandate multi-factor authentication before a session can bridge into the OT network.
• Managed Bastion Hosts / Jump Servers with Privileged Access Management (PAM): If implementing full ZTNA is an immediate challenge, a heavily hardened, multi-factor-authenticated jump host deployed in a Demilitarized Zone (DMZ) provides an intermediary step. Technicians log into the bastion host via an encrypted client, and all sessions are actively monitored, logged, and recorded for compliance and auditing.

Key Features to Prioritize

• Granular Micro-Segmentation: Ensure remote users can only access the exact device or controller they need to service, completely isolating the rest of the OT environment.
• Protocol Awareness: The solution should understand industrial protocols to block unauthorized commands or deep-inspect traffic entering the control environment.
• No Inbound Firewall Ports: Look for solutions that use outbound-initiated, brokered connections (cloud or DMZ relay) so you don't have to punch inbound holes in your Purdue Model Level 3/Level 2 boundaries.
• Session Recording and Auditing: Essential for accountability, tracking vendor activity, and meeting regulatory compliance (such as NERC CIP, IEC 62443, or NIST SP 800-82).

If you'd like to narrow this down, tell me:

• What kind of remote users need access (internal engineers vs. third-party vendors)?
• Are you looking for a cloud-managed solution or an on-premises/air-gapped approach?
• What industrial protocols or equipment are most critical to protect?

For most industrial environments, the best architecture is not a single remote-access product. It is a brokered, zero-trust-style remote-access architecture built around a hardened jump server/bastion host, MFA, least privilege, segmentation, and session monitoring.

NIST specifically recommends MFA as a best practice for remote access to OT, while CISA emphasizes controlled remote access, strong authentication, limiting access to when it is required, and logging/monitoring. CISA also notes that no single remote-access solution is sufficient by itself; defense in depth is required.

Recommended architecture

Remote Engineer / Vendor
          │
          ▼
   MFA + Device Validation
          │
          ▼
   Remote Access Gateway
     / Zero-Trust Broker
          │
          ▼
   OT DMZ / Jump Server
          │
     Firewall / ACL
          │
          ▼
     OT Management Zone
          │
          ▼
   HMI / Engineering Workstation
          │
          ▼
       ICS / PLCs

Key controls:

1. Never expose PLCs, HMIs, SCADA servers, or engineering stations directly to the Internet.
2. Put a hardened jump server/bastion host in an OT DMZ and make it the controlled entry point.
3. Require phishing-resistant MFA where practical.
4. Use individual accounts, not shared vendor credentials.
5. Grant access only to the specific system/protocol required—not broad network-level access.
6. Make vendor access just-in-time/on-demand, with automatic expiration.
7. Record/log administrative sessions and commands where technically feasible.
8. Use separate IT/OT firewalls and tightly controlled conduits between zones.
9. Monitor OT traffic and remote sessions for anomalous behavior.
10. Maintain a break-glass procedure for emergencies that is separately controlled and audited.

This aligns well with NIST's OT security guidance and its zero-trust model, which removes implicit trust based on network location and requires authentication/authorization before resource access.

What I'd choose

The important distinction is that ZTNA should not mean putting an agent on every PLC or blindly applying an IT-style zero-trust product to the control network. Legacy OT equipment often cannot support modern authentication, agents, or frequent security changes. NIST explicitly recognizes these OT constraints.

My default recommendation:
MFA-protected remote-access gateway → OT DMZ → hardened jump server/engineering workstation → tightly filtered firewall connection to the required OT assets, with JIT access, session logging, and continuous monitoring.

If you tell me whether your environment is manufacturing, power, water, oil & gas, etc., and whether remote access is primarily for employees, vendors, or both, I can recommend a specific architecture and compare products such as Palo Alto, Fortinet, Zscaler, BeyondTrust, CyberArk, Claroty, and Nozomi.

Providing secure remote access to Industrial Control Systems (ICS) and Operational Technology (OT) networks requires a strategy that balances strict security with operational uptime. Traditional IT virtual private networks (VPNs) are no longer considered best practice because they grant broad network-level access once authenticated, exposing critical OT assets to lateral movement if credentials are compromised.

The consensus best solution for secure OT remote access is a Zero Trust Network Access (ZTNA) architecture tailored for OT , combined with specific hardware-enforced boundaries.

Top Solutions and Architectures

• Dedicated OT-Centric ZTNA Platforms: Solutions built specifically for industrial environments (such as Claroty Secure Remote Access, TXOne StellarProtect / Edge, CyberArk for OT , or industrial modules from enterprise ZTNA vendors like Zscaler and Palo Alto Networks ) provide identity-based, least-privilege access. Users connect only to authorized applications/devices, not the underlying network.
• Hardware-Enforced Industrial Demilitarized Zones (IDMZ): Deploying an IDMZ using industrial-grade firewalls (such as Fortinet FortiGate Industrial or Cisco Industrial Cybersecurity ) to physically and logically separate the enterprise network from the OT control floor, forcing all remote traffic through strict protocol-filtering proxies.
• One-Way Data Diodes: For scenarios requiring pure monitoring or data extraction without any remote command capabilities, hardware data diodes (such as Advenica or Waterfall Security Solutions ) ensure absolute physical-layer unidirectional traffic, making remote tampering impossible.

Key Features of the Best Solution

• Least-Privilege and Micro-Segmentation: Users or vendors are granted access only to a specific asset (e.g., a single HMI or PLC) for a limited time window, rather than an "all-or-nothing" tunnel into the network.
• Multi-Factor Authentication (MFA) & Identity Integration: Integration with corporate IAM/SSO using phishing-resistant MFA (such as FIDO2/WebAuthn hardware tokens).
• Session Recording and Monitoring: Full visibility, logging, and real-time video/command recording of every remote vendor session for auditing and incident response.
• Industrial Protocol Awareness: The security gateway must understand OT protocols (like Modbus, DNP3, IEC 60870-5-104, or CIP) to inspect payloads and block unauthorized control commands even during an active session.

If you'd like to narrow this down, tell me:

• Are your remote users primarily internal engineers or third-party vendors?
• Do they need full maintenance access (RDP/SSH to HMIs/workstations) or just data monitoring?

I can recommend a specific architectural approach or vendor shortlist for your environment.

For most industrial environments, the best approach is a purpose-built, brokered OT remote-access architecture—not a traditional VPN directly into the control network.

NIST recommends separating OT from corporate networks and minimizing the connections between them; CISA likewise emphasizes that remote access can introduce significant risk to control systems.

Recommended architecture

Remote user/vendor → MFA + access broker/jump server → OT DMZ → OT jump host → specific ICS asset

The key controls should be:

1. OT network segmentation

   • Keep the control network isolated from IT and the Internet.
   • Put remote-access infrastructure in an OT DMZ, with tightly controlled firewall rules between zones.

2. Privileged access management (PAM)

   • Require individual identities and phishing-resistant MFA where practical.
   • Grant access only to the specific system(s) and protocol(s) required.
   • Avoid shared vendor/operator accounts.

3. Jump server / remote-access gateway

   • Remote users connect to a hardened intermediary rather than directly to PLCs, HMIs, engineering workstations, etc.
   • Ideally, the gateway provides session recording, command/application restrictions, and centralized auditing.

4. Just-in-time access

   • Access should normally be off by default.
   • Require an approved ticket/change request and time-limited authorization.
   • Automatically revoke access when the maintenance window ends.

5. Application/protocol-level control

   • Don't simply give someone unrestricted IP access to the OT VLAN.
   • Permit only the necessary destination, port, protocol, and application.

6. Full monitoring and logging

   • Record who connected, when, from where, to which asset, and what they did.
   • Send logs to your SOC/SIEM and alert on unusual access.

7. Vendor access through the same controlled mechanism

   • Avoid permanent vendor VPN accounts.
   • Give vendors temporary, monitored access to the specific asset they are supporting.

What I would choose

The important nuance is that “Zero Trust” by itself isn't the solution. For OT, you want a solution designed around availability, safety, legacy protocols, and deterministic behavior. NIST's current OT guidance explicitly addresses these unique requirements.

My recommendation: implement an OT-specific remote access gateway/PAM platform in an OT DMZ, with MFA, just-in-time authorization, per-asset access controls, session recording, and centralized logging. Keep the actual PLC/DCS/SCADA network inaccessible directly from the Internet and preferably inaccessible directly from the corporate VPN.

NIST's OT security project currently lists SP 800-82 Rev. 3 as the final guidance and notes that Rev. 4 is in draft, so I'd use Rev. 3 as the current baseline while watching the Rev. 4 development.

If you tell me whether this is manufacturing, energy, water, oil & gas, etc., and whether you need employee access, vendor access, or both, I can narrow this down to the best architecture and specific products/vendors.