Industrial IoT Data Collection: A Read-Only Application Is Not a Network Boundary
A collector configured only to read equipment values can still sit on a computer that connects two networks. Before adding an industrial IoT gateway, review the paths the device introduces, including management and maintenance. Application behavior, permitted network traffic, and physical one-way transfer are different properties that need different evidence.
The reference here is the final NIST SP 800-82 Revision 3 publication, published in September 2023. As checked on October 19, 2026, NIST also lists Revision 4 as an initial public draft; this article does not treat that draft as a replacement final standard or claim compliance with either document.
Describe more than the telemetry arrow
Consider a hypothetical gateway with one connection to equipment and another to the business network. Its application polls measurements and sends summaries outward. A drawing containing only that telemetry arrow omits questions about operating-system forwarding, remote administration, diagnostic tools, software updates, and temporary maintenance connections.
List every interface and its intended role. Include wireless interfaces and maintenance connections if the product has them, even when the normal collector application does not use them. For each necessary communication, identify the initiator, destination, protocol, purpose, and responsible owner. Keep this detailed site inventory private; a public architecture example should not expose actual plant addresses or access information.
This is a design-review exercise, not an instruction to run discovery scans against production controllers. Obtain the equipment owner's approved inventory and vendor documentation first. Any active validation must respect the site's operational and safety constraints.
Identify the control that enforces each boundary
In NIST SP 800-82r3, section 5.2.3.1 discusses network segmentation and isolation using traffic-enforcement devices. It also emphasizes that unmanaged outbound connections can create risk. Appendix E distinguishes hardware-enforced unidirectional gateways from firewalls that can permit communication in both directions.
Do not label a general-purpose computer as a data diode merely because its current application sends measurements outward. Similarly, separate network interfaces do not, by themselves, document which traffic the complete system permits. Ask where the restriction is enforced and who can change it.
A proposal might use a site-approved intermediary zone, firewall-controlled paths, or a qualified one-way transfer solution. The appropriate choice depends on the plant's requirements and existing architecture. This article is not a universal wiring diagram and does not recommend removing existing protection to make a collector connect.
Keep management and data access separately reviewable
An approved telemetry path does not automatically authorize remote shell access, a web administration interface, or a vendor maintenance tunnel. Describe those capabilities independently. Determine whether they are necessary, how access is granted, how activity is observed, and how temporary access ends.
Ask the supplier what happens when the collector software stops or is replaced. Does the required boundary remain enforced elsewhere, or was the security claim based entirely on that application's intended behavior? Also inspect recovery modes and maintenance procedures, because a temporary troubleshooting connection can invalidate an otherwise accurate normal-operation diagram.
Do not publish passwords, keys, firewall exports, or customer network drawings as evidence. A review can record that an authorized administrator verified a bounded path without making the underlying sensitive configuration public.
Validate the proposed integration under site control
Use an isolated representative setup to compare intended data flows with the proposed enforcement rules. Include an expected-allowed communication and an expected-denied path. Record what was actually tested, which device enforced the result, and which production conditions the fixture did not reproduce.
Before commissioning, have the plant's responsible network and controls teams approve the final communication inventory and maintenance arrangements. Treat later interface or remote-access additions as changes to that agreement.
The useful outcome is not a statement that the gateway is “read-only.” It is a clear explanation of what can communicate, what enforces that scope, and how the arrangement remains controlled when someone maintains or updates the system.
