CONTROLLED NETWORK ARCHITECTURE
DCOS Network Architecture
A governed zone-and-conduit architecture for the management networks that make a critical facility observable, recoverable and supportable—from field and building systems through OOB, security, campus users and the interconnection edge.
- Access
- Open access
- Resource type
- Controlled network reference architecture
- Primary audience
- Network, OT, facility, security, platform, owner’s engineering and commissioning teams
- Product scope
- DCOS Network, PrecisionDCMS, DCOS Secure, DCOS Connect and CriticalOps Cloud
THE OPERATING UNDERLAY
Monitoring, security and remote operations are only as dependable as the management network beneath them.
DCOS Network is the network product and lifecycle service for building-management, OT, campus, NOC, out-of-band, physical-security and customer-management systems. It establishes the routed, switched, wireless and recovery paths needed to operate those systems without placing every endpoint in one flat management domain.
The architecture is designed for greenfield and brownfield sites. It may use a full PrecisionX reference design, operate as a managed overlay on accepted customer infrastructure or modernize selected zones while other network systems remain authoritative.
Segmentation is not a diagram label. It is an enforced, monitored and recoverable operating boundary.
NETWORK DOMAINS
Separate traffic by function, authority, risk and recovery requirement.
Segmentation with governed conduits between zones
The reference architecture separates seven governed network domains. Each domain has its own access rules, and reaching one domain never implies reachability into another.
- 01
Building-management and OT
Controllers, PLCs, remote I/O, meters, UPS, generators, ATS, switchgear, cooling systems, environmental devices, gateways and approved engineering workstations. Access is restricted by source, destination, protocol, identity and operational role.
- 02
Operations and out-of-band
Console servers, BMCs, network-management interfaces, recovery routers, secondary access paths, monitoring collectors and emergency administrative services. OOB is designed to remain useful when the primary production or campus path is impaired.
- 03
Campus operations
Staff devices, approved administrative services, voice, collaboration, printers, operational applications and managed Wi-Fi. Campus access does not imply access to OT, BMC or physical-security management.
- 04
Guest and contractor
Internet-oriented or narrowly brokered access for visitors, vendors and temporary personnel. The default design prevents lateral reachability into protected management domains.
- 05
Physical security
Access control, video, intrusion, intercom, visitor, duress, ALPR and related management services. Security traffic is isolated from general campus use while retaining approved interfaces to identity, incident and evidence systems.
- 06
Customer and cluster management
Customer BMC, management, service, storage, fabric-management and other approved operational paths. Tenant, customer and platform responsibilities are explicit; the domain is not silently merged with facility OT.
- 07
Interconnection edge
Firewalls, routing, optical transport, carrier handoffs, Internet, private WAN, cloud on-ramps, remote hubs, peering and cross-site services. DCOS Connect owns or coordinates the external service lifecycle while DCOS Network establishes the local edge.
DESIGN RULES
The reference architecture favors explicit paths over implicit trust.
Deny by default
Inter-zone access is not assumed. Required flows are documented by source, destination, protocol, port, direction, identity, purpose, owner and validation method.
Named identity
Administrative access uses named users, MFA and role-based privilege. Shared credentials and emergency access are controlled, rotated and audited according to the approved policy.
No public management exposure
Controllers, BMCs, network devices and security-management endpoints are not directly exposed to the public Internet as the normal remote-access method.
Outbound and private service paths
Hosted monitoring and support use approved outbound, VPN, zero-trust or private-WAN patterns. The site does not become dependent on an opaque inbound path.
Independent recovery
OOB and recovery paths are designed against the failures they are intended to survive. Diversity is documented by equipment, power, route, carrier, hub and service—not inferred from two circuit IDs.
Observable infrastructure
Power, environment, interface, neighbor, route, tunnel, optical, wireless, authentication, configuration, backup and capacity state are monitored within the accepted scope.
Controlled configuration
Templates, source-of-truth records, approvals, backups, versions, deviations and restore procedures make the network reproducible and supportable.
Lifecycle ownership
Addressing, DNS, NTP, certificates, licenses, support, firmware, spares, circuits, optics, configurations and capacity have named owners and renewal or replacement triggers.
ZONES, CONDUITS AND SERVICES
Build the local network as a set of governed service boundaries.
Scroll horizontally to see the full table.
| Layer | Primary functions | Required controls |
|---|---|---|
| Endpoint and field access | Controllers, devices, cameras, readers, BMCs, consoles, WAPs and sensors | Port role, authentication where supported, VLAN/VRF, power, physical labeling, endpoint inventory and source qualification |
| Access and distribution | PoE, industrial access, campus switching, resilient aggregation and routed boundaries | Redundant or appropriate topology, loop control, gateway placement, QoS, multicast control, telemetry, configuration backup and failure testing |
| Security and policy | Firewalls, ACLs, segmentation gateways, VPN/ZTNA, NAC and administrative jump paths | Deny-by-default rules, identity, change control, logging, review and expiration |
| Core and services | Routing, DNS, NTP, DHCP/IPAM, identity, logging, monitoring and management services | Availability, authoritative ownership, backup, restore, time integrity and dependency records |
| OOB and recovery | Console, BMC, alternate WAN, recovery routing, emergency access and local support | Independent power and path where required, break-glass control, reachability tests, contact and recovery procedures |
| Interconnection edge | Carrier, optical, Internet, cloud, private links, hubs and peering | Handoff definition, route policy, capacity, DDoS/security boundary, acceptance, diversity and incident ownership |
RECOVER THE NETWORK THAT RECOVERS EVERYTHING ELSE
Out-of-band must be engineered as a separate operational capability.
OOB provides approved access to console, BMC and management interfaces when the primary management or campus path is degraded. It may use independent routers, cellular or alternate carrier service, console servers, private tunnels and local recovery services. OOB is not automatically independent because it uses a different VLAN or modem. The architecture must identify shared power, antennas, carrier backhaul, firewalls, DNS, identity, remote hubs, cloud regions and credentials. Required recovery paths are tested from the actual NOC, backup NOC or authorized emergency location.
- Failure scenario the OOB path is intended to survive
- Endpoint scope and privilege
- Primary and alternate power
- Primary and alternate transport
- Console and BMC reachability
- Named and break-glass identity
- DNS, time and certificate dependency
- Local and remote routing
- Logging and session evidence
- Bandwidth and concurrency
- Periodic end-to-end test
- Loss, expiry and restoration procedure
CYBERSECURITY IS PART OF THE NETWORK PRODUCT
Protect the management environment without making recovery impossible.
DCOS Network applies zone-and-conduit segmentation, Purdue-informed where appropriate, without treating a generic Purdue level as a substitute for a project-specific flow and authority model. Controls are selected from the actual endpoints, protocols, users, remote support, customer boundaries and consequences.
- Asset and interface inventory
- IPAM, DNS and source-of-truth integration
- Named identity, MFA and RBAC
- Privileged access and session governance
- Service-account and certificate management
- Deny-by-default routing and firewall policy
- Network access control where appropriate
- Secure remote access and vendor paths
- Configuration backup and change control
- Central logs, monitoring and time
- Vulnerability and supported-firmware process
- Physical port, cabinet and pathway controls
- Incident, isolation and restoration procedures
- Evidence for access, rule, configuration and test changes
Network reachability does not grant equipment authority
A permitted monitoring flow does not automatically permit an engineering session, configuration change or equipment command.
GREENFIELD OR BROWNFIELD
Apply the reference architecture without forcing unnecessary replacement.
Full-Stack PrecisionX network
PrecisionX engineers, supplies, configures, stages, accepts and supports the selected management-network domains under one reference architecture.
Managed overlay
Existing customer or site network platforms remain in place. PrecisionX establishes approved visibility, administrative access, monitoring, configuration, incident and lifecycle processes around them.
Hybrid modernization
High-risk, unsupported or missing domains are replaced or added while qualified existing switching, routing, wireless, firewall or security infrastructure remains authoritative.
Customer-standard implementation
The project uses approved customer vendors, addressing, identity, security and operational standards while preserving the PrecisionDCOS operating contract and acceptance obligations.
FROM PORT MAP TO OPERATING SERVICE
The network is accepted by behavior, not by link light.
- 01
Engineering records
Zone and conduit diagram, logical and physical topology, rack and cabinet placement, port map, addressing, VLAN/VRF, routing, firewall flows, wireless design, OOB design, optical budget, power, dependency, responsibility and acceptance records.
- 02
Staging and FAT
Load controlled configurations; validate hardware, versions, templates, routing, segmentation, identity, monitoring, logging, backup, simulated failures and recovery before shipment or site activation.
- 03
SAT and commissioning
Verify actual circuits, optics, routes, wireless coverage, endpoint reachability, policy enforcement, NTP/DNS, identity, monitoring, OOB, failure behavior, labeling and as-built records.
- 04
Operational readiness
Confirm NOC access, escalation, carrier and OEM support, configuration restore, spares, certificates, licenses, capacity thresholds, change windows, patch process and customer communications.
- 05
Lifecycle operations
Monitor availability, errors, optics, routes, tunnels, wireless, power, environment, configuration drift, backup success, security events, capacity, licenses, support and lifecycle dates. Link incidents, changes and maintenance to the affected network services and dependencies.
The controlled architecture includes
- Domain and zone definitions
- Reference physical and logical topology
- Building-management and OT network
- Campus operations and managed Wi-Fi
- OOB and recovery architecture
- Physical-security network
- Customer and cluster-management boundaries
- Interconnection edge
- Routing, segmentation and firewall principles
- Identity and remote administrative access
- Source-of-truth, IPAM, DNS, NTP and certificates
- Network observability and configuration governance
- New-build, overlay and modernization patterns
- Failure, recovery and degraded-mode requirements
- FAT, SAT and operational-readiness matrices
- Lifecycle, spares, support and handback requirements
Frequently asked
Questions and answers
- Is DCOS Network the production compute fabric?
- Not by default. DCOS Network primarily governs building-management, OT, campus, OOB, physical-security and customer-management networks plus the interconnection edge. Production Ethernet, InfiniBand or other cluster fabrics may be customer- or solution-provider-authoritative while their health and dependencies are integrated into PrecisionDCOS.
- Does every site use the same VLAN or IP plan?
- No. The reference architecture standardizes roles, boundaries and records, not one universal address range. Addressing, VRFs, VLANs, routing, customer overlap, carrier interfaces and expansion are engineered for the site and portfolio.
- Is a cellular modem sufficient for OOB?
- It may be one component of OOB, but sufficiency depends on the failures, endpoints, power, coverage, backhaul, security, bandwidth, remote access and shared dependencies it must survive.
- Can existing Cisco, Juniper, Aruba, Mist, UniFi or other infrastructure remain?
- Qualified existing platforms may remain under Managed Overlay or Hybrid Modernization. Supportability, security, configuration access, monitoring, recovery, lifecycle and responsibility must be accepted; no vendor is retained solely because it is already installed.
- Does network access permit device control?
- No. Reachability, authentication, administrative privilege and equipment-changing authority are separate. Command or configuration rights are granted only through the approved role and change or authority process.
Related resources
DCOS Connect Service Guide
Carrier, optical transport, dark fiber, Internet, remote hub, cloud, peering and private interconnection from procurement through acceptance and operations.
Read resourceSecurityDCOS Secure Overview
Perimeter, access control, video, intrusion, visitor, critical communications, dispatch and evidence as a governed protective domain.
Read resourceArchitecture BriefsAuthority and Safety Boundary Brief
How read authority, command authority, local protection, workflow approval, API access and evidence are separated across the operating system.
Read resourceENGINEER THE MANAGEMENT UNDERLAY
Define the domains, paths and recovery outcomes.
Share the site topology, existing network standards, endpoint classes, carrier boundary and operating model. PrecisionX will identify the applicable reference architecture and controlled review package.