Direct IP-based access from other zones and networks presents an inherent risk to the data within an ICS. This is due in part to the special patch cycles in OT, which can be much longer than in office IT, for example. At the same time, remote maintenance access to an ICS usually takes place from networks that can only be trusted to a limited extent. Such networks include private networks of third-party organisations and other zones of an organisation's own network. Zones in an organisation's own network that can only be trusted to a limited extent include those of the internal office and building IT or other zones of the OT network (such as for operations and production management with MES, ERP).

Direct access to an ICS from other zones and networks (e.g. via a local connection or VPN) can introduce malware and open the door to targeted attacks. This can lead to risks to life and limb in the OT zones to be protected, high financial losses due to downtime, or confidential information (such as company secrets) falling into the wrong hands.