A water utility’s OT network sits adjacent to an in-scope IT foothold but is explicitly out of scope. The path is technically reachable. What is the correct action?

If a water utility’s OT network sits adjacent to an in-scope IT foothold but is explicitly out of scope, the correct action is to refuse to pivot into the OT segment despite technical possibility. Pivoting briefly to “prove the path” then undoing it quietly still violates written scope and can stress fragile OT. Treating adjacency as implied authorization for any connected network is a common and dangerous fallacy in industrial environments. Cloning OT historians onto the IT foothold for offline browsing may move sensitive process data and still violates OT boundaries. Exam caveat: OT exclusions are bright lines even when routes exist. Operational check: note the adjacent route as a segmentation observation if RoE allows discussing adjacency, do not traverse it, and escalate if the utility wants a separately authorized OT assessment later. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.