A water utility’s OT network sits adjacent to an in-scope IT foothold but is explicitly out of scope. The path is technically reachable. What is the correct action?
Select an answer to reveal the explanation.
Short Explanation
Being able to see the water-plant fence from the IT parking lot does not mean you hop it. Out-of-scope OT stays out—even when a route looks tempting. Technical reachability is not a permission slip.
Full Explanation
Authorization—not mere adjacency—governs where pivots may go. OT and other excluded segments remain off-limits even if a foothold can route toward them. Testers should refuse out-of-scope pivots and report the reachable path as a finding or scope question as appropriate. Quiet “proof” testing of excluded OT is still a scope breach.