A water utility blocks sending OT historian data to Azure AI services used by the IT SOC. What data-boundary practice is that?

Blocking OT historian data from Azure AI services used by the IT SOC is data-boundary segmentation: sensitive civic OT telemetry stays out of AI-assisted IT security tooling. Water utility historians and SCADA-related tags can reveal process setpoints, equipment states, and operational patterns that create safety and security risk if mixed into general IT AI workspaces or used to train broad models. The practice keeps OT data in OT-authorized systems and allows the IT SOC to use Azure AI only on approved IT security datasets.

Sanitizing sensitive civic OT data for limited AI-assisted IT security use does not describe blocking because it still routes OT telemetry into the IT SOC's Azure AI services, even in scrubbed and narrowly scoped form, rather than keeping that data out of IT security tooling. Restricting sensitive civic OT data to audited AI-assisted IT security queries does not describe blocking because it still permits OT telemetry inside AI-assisted IT security tooling under audit controls, rather than keeping that data segmented away from those services. Isolating sensitive civic OT data in compliant AI-assisted IT security storage describes compliant retention inside AI-assisted IT security storage, not segmentation away from AI-assisted IT security services, so it addresses a different storage need than blocking historian connectors to IT Azure AI.

Exam caveat: Segmentation does not mean the SOC gets zero OT visibility forever; it means access is mediated through OT-approved historians, historians' security monitoring, or carefully scoped one-way exports with engineering ownership—not ad-hoc AI workspace absorption. Know Purdue-style zoning concepts as applied to cloud AI connectors.

Operational check: Inventory AI service data sources; confirm historian connectors to IT Azure AI are blocked; require architecture review for any OT-to-cloud AI proposal; implement network and identity controls that enforce the boundary; and document exceptions with utility OT ownership and time limits.