Technical controls enforce network separation between ICS and IT environments through firewalls and unidirectional gateways
A firewall between IT and OT zones permitting only necessary flows, plus one-way data paths, is the technical segmentation A.8.20 requires for industrial networks.
The technical facet enables the IT/OT separation with a firewall permitting only the specific flows production needs and one-way data paths where the plant only publishes outward, the enforcement A.8.22 requires for ICS zones.