In one embodiment, a device receives control logic programmed within at least one controller included within an industrial network. The device also determines a network topology of the industrial network, and derives a network policy for the industrial network based upon, at least in part, the control logic and the network topology.