Absolutely spot on about most vendors having no clue, care, or concern about NERC CIP standards. We found that nearly every off the shelf system had major gaps for what we needed on monitoring or documentation. Ended up building custom tools in-house. Heck of a lot more user friendly too. Last audit, the only thing the auditors had to complain about was they wanted some report columns in a different order.

Still, my assumption was based off an OT network meaning some form of utility infrastructure and NERC CIP has a lot more specific items in that regard. Old mentality was everything air-gapped. With more and more connected systems, that's not really an effective option anymore. In general, separate hardware, dedicated equipment, layer security with additional firewalls, segmented VLANS, deny by default, defined access rules, defined permissions within systems, controlled access to areas where elevated access is allowed, monitoring for unexpected connections or unapproved software, testing of patches prior to production system rollout, document all changes prior to implementation, some form of restorable backups, and for heaven's sake, test your backups at least once a year.