BlastShield Orchestrator by BlastWave manages all OT network policies, including Users, Agents, Groups, Protocol Policies, Services, and Proxies. It functions as the ZTA Policy Engine and Policy Administrator. Communication can be filtered by IP protocol (e.g., TCP, UDP, HTTPS). The Orchestrator can set up Proxies for traffic to configured domains, enabling conditional access to cloud applications. It also participates in registration and session establishment. The Orchestrator is a cloud-based solution that can also be deployed and self-managed on-premise for air-gapped networks and highly-confidential data.