To address the security requirements of industrial control systems operating in open cloud-edge collaborative networks, existing protection architectures are urgently required to be redesigned, and corresponding security assessments are needed. Based on the conventional defense-in-depth framework, an improved methodology following the “supporting devices-equipment-systems-evaluation” hierarchy was proposed. Key components were reconfigured using dynamic heterogeneous redundancy, multi-mode arbitration, and quadruple control mechanisms. Critical supporting devices, including analog microcontroller unit (MCU), security programmable logic controller (PLC), and security distributed control system (DCS), were developed. A novel ndustrial control systems security isolation gateway and a cloud-edge intelligent platform were constructed to implement an intelligent protection system for cloud-edge collaborative environments. A digital twin testing platform was established based on real petroleum and petrochemical production scenarios. Actual operational data were imported, and two types of evaluations were conducted: quantitative assessment of cybersecurity effectiveness and attack verification testing. Experimental results indicate that a 100% compliance rate is achieved in the quantitative evaluation, while a 99% attack defense success rate is obtained in the attack verification tests. Compared with the traditional defense architecture, the protection capability is significantly enhanced. It is demonstrated that the proposed endogenous security-based design provides a feasible, advanced, and efficient solution for the security enhancement of industrial control systems in large state-owned enterprises.