Operating reality
The architecture will not hold still.
A substation is designed once and lives for decades. A production hall is re-laid out. Lines are added, retooled, moved between buildings and occasionally sold. A cell commissioned last quarter runs beside one installed a generation ago, on controllers two vendors have since discontinued, and both have to make the same shift.
That churn is what defeats manufacturing security programs. A network design that was correct at the last audit has since absorbed three machine installations, each delivered by a different builder, each arriving as a sealed skid with its own embedded controllers, its own unmanaged switch and its own remote-support arrangement written into the supply contract. Nobody inventoried them because nobody was asked to at acceptance.
Enterprise integration pulls in the other direction. MES scheduling, historian feeds and the ERP interface are now load-bearing for the plant, so the boundary between the production network and corporate IT carries real traffic that cannot simply be closed. And where quality, batch records and traceability live, integrity matters as much as availability: a record that cannot be trusted is a recall conversation, not an IT ticket.
So the work has to be built for change rather than for a single as-built drawing — zoning that follows the process rather than the cable route, acceptance criteria that catch new machinery on the way in, and a standard that lands the same way at every plant rather than being reinterpreted at each one.
An as-built drawing is out of date the week after the next line moves. The standard has to survive the change, not describe a moment.
Operational priorities
Four things manufacturing programs have to get right.
These decide whether a plant program becomes part of how the site runs or stalls after the first assessment, well before any question about tooling.
01 · Downtime is the unit of account
Exposure is expressed as what it could cost the line, and remediation as what it costs the schedule. Work is sequenced into changeover, planned maintenance and shutdown windows, so security competes for time on the same terms as every other plant activity.
02 · Zoning that survives retooling
Segmentation drawn around process cells and their real dependencies stays valid when a line is reconfigured. Segmentation drawn around a cabinet layout has to be re-engineered every time the floor changes, which in practice means it is not maintained at all.
03 · Machinery arrives with a network
OEM skids and packaged equipment come with embedded controllers, switches, routers and support connections agreed in procurement. The control that works is a specification and acceptance check applied at purchase and at site acceptance, not an audit finding two years later.
04 · Integrity alongside availability
Recipes, batch records, genealogy and quality data carry regulatory and commercial weight. Protecting the historian, the MES and the ERP interface is about records that hold up to scrutiny as much as it is about keeping the line moving.
In scope
Five environments we work in.
Collection uses OT-native tools built for production networks, and review is configuration-based. Machine safety functions and safety controllers are examined on paper, never exercised, and nothing is proven by interrupting a running line.
Line control and motion
PLC and PAC estates, drives and motion control, line and cell HMIs, robot and vision cells, and the cell-level networks and fieldbuses that tie them together, typically across several controller generations on one floor.
Machine safety controllers and safety functions sit inside this environment and are examined on paper and by configuration only. They are never exercised, and no finding is ever demonstrated by interrupting a running line. Everything else is assessed from controller configuration, project files and traffic collected with OT-native tools, with work scheduled into changeover or planned maintenance rather than requesting a stop.
MES, historian and ERP
Manufacturing execution, historians, recipe and parameter management, quality, genealogy and traceability systems, and the interface to ERP and scheduling where production data crosses into enterprise systems.
Here integrity carries as much weight as availability. A batch record, a genealogy trail or a released recipe that cannot be trusted is a recall conversation and a customer audit finding, not a service ticket. The questions are who can write to each record, whether recipe changes are authorized and logged, and whether the flow described as one-way genuinely is. Evidence comes from configuration and interface design rather than from testing a live system.
Packaged machinery and skids
OEM-supplied equipment arriving as a sealed package with its own controllers, unmanaged switches, sometimes its own router or cellular modem, and a support connection agreed during procurement.
This is where most manufacturing estates quietly change shape. A cell commissioned last quarter can bridge two zones nobody intended to connect, and it was never inventoried because acceptance did not ask. We review each package by configuration and by supply contract, then write the specification and site acceptance criteria that catch the next one on the way in — which is a procurement control rather than an audit finding two years later.
Plant network and IT/OT interface
Plant-floor switching and wireless, the industrial demilitarized zone, the routes carrying MES, historian and ERP traffic, and the governance of who may change what across that boundary.
This traffic is load-bearing for production, so the boundary cannot simply be closed, and neither side should absorb the other. What works is shared governance with explicit decision rights: IT brings identity, patching discipline, monitoring scale and network engineering; operations and engineering hold process knowledge and the authority to say when a change may land. Zoning is drawn around process cells and their real dependencies, so it survives the next retooling.
Engineering and machine-builder access
Engineering workstations, programming software and license dongles, project archives and the last known-good backups, jump hosts, and every remote path used by maintenance staff, machine builders, integrators and OEMs.
Two findings recur. The first is remote support written into a supply contract and never revisited, standing open between visits. The second is the project archive: the only copy of the program running a line, held on an engineer's laptop or a share nobody backs up. We inventory each access path against the agreement that created it and broker it through a managed route, and we treat recoverable, version-controlled project files as a production continuity control rather than an administrative tidy-up.
Related solutions
Where manufacturing engagements usually start.
Each stands alone. Most manufacturers begin on one representative line or one lead plant, then reuse what it produces across the rest of the estate.
Questions from this sector
What plant and group teams ask us first.
We retool lines every few months. Anything you design will be out of date by the summer.
That is true of a design written as an as-built drawing, which is why we do not write one as the deliverable. Zoning is drawn around process cells and their genuine dependencies rather than around the cabinet layout or the cable route, so a line that moves takes its zone with it.
The second half is acceptance criteria applied at purchase and at site acceptance, so new machinery arrives into a known position instead of being discovered later. Change stops being the thing that erodes the design and becomes the point at which it is applied.
Corporate IT wants to absorb the plant network. Is that what you will recommend?
No. Folding operations into IT replaces one problem with another, because the party that understands what a change does to a running line stops being the party that authorizes it. Nor is the opposite workable: a plant network run entirely in isolation gives up identity, patching discipline and monitoring that IT is genuinely better placed to provide.
What we design is shared governance with explicit decision rights — what IT provides, what engineering and operations retain, who may approve a change and in which window, and how the two sides escalate to each other during an incident. Written down, that argument stops recurring at every project.
Remote support is written into our machine builders' contracts. We cannot unpick that.
You do not need to unpick it, and removing the access would cost you response time you cannot afford. The change is in how the access is delivered rather than whether it exists: a brokered route into a managed environment instead of a standing connection to the cell, privileged credentials you issue, sessions that are recorded, and entitlements that expire.
Most builders accept that, because it does not reduce their ability to support you. Where a contract genuinely blocks it, the finding is written as specification language for the next machine purchase or contract renewal, which is where this is actually won.
We have run group standards before. They never land the same way at every plant.
Usually because the standard was written at product level, so a plant with different equipment could not comply literally and quietly reinterpreted it. Written instead at the level of zones, conduits, permitted flows and required evidence, the same standard can be met by different means at different sites.
The other half is measurement. If maturity is assessed the same way at every plant and reported in one language, a site that has diverged is visible early rather than at the next audit. That is what makes a group standard hold, not the document itself.
Our customers already audit us on cybersecurity. Is that not covered?
Customer audits are generally written around corporate information security and the protection of their data — identity, endpoints, policy, incident notification. They rarely examine whether a compromise could stop the line that makes their part, which is the exposure they would feel first.
The two are complementary. Clearing a customer audit stays a business requirement; the plant-side work answers a different question, and it tends to make the next audit easier because the evidence already exists rather than being assembled each time.
Next step
Prove the method on one line first.
A single representative line establishes effort, disruption and value before anything is committed across the plant or the group, and produces the zoning pattern and acceptance criteria the rest of the program reuses.
- OT-native data collection — solutions built for production networks, alongside configuration review
- Production windows respected — work sequenced into changeover and planned maintenance
- Machine safety functions out of scope — reviewed by configuration, never exercised
- OEM agreements honored — warranty and support terms checked before anything is touched
- Vendor-independent — specifications written to be tendered competitively across your plants
Questions from this sector
What operators in this industry ask first.
What are the OT cybersecurity challenges in industrial manufacturing?
Variety and connection. A manufacturing site typically runs many small control systems from many suppliers, flat networks grown line by line, machine builders with standing remote support, and a growing set of links to MES, quality, maintenance and analytics platforms. The most common event is not a targeted attack — it is commodity ransomware reaching production through a path nobody had mapped.
How does InnovAKT secure a multi-site manufacturing network?
With a standard that scales and a rollout that respects each site's schedule: a reference architecture for a line and a site, a segmentation and remote access model that works the same way everywhere, and a sequence that lets each plant adopt it in its own downtime. Uniformity is what makes a multi-site program affordable to run.
Can machine builders keep their remote access?
Yes, through a brokered path rather than a private one. The machine builder keeps the ability to support the equipment; the plant gains a single controlled route, identity for each engineer, approval before a session, and a record of what was done. Most OEMs accept this readily once it is written into the support arrangement.