The hard part is not the office network. It is the boundary between it and the plant, and the twenty-year-old machines on the other side that nobody can patch.
A provider who is good at professional services IT can run the office side of a manufacturer competently from day one. Email, laptops, the ERP front end, identity: same job, different logo.
Then they meet the plant, and the assumptions that work everywhere else stop working. Patching has to wait for a production window. A vendor needs remote access to a machine that cannot be allowed near the internet. There is a Windows 7 box running a press because the press manufacturer will not certify anything newer, and replacing the press costs more than the building.
This is the part that has to be bought deliberately.
The boundary is the job
Most manufacturing incidents we have been called into followed the same path. Something got into the office network by ordinary means, usually a credential or an email attachment, and then moved sideways into the production environment because the two were, functionally, one flat network with a switch between them.
The defence is not exotic. It is a real boundary with a small number of explicit rules, and discipline about what crosses it. In practice that means:
- Production systems cannot browse the internet, and the office cannot reach them except through defined services on defined ports.
- Vendor access is brokered through a jump host that is enabled when needed and disabled afterwards, not a permanent VPN account with a password set in 2019.
- Domain controllers, backups and administrative tooling are separated, so that compromising the office identity system does not hand over the plant.
Each of these is a project of days, not months, and each is routinely absent.
Patching, honestly
The standard advice is to patch promptly. On a plant that advice is sometimes wrong, and pretending otherwise is how you get a provider who either breaks production or quietly stops patching anything.
The workable position has three parts.
Separate the estate. Office endpoints get the normal cycle, in rings. Manufacturing operations systems get a slower cycle tied to production windows. Control systems get patched when the equipment vendor certifies it, which may be never.
Compensate where you cannot patch. An unpatchable machine is not an accepted risk, it is a risk that needs a different control: network isolation, application allow-listing, removable media restrictions, monitoring. Write down which compensating control covers which unpatchable asset. That document is what an auditor or an insurer will ask for.
Make deferrals expire. Every exception has an owner and a review date. Without that, the temporary exception for the labelling machine in 2022 is still there and nobody knows why.
What to ask a provider before signing
Four questions, and the quality of the answer matters more than the content.
"How do you handle a machine vendor who needs access tomorrow morning?" You want a described process with a human approving and a time limit. "We'd set up a VPN account" is the wrong answer.
"What is your change window, and who decides it?" The right answer involves your production schedule. A provider who patches at 2am on the second Tuesday regardless will eventually patch through a night shift.
"What do we do about the equipment that cannot be updated?" If they say everything can be updated, they have not worked on a plant.
"How quickly can you get someone here?" Remote support covers most of the office. It does not cover a line that has stopped. Get a number and the hours it applies to, and check it is in the contract rather than in the sales deck.
Recovery is measured in shifts
In an office, a four-hour recovery is a bad morning. On a line running two shifts, four hours is a meaningful fraction of the day's output, and the cost is calculable to the pound.
That calculation is worth doing, because it is the only argument that reliably unlocks budget. Take the contribution per hour of the line, multiply by a realistic outage, and compare it with the cost of the thing you want. In our experience this conversation moves faster in manufacturing than in any other sector, because the finance director already has the first number.
Two specifics that matter more here than elsewhere:
Offline copies of machine programs. PLC programs, HMI configurations, CNC files. These often live on one engineer's laptop and nowhere else. They should be in version control, or at minimum in a backed-up repository, with a copy that is reachable when the network is not.
A paper fallback for despatch. If the system that prints labels and generates paperwork is down, can you still ship? Somebody should have rehearsed the answer, because the alternative is discovering it with trucks waiting.
The thing most providers will not tell you
A large share of manufacturing IT risk sits in equipment that was specified by engineering, bought on a capital budget, and never entered the IT conversation at all. Nobody is hiding anything; the machine was bought to make parts and the embedded PC inside it was an implementation detail.
The fix is procedural rather than technical. Add one question to the capital approval process: what does this machine connect to, what operating system is inside it, and who patches it? Asking that at purchase costs nothing. Asking it eight years later costs a network redesign.
A sensible first ninety days
Inventory everything with an IP address, including the things engineering owns. Map the boundary as it actually is, which will not match the diagram. Close standing vendor access and replace it with a brokered path. Separate the patch cycles and write down the compensating controls for what cannot be patched. Then measure one recovery, for the system whose outage costs the most per hour.
None of that is glamorous and all of it is cheaper than the alternative.
