The principles
- Segmentation: IT and OT kept separate, with an intermediate zone (DMZ) where needed
- One-way access: read-only wherever possible, no control signals back
- Standard protocols: OPC UA, Modbus, I/O or API, instead of bespoke work
- Minimal ports: open only what the connection genuinely needs
- Legacy PLCs: through a gateway or by passive reading, without intervening in the control system
The warranty and liability question
Where an intervention would affect the control system or the machine supplier's warranty, you measure by reading along instead of writing into the control system. The connection is carried out to plan so that running production is never put at risk.
Honest about what IT and the MSP do
A short technical intake with your IT department and, where applicable, your external ICT partner is needed: that party manages the network and does not want unfamiliar hardware on it without an agreement. We say so explicitly instead of pretending IT has nothing to do. The management arrangements for year two are put in writing.
Frequently asked questions
Do IT and OT stay separate?
Yes. With network segmentation and, where needed, a DMZ, the production network stays separate from the office network.
Do ports have to be opened?
As few as possible, and only for what the connection needs, never a broad opening.
Does this affect my machine warranty?
Where an intervention would affect the control system, measurement is done by reading along, so the warranty is usually not at stake.
Which protocols are used?
OPC UA, Modbus, I/O or API: standard protocols, matched to what the machine offers.
