Separating the floor from the office
Splitting the network into a machine layer and an office layer, rules for traffic between them and control over remote access by service engineers. The single change with the biggest effect on plant security.
One serves the office, the mail and the trading system; the other serves machine controllers, scales, scanners and panels on the floor. They obey entirely different rules, because the first is allowed to restart and the second stops when production stops. The trouble starts where both run on one switch, which in Polish plants is the rule rather than the exception.
We do not program controllers, change machine settings or go into automation, because that is work for your maintenance team and the line manufacturer. We handle the layer around it: the network, servers, backups, accounts and office hardware. In larger plants we work side by side with maintenance and put the split of responsibility in writing.
Every plant has a few computers that cannot be updated or secured in the normal way, because they are part of a machine worth several hundred thousand. That is not negligence; it is a condition of the warranty.
The panel on a machine tool or a measuring station runs a version of Windows that no longer receives fixes, and the machine maker stipulates in the service contract that any change to that system ends support. The machine is meant to run for another ten years and nobody will replace it over an update.
Since that computer cannot be fixed, you have to limit what it talks to. We move the machine layer into a separate subnet, open only the connections genuinely needed, and cut off its access to the internet and to office resources.
The line manufacturer wants to connect to the machine remotely, usually with its own tool and ideally around the clock. That is sensible during a breakdown and risky for the rest of the year. We switch the access on for the duration of the service call, with named sign-in and a record of what happened.
Splitting the network is the single change that buys a plant the most security for the least money, and it is usually the first thing we propose. The technical detail is in building a secure company network, and the physical layer, meaning cabling and access points in the hall, in company networks.
The amendment to the national cybersecurity system act took effect on 3 April 2026 and brought manufacturing in as an important sector. Classification happens by operation of law, with no administrative decision, so nobody will notify you.
Annex 2 lists the production of chemicals and food, and the manufacture of medical devices and in vitro diagnostics, computers, electronic and optical products, electrical equipment, machinery and equipment, as well as motor vehicles, trailers, semi-trailers and other transport equipment.
An important entity is a medium or larger enterprise, meaning from fifty employees or ten million euro of turnover. Linked and partner enterprises count as well, so a plant inside a group crosses the threshold sooner than its own payroll would suggest.
Entry in the register of key and important entities has a deadline of 3 October 2026. An information security management system and the reporting duties have until 3 April 2027. Reporting serious incidents applies immediately, with no transition period.
Honestly: compliance is mostly documents, a risk analysis and board decisions rather than buying equipment. We take the technical part, meaning network segmentation, backups, access control and gathering evidence, while the cybersecurity officer and the policy have to sit with you or with a law firm. We record the starting point in an IT audit. Basis: Journal of Laws 2026 item 252.
In an office the maintenance window is Saturday morning. In a plant running three shifts there simply is no such window, so planning IT work looks completely different and is one of the first things we settle.
You know it, we do not, and it is your figure that decides how much is worth spending on spare capacity. Until we hear it we cannot sensibly advise whether you need a second server, a second link, or simply a fast backup. We ask about it at the first meeting.
Replacing a switch, moving a server or cutting power to a cabinet go into the shutdown plan alongside the mechanical work, not next to it. That means some tasks wait months and have to be scheduled with the same lead time as a machine overhaul.
A terminal on the floor can die at two in the morning, and then it makes no difference that the office opens at eight. We agree what the shift supervisor handles alone from a short instruction and what triggers the on-call line, because not every report has to wake an engineer.
Out-of-hours cover is a separate, paid option in our contract, not a default promise. We describe it plainly under round-the-clock support, including when it is not worth buying. The rhythm of planned work is covered by server administration.
Six areas we usually start from. Under each one is a link to the page with the detail.
Splitting the network into a machine layer and an office layer, rules for traffic between them and control over remote access by service engineers. The single change with the biggest effect on plant security.
Cabling in conditions with dust, damp and interference, access points covering racking and trucks, and switches with spare ports for the next workstations.
Maintenance and integrations for the system that planning and the warehouse run on, plus dealing with its vendor when the problem sits in the application rather than the infrastructure.
Drawings, machining programs, recipes and bills of materials are assets that usually exist in a single copy and are often less protected than the mail.
Choosing the machine, virtualisation and spare capacity, and for critical systems a second node as well, if your cost of downtime justifies it.
An agreed route for evenings, nights and weekends, with a short instruction for the shift supervisor and a clear line on when a matter waits until morning and when it does not.
What it does not cover: programming controllers, changes to machining programs, automation and servicing the machines themselves. Nor do we replace the line manufacturer within its warranty scope, though we do help establish whose side the problem is on, which is usually the longest part of a breakdown.
The first visit happens on the shop floor rather than in a meeting room, because what stands next to the machines appears in no register.
We walk the hall with someone from maintenance and record what is connected to the network, including computers by the machines that the IT side often does not know about. We come back with a list of risks and a proposed order. Free and without commitment.
We ask what an hour of line stoppage costs and about the shift pattern and planned shutdowns. Those two figures shape the whole plan: what we do at once, what waits for a shutdown and what calls for spare hardware.
We separate the machine layer from the office layer and sort out backups of the technical documentation. These two give the most straight away and are needed both during an incident and when demonstrating compliance.
Requests, updates fitted into shutdowns, restore tests and a monthly report with a section on what we deliberately left undone and why it is waiting.
Pages that come up in conversations with manufacturing plants.
Pick your industry and see how comprehensive IT support and IT outsourcing for SMEs can help your company.
Do not update them, isolate them. We move such a computer into a separate subnet, take away its access to the internet and to office resources, and leave only the connections the machine genuinely needs. The warranty stays intact and the risk drops to a level you can defend in front of an auditor.
If you make chemicals, food, medical devices, electronics, electrical equipment, machinery or vehicles and have at least fifty staff or ten million euro of turnover, then most likely yes, as an important entity. It happens by operation of law and nobody will notify you. It is worth settling with a lawyer, because linked companies count too.
The act itself usually does not, but its effects do. A customer covered by the rules has to account for the risk of its suppliers, so the requirements reach you as a security questionnaire or a contract clause. In practice subcontractors feel this earlier than many a large plant.
Some work can be done without interrupting anything and we do that as we go. The rest enters the planned shutdown schedule, just like mechanical work, and needs the same lead time. We settle this once, at the start, and stick to that calendar so nobody stops your line without agreement.
No, because the scopes do not overlap. Maintenance answers for the machines and automation, we answer for the network, servers, backups and accounts. We put the boundary in writing, including who calls the line manufacturer during a breakdown. In practice maintenance is our best counterpart in the plant.
To access yes, to permanent not necessarily. The standard we propose is a connection switched on for the service call, a named account instead of a shared one, and a record of what happened. Manufacturers usually accept it, because other customers make the same demand. The harder case is a mobile modem inside the machine that nobody knew about.
It depends mainly on the number of computer workstations rather than headcount, because in manufacturing those figures diverge sharply. A plant with a hundred people and twenty computers pays for twenty workstations. The hall is priced separately if it holds many terminals and access points.
That follows directly from the cost of an hour of downtime, which only you know. If the line stands at tens of thousands an hour, redundancy pays for itself at the first failure. If production can cope for half a day on paper, a good backup and spare hardware are enough. We do sometimes advise against a second server and treat that as a normal part of the conversation.
The first meeting takes 30 minutes and commits you to nothing. We will tell you straight whether we can help and what we would propose.
2019 - 2024 Interactive Workspace Ltd. - All rights reserved.