Protecting a connected workshop does not start with a firewall. It starts with knowing what is plugged in, and by whom.
First decision: map it
Nobody can protect what they do not know. An inventory of equipment, protocols and actual flows is the absolute prerequisite. That exercise almost always reveals the same thing: remote maintenance access opened by an integrator years ago, never closed, never documented.
Second decision: separate the worlds
Business IT and industrial IT share neither rhythm, nor constraints, nor consequences in case of incident. Segmentation into zones and conduits, as structured by IEC 62443, protects production from office-side incidents as much as the reverse.
Third decision: accept the industrial tempo
You do not reboot a controller because a patch is available. Update plans must fit real shutdown windows, with compensating measures for the interval. A security policy that ignores the production calendar will not be applied.
What does not work
Transposing the IT department's framework onto controllers as-is. Installing antivirus on a supervision station certified by the manufacturer. Banning all remote connections without planning how the maintainer will intervene at night. Each of those decisions produces a workaround, and a workaround is worse than no rule.
Measuring progress
Compliance is not a binary state. We work in levels: complete mapping, then segmentation, then access control, then monitoring. Each level can be observed, dated and documented — which makes the approach defensible in front of a customer or an insurer.
Published 9 April 2026 Discuss this topic with us
