On a food processing line, inspect access first: who and what can reach controllers, operator screens and engineering laptops, including vendors. Then check network boundaries, controller and recipe backups, and the safety systems that must keep working. These steps match the operational technology guidance from NIST and the ISA/IEC 62443 series.
Why start with access?
A packaging line or a cooking oven is run by programmable systems that touch the physical world. NIST's guide to operational technology security (SP 800-82 Revision 3, September 2023) describes OT as programmable systems and devices that interact with the physical environment, and says security has to account for performance, reliability and safety. That last part is why the first week is about observing, not scanning aggressively.
Access is the cheapest place to find real risk, because it needs conversations and diagrams, not probes against live equipment.
What do you ask for in week one?
A map of paths in. Ask who connects remotely: equipment makers, integrators, maintenance contractors, your own engineers. For each, note the route, the account, and whether anyone approves a session. Shared vendor accounts and always on remote tools deserve the first look.
A current network diagram. Compare the diagram with what a switch actually shows. The gap between the two is a finding in itself.
The seams between office IT and the plant network. Look for any machine that sits on both sides, such as a historian, a reporting server or an engineering laptop that moves between plants.
A list of what is on the line. Controllers, operator panels, drives, vision systems, scales, labelers, and the Windows machines that talk to them. Record make, model and firmware version where you can read it passively.
What about controllers and recipes?
Ask where the controller programs and recipe parameters are backed up, who can change them, and how a change is recorded. In food production, a recipe or setpoint change can matter for product quality and safety, not only for uptime. The question is whether you could restore a known good state, and prove it was the last approved state.
Restore testing is the part teams skip. An untested backup is a hope. Try restoring to a spare controller or a test bench, with the line owner present.
What belongs to whom?
The ISA/IEC 62443 series names four groups: asset owners, automation product suppliers, integrators, and service suppliers, and builds on shared responsibility among them. For you as the plant owner, that means your contracts should state who patches what, who may connect, and who holds the system documentation.
The series also helps asset owners decide the level of security their risk calls for. Part 3-3 covers system security requirements and security levels, so start there when you set targets.
What should you not do?
Do not run active scanners on a live line without the plant engineer's agreement and a tested plan. Some industrial devices handle unexpected traffic badly. Prefer passive monitoring, switch port mirrors, and reading configurations offline.
Do not treat patch cadence from office IT as the model. A controller may need a maintenance window planned weeks ahead, and the vendor may need to approve the update.
Do not forget the safety systems. Changes that touch emergency stops, interlocks or guarding need the safety owner's sign off. Machine safety standards exist for that equipment, and this post does not summarize them because we did not verify their text.
What to do
- List every remote access path and its owner.
- Get or draw a network diagram and verify it against switch data.
- Find every machine that spans office and plant networks.
- Record controller and recipe backups, and test one restore.
- Write the vendor responsibilities into contracts and service agreements.
- Agree with the plant engineer how any active testing will be done and when.
Quick check
Can I just scan the plant network like an office network?
Not without planning. Some industrial devices react badly to unexpected traffic. Start with passive methods and agree any active test with the plant engineer.
Which standard should I read first?
NIST SP 800-82 Revision 3 is free and explains OT security broadly. The ISA/IEC 62443 series is the industrial automation standard family, and its parts are listed on the ISA page.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, fetched 18 October 2026.
- ISA/IEC 62443 series overview, fetched 18 October 2026.
Last reviewed: 18 October 2026.
