On a steel mill's shop floor, a vulnerable dependency is a question about a specific machine: which furnace controller, rolling line or operator screen runs the affected component, who can reach it and when a change is allowed. Triage by reachability and exposure, then fit fixes into planned outages.
This post uses a hypothetical example and names no mill or incident. Standards are cited from the pages we fetched.
Why do mills care about this sector label?
CISA's Critical Manufacturing Sector page lists primary metals manufacturing, including iron and steel mills and ferro alloy manufacturing, as one of the sector's core industries. Its products feed many other critical sectors. So steel plants sit inside an area CISA tracks for resilience.
The software stack is a mix of eras: modern analytics dashboards beside controllers that have run for many years. Libraries inside vendor products may be old and unlisted.
How does a scanner finding translate to the floor?
Imagine a vulnerability report names an open source web library. In an office app you update the package. On the floor, ask a different chain of questions.
Where does it run? A historian server, an operator HMI, an engineering workstation or inside a controller's firmware. The answer sets the risk.
Who can reach it? Only people on the plant network, or also the corporate network, or the internet through a remote support link. NIST's SP 800-82 Revision 3 gives guidance on typical OT topologies and countermeasures.
What does it control? A reporting screen is not a furnace. Separate software that displays data from software that can change set points.
When can it change? Many lines run continuously. The change window may be a planned outage weeks away.
What does a good triage rule look like?
Use three tiers. Tier one: reachable from outside the production zone, or exposed to untrusted input, and attached to something that can act on the process. Act soon, with compensating controls first if a change must wait. Tier two: reachable only inside the zone, on supporting systems. Schedule in the next window. Tier three: not reachable in your configuration. Record the reasoning and watch for change.
Reachability analysis helps decide which tier a finding belongs to, by checking whether your code or the vendor's actually calls the vulnerable function. For vendor firmware you will often have to ask the vendor.
What controls buy time?
Segmentation between corporate and plant networks. Removal of direct internet paths. Strong authentication for remote support, with sessions logged. Allow lists on what a vulnerable service may talk to. Monitoring for unusual traffic from the affected host. These are the controls NIST's OT guide discusses at length, and they work while you wait for a window.
How should patching be governed?
The ISA/IEC 62443 series includes a technical report on patch management in the industrial automation environment, TR 62443-2-3, by the title on ISA's page. We read the title and not the report, so consult it directly. Whatever you adopt, include a test step on a non-production unit and an agreed rollback.
What to do
- Build a list of software on the floor by line and function, with versions.
- When an advisory arrives, find which systems contain the component and where they sit.
- Classify each finding into the three tiers by reachability and ability to act on the process.
- Apply compensating controls to tier one immediately.
- Request vendor statements on exploitability in your configuration.
- Test fixes on a non-production unit and prepare rollback.
- Apply changes in planned outages and record before and after versions.
- Review the tiers after each network or configuration change.
Quick check
Should every finding be patched immediately?
No. On OT systems a patch is also an operational change. Triage by exposure and function, use compensating controls and apply fixes in tested windows.
Why separate displays from controllers?
A display flaw and a flaw in something that can change set points carry different consequences, so they rank differently.
Sources
- Critical Manufacturing Sector, CISA, fetched 18 October 2026
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, fetched 18 October 2026
- ISA/IEC 62443 series of standards, ISA, fetched 18 October 2026
Last reviewed: 18 October 2026.
