OT and IT still flat: how construction and plant networks get carved without stopping jobs
The problem is not "we need more firewalls"
Walk a plant floor or a busy jobsite trailer and you will hear the same story: office PCs, guest Wi-Fi, vendor laptops, and production or site systems sit on one big LAN. Someone calls that "OT" because machines live there. It is not.
If traffic from the office, a visitor, or a random SSID can reach a PLC, CNC, BMS controller, or trailer-connected equipment without a deliberate choke point, you have a flat network with machines on it.
That distinction matters when:
- A phishing click in accounting becomes ransomware that also hits the floor
- A vendor laptop on guest Wi-Fi can scan every HMI
- A prime or insurer asks how OT is segmented and the honest answer is "VLAN names only"
- CUI drawings open on a shop tablet that rides the same subnet as the CNC
You do not fix that with a bigger appliance and a weekend cutover. You carve it in phases so jobs keep running.
What "flat" looks like in construction and manufacturing
The patterns are boring and common:
Manufacturing / plant
- Engineering workstations and shop tablets on the same subnet as controllers
- Remote support jump boxes with broad access "for convenience"
- USB and contractor laptops plugged straight into machine cells
- No inventory of what talks to what (only what IT manages)
Construction / jobsites
- Trailer Wi-Fi shared by field tablets, guest phones, and cameras
- Temporary switches daisy-chained with default credentials
- Office VPN users who can reach site gear the same way they reach file shares
- Subcontractors joining the same SSID as project controls or BIM viewers
If your asset list stops at "PCs and servers," the floor and the trailer are invisible. Invisible systems do not get patched, monitored, or segmented.
Why "rip and replace" fails on live jobs
A full greenfield redesign sounds clean on a whiteboard. On a running line or an active site it usually means:
- Unplanned downtime while someone discovers undocumented dependencies
- Production refusing the change because the last "network project" broke a cell
- Temporary workarounds that become permanent flat paths again
Treat segmentation as controlled surgery, not a rebuild. Goal: shrink blast radius first, then deepen controls.
A carve plan that does not stop the job
Use this sequence. Each step should leave production and field work better protected than yesterday, not "broken until phase 3 ships."
1. Draw the real map (one week, not a six-month discovery)
You need three lists, even if they start ugly:
- Business / IT systems (email, ERP, file shares, CAD/BIM, M365)
- Production or site systems (PLCs, HMIs, CNC, MES, cameras, access control, trailer gear)
- People and paths that cross both (vendor remote access, engineering laptops, jump hosts, guest Wi-Fi, USB)
Walk the floor or trailer with ops, not only IT. Ask: what happens if this IP disappears for an hour? That question finds the real critical path.
2. Stop the easy lateral moves first
Before fancy zones, kill the paths that turn one compromised laptop into a plant event:
- Guest / visitor Wi-Fi fully segregated from corporate and OT (SSID separation alone does not count). Confirm with a packet path test, not a diagram.
- Default credentials on switches, cameras, and temporary jobsite gear
- Shared admin accounts used from the same session that browses email
- Unrestricted vendor remote access (prefer time-boxed, MFA-gated jump paths with logging)
These are the same gaps that show up early on a compliance readiness checklist. Closing them does not require a plant shutdown.
3. Create a small number of zones, then enforce them
Start with a practical zoning model, not a 40-zone Purdue chart nobody will maintain:
| Zone | Examples | Default rule | | --- | --- | --- | | IT / business | Laptops, servers, SaaS, email | No direct path to controllers | | Shared services | Domain, DNS, patch, jump hosts | Explicit allow-lists only | | OT / production or site ops | PLC, HMI, CNC, site controllers | Deny by default from IT and guest | | Vendor / contractor | Support laptops, OEM tunnels | Time-boxed, logged, MFA |
Put enforcement on firewalls or ACLs at the choke points between zones. Renaming VLANs without rules is theater.
For manufacturers who also carry DFARS / NIST 800-171 scope, remember: if a controller or tablet opens CUI, it belongs in the protected boundary. "OT is separate" is not a control. See The Manufacturer's Guide to NIST 800-171 and the NIST 800-171 overview.
4. Carve by cell, line, or trailer, not the whole company at once
Pick one high-value slice:
- One machine cell that already has a managed switch
- One production line with a known maintenance window
- One active jobsite trailer before the next crew wave
Move that slice behind the choke point. Validate that operators can still do their job. Document the allow-list (who talks to whom, on which ports). Then repeat.
Ops will trust the next slice only if the first one did not create a surprise outage.
5. Add monitoring where you already have a boundary
Once a zone exists, you can finally see abuse:
- Log and alert on new east-west connections from IT into OT
- Alert when guest or vendor ranges talk to controllers
- Keep enough history to answer "what changed before the line stopped?"
You cannot monitor a flat LAN into usefulness. Monitoring follows segmentation, not the other way around.
Construction-specific notes
Jobsites rotate gear weekly. Build for temporary without accepting permanent flatness:
- Standard trailer kit: managed switch, separate guest SSID, documented uplink to HQ
- Project closeout checklist that removes contractor accounts and temporary tunnels
- Prefer cellular or dedicated site links for cameras and access control instead of dumping them onto the office VLAN
- Treat BIM viewers and field tablets as IT endpoints: MFA, EDR, encrypted disks. Do not park them on the same L2 as controllers "because both are in the trailer"
If your construction practice is still growing security maturity, start with the free checklist and a clear site network standard before you buy another point tool.
Manufacturing-specific notes
Shop culture will fight anything that slows a changeover. Design for maintenance reality:
- Keep a break-glass path for OEM support that is MFA-gated, time-boxed, and reviewed after each use
- Patch and backup jump hosts and historians on an IT cadence; do not leave them as unowned orphans
- When engineering needs files on the floor, use a controlled file path or read-only share, not "map the whole CAD vault onto the cell PC"
- If you bid DoD work, align the OT carve with your CUI boundary and SPRS evidence, not a separate slide deck. Context for the current CMMC timeline sits on our CMMC overview.
A 30-day carve without a plant outage
Week 1: Asset and path map. Guest Wi-Fi path test. Kill default passwords on edge gear. Name owners for IT vs OT vs vendor access.
Week 2: Stand up the choke point (firewall or ACL pair). Move one non-critical shared service behind it as a dry run. Document allow-list format.
Week 3: Move one cell, line, or trailer into the OT zone during a planned window. Validate operator workflows. Fix the allow-list, do not punch permanent any/any holes.
Week 4: Turn on alerting for new cross-zone flows. Schedule the next two slices. Update network diagrams and (if in scope) SSP language so the document matches the plant.
If you freeze after the diagram, you still have a flat network. The carve only counts when rules enforce it.
Bottom line
OT is not a label on a subnet. It is a boundary you can prove: who can reach the machines that keep the job running, and who cannot.
Construction firms and manufacturers that carve in small, tested slices reduce ransomware blast radius, make vendor access honest, and stop guessing when a prime or insurer asks how the floor is protected. Teams that only rename VLANs stay flat.
If you want a senior engineer to walk your current path map and the first choke point that will not stop production, book a free 45-minute Compliance Gap Audit. You keep the written snapshot either way.