--- title: "OT and IT still flat: how construction and plant networks..." url: https://trnsfrm.tech/blog/ot-it-flat-network-construction-plant-segmentation description: "If a guest laptop or office PC can reach PLC, CNC, or site controllers, you do not have OT. You have a flat network with machines on it. Here is how…" lang: en --- Back to blog (https://trnsfrm.tech/blog) Image: OT and IT still flat: how construction and plant networks get carved without stopping jobs (https://trnsfrm.tech/blog-covers/zero-trust.jpg) By Jeff Dennis (https://www.linkedin.com/in/jefferydennis), Founder & CEO October 14, 2026 # OT and IT still flat: how construction and plant networks get carved without stopping jobs ## The problem is not "we need more firewalls" Walk a plant floor or a busy jobsite trailer and you will hear the same story: office PCs, guest Wi-Fi, vendor laptops, and production or site systems sit on one big LAN. Someone calls that "OT" because machines live there. It is not. If traffic from the office, a visitor, or a random SSID can reach a PLC, CNC, BMS controller, or trailer-connected equipment without a deliberate choke point, you have a **flat network with machines on it**. That distinction matters when: - A phishing click in accounting becomes ransomware that also hits the floor - A vendor laptop on guest Wi-Fi can scan every HMI - A prime or insurer asks how OT is segmented and the honest answer is "VLAN names only" - CUI drawings open on a shop tablet that rides the same subnet as the CNC You do not fix that with a bigger appliance and a weekend cutover. You carve it in phases so jobs keep running. ## What "flat" looks like in construction and manufacturing The patterns are boring and common: **Manufacturing / plant** - Engineering workstations and shop tablets on the same subnet as controllers - Remote support jump boxes with broad access "for convenience" - USB and contractor laptops plugged straight into machine cells - No inventory of what talks to what (only what IT manages) **Construction / jobsites** - Trailer Wi-Fi shared by field tablets, guest phones, and cameras - Temporary switches daisy-chained with default credentials - Office VPN users who can reach site gear the same way they reach file shares - Subcontractors joining the same SSID as project controls or BIM viewers If your asset list stops at "PCs and servers," the floor and the trailer are invisible. Invisible systems do not get patched, monitored, or segmented. ## Why "rip and replace" fails on live jobs A full greenfield redesign sounds clean on a whiteboard. On a running line or an active site it usually means: - Unplanned downtime while someone discovers undocumented dependencies - Production refusing the change because the last "network project" broke a cell - Temporary workarounds that become permanent flat paths again Treat segmentation as **controlled surgery**, not a rebuild. Goal: shrink blast radius first, then deepen controls. ## A carve plan that does not stop the job Use this sequence. Each step should leave production and field work better protected than yesterday, not "broken until phase 3 ships." ### 1. Draw the real map (one week, not a six-month discovery) You need three lists, even if they start ugly: 1. **Business / IT systems** (email, ERP, file shares, CAD/BIM, M365) 2. **Production or site systems** (PLCs, HMIs, CNC, MES, cameras, access control, trailer gear) 3. **People and paths that cross both** (vendor remote access, engineering laptops, jump hosts, guest Wi-Fi, USB) Walk the floor or trailer with ops, not only IT. Ask: what happens if this IP disappears for an hour? That question finds the real critical path. ### 2. Stop the easy lateral moves first Before fancy zones, kill the paths that turn one compromised laptop into a plant event: - **Guest / visitor Wi-Fi** fully segregated from corporate and OT (SSID separation alone does not count). Confirm with a packet path test, not a diagram. - **Default credentials** on switches, cameras, and temporary jobsite gear - **Shared admin accounts** used from the same session that browses email - **Unrestricted vendor remote access** (prefer time-boxed, MFA-gated jump paths with logging) These are the same gaps that show up early on a compliance readiness checklist (https://trnsfrm.tech/compliance-checklist). Closing them does not require a plant shutdown. ### 3. Create a small number of zones, then enforce them Start with a practical zoning model, not a 40-zone Purdue chart nobody will maintain: | Zone | Examples | Default rule | | --- | --- | --- | | IT / business | Laptops, servers, SaaS, email | No direct path to controllers | | Shared services | Domain, DNS, patch, jump hosts | Explicit allow-lists only | | OT / production or site ops | PLC, HMI, CNC, site controllers | Deny by default from IT and guest | | Vendor / contractor | Support laptops, OEM tunnels | Time-boxed, logged, MFA | Put **enforcement** on firewalls or ACLs at the choke points between zones. Renaming VLANs without rules is theater. For manufacturers who also carry DFARS / NIST 800-171 scope, remember: if a controller or tablet opens CUI, it belongs in the protected boundary. "OT is separate" is not a control. See The Manufacturer's Guide to NIST 800-171 (https://trnsfrm.tech/resources/manufacturers-guide-nist-800-171) and the NIST 800-171 overview (https://trnsfrm.tech/frameworks/nist). ### 4. Carve by cell, line, or trailer, not the whole company at once Pick one high-value slice: - One machine cell that already has a managed switch - One production line with a known maintenance window - One active jobsite trailer before the next crew wave Move that slice behind the choke point. Validate that operators can still do their job. Document the allow-list (who talks to whom, on which ports). Then repeat. Ops will trust the next slice only if the first one did not create a surprise outage. ### 5. Add monitoring where you already have a boundary Once a zone exists, you can finally see abuse: - Log and alert on new east-west connections from IT into OT - Alert when guest or vendor ranges talk to controllers - Keep enough history to answer "what changed before the line stopped?" You cannot monitor a flat LAN into usefulness. Monitoring follows segmentation, not the other way around. ## Construction-specific notes Jobsites rotate gear weekly. Build for temporary without accepting permanent flatness: - Standard trailer kit: managed switch, separate guest SSID, documented uplink to HQ - Project closeout checklist that removes contractor accounts and temporary tunnels - Prefer cellular or dedicated site links for cameras and access control instead of dumping them onto the office VLAN - Treat BIM viewers and field tablets as IT endpoints: MFA, EDR, encrypted disks. Do not park them on the same L2 as controllers "because both are in the trailer" If your construction practice is still growing security maturity, start with the free checklist and a clear site network standard before you buy another point tool. ## Manufacturing-specific notes Shop culture will fight anything that slows a changeover. Design for maintenance reality: - Keep a **break-glass** path for OEM support that is MFA-gated, time-boxed, and reviewed after each use - Patch and backup jump hosts and historians on an IT cadence; do not leave them as unowned orphans - When engineering needs files on the floor, use a controlled file path or read-only share, not "map the whole CAD vault onto the cell PC" - If you bid DoD work, align the OT carve with your CUI boundary and SPRS evidence, not a separate slide deck. Context for the current CMMC timeline sits on our CMMC overview (https://trnsfrm.tech/frameworks/cmmc). ## A 30-day carve without a plant outage **Week 1:** Asset and path map. Guest Wi-Fi path test. Kill default passwords on edge gear. Name owners for IT vs OT vs vendor access. **Week 2:** Stand up the choke point (firewall or ACL pair). Move one non-critical shared service behind it as a dry run. Document allow-list format. **Week 3:** Move one cell, line, or trailer into the OT zone during a planned window. Validate operator workflows. Fix the allow-list, do not punch permanent any/any holes. **Week 4:** Turn on alerting for new cross-zone flows. Schedule the next two slices. Update network diagrams and (if in scope) SSP language so the document matches the plant. If you freeze after the diagram, you still have a flat network. The carve only counts when rules enforce it. ## Bottom line OT is not a label on a subnet. It is a boundary you can prove: who can reach the machines that keep the job running, and who cannot. Construction firms and manufacturers that carve in small, tested slices reduce ransomware blast radius, make vendor access honest, and stop guessing when a prime or insurer asks how the floor is protected. Teams that only rename VLANs stay flat. If you want a senior engineer to walk your current path map and the first choke point that will not stop production, book a free 45-minute Compliance Gap Audit (https://trnsfrm.tech/book). You keep the written snapshot either way. ## Keep exploring More from the TRNSFRM team. ### All Blog Posts Browse every cybersecurity and IT article. https://trnsfrm.tech/blog ### Case Studies Real CMMC, NIST, and FTC outcomes. https://trnsfrm.tech/case-studies ### Free Compliance Checklist Score yourself across 47 controls in 10 minutes. https://trnsfrm.tech/compliance-checklist ### Compliance Frameworks CMMC, NIST 800-171, ISO 27001, HIPAA, FTC, ITAR. https://trnsfrm.tech/governance ### Cybersecurity Operations 24/7 MDR, SOC, and threat response. https://trnsfrm.tech/cybersecurity ### IT Resilience Framework Assess, Remediate, Operate, Improve. A continuous lifecycle. https://trnsfrm.tech/it-resilience-framework ### ITAR Compliance Checklist Work through ITAR readiness control by control. https://trnsfrm.tech/frameworks/itar ### MSP Partner Program White-label security and compliance for MSPs. https://trnsfrm.tech/partners/msp ### Choosing a Cybersecurity Firm 2026 buying guide and provider directory. https://trnsfrm.tech/blog/cybersecurity-companies ## More industries we secure Regulated-industry programs built by TRNSFRM. ### Aerospace & Space AS9100, CMMC, ITAR programs for aerospace suppliers. https://trnsfrm.tech/industries/aerospace-space ### Ambulatory Surgery Centers HIPAA-grade IT for ASCs and outpatient surgery. https://trnsfrm.tech/industries/ambulatory-surgery-centers ### Automotive Suppliers TISAX, CMMC, and OEM cyber flow-downs. https://trnsfrm.tech/industries/automotive-suppliers ### Behavioral Health HIPAA + 42 CFR Part 2 for behavioral health providers. https://trnsfrm.tech/industries/behavioral-health ### Defense & DoD Suppliers CMMC 2.0 & NIST 800-171 for the defense industrial base. https://trnsfrm.tech/industries/defense-dod-suppliers ### Dental Practices Real HIPAA compliance for dental groups and DSOs. https://trnsfrm.tech/industries/dental ## Featured cybersecurity insights Deeper reads from the TRNSFRM team. ### Building an Incident Response Plan You'll Actually Use A pragmatic IR playbook, not a shelf binder. https://trnsfrm.tech/blog/building-an-incident-response-plan-you-ll-actually-use ### Cloud Misconfigurations: The #1 Cause of Data Breaches Where teams get cloud wrong — and how to fix it. https://trnsfrm.tech/blog/cloud-misconfigurations-the-1-cause-of-data-breaches ### CMMC 2.0: What Defense Contractors Must Do Now The DIB compliance clock is ticking. https://trnsfrm.tech/blog/cmmc-2-0-compliance-what-defense-contractors-must-do-now ### Deepfake Fraud in the Boardroom: The New CEO Scam Why voice and video attacks now target execs. https://trnsfrm.tech/blog/deepfake-fraud-in-the-boardroom-the-new-ceo-scam ### MFA Bypass Techniques and How to Stop Them Attackers are getting past MFA — here's how. https://trnsfrm.tech/blog/mfa-bypass-techniques-and-how-to-stop-them ### Quantum Computing and the Cryptography Apocalypse Start planning your post-quantum crypto migration. https://trnsfrm.tech/blog/quantum-computing-and-the-cryptography-apocalypse Call Now: +18777776855 ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "logo": "https://trnsfrm.tech/wp-content/uploads/2021/11/trnsfrm-logo.svg", "image": "https://trnsfrm.tech/og-image.png", "description": "Cybersecurity, compliance, and managed IT services for manufacturers, construction, automotive, and healthcare organizations.", "foundingDate": "2008", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "founder": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://trnsfrm.tech/", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ] }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "address": [ { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, { "@type": "PostalAddress", "addressLocality": "Columbus", "addressRegion": "OH", "addressCountry": "US" } ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer service", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "areaServed": "US", "availableLanguage": "English" }, "knowsAbout": [ "CMMC", "NIST 800-171", "ISO 27001", "HIPAA", "FTC Safeguards", "ITAR", "Managed IT", "vCISO", "vCIO", "Cybersecurity", "Microsoft GCC High" ], "makesOffer": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity", "url": "https://trnsfrm.tech/cybersecurity", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Governance & Compliance", "url": "https://trnsfrm.tech/governance", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT", "url": "https://trnsfrm.tech/managed-it", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "vCISO", "url": "https://trnsfrm.tech/vciso", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Integration & Implementation", "url": "https://trnsfrm.tech/services/ai", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft GCC / GCC High", "url": "https://trnsfrm.tech/services/microsoft-gcc", "provider": { "@type": "Organization", "name": "TRNSFRM" } } } ], "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": "176", "bestRating": "5", "worstRating": "1" }, "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "TRNSFRM", "url": "https://trnsfrm.tech", "publisher": { "@type": "Organization", "name": "TRNSFRM" }, "potentialAction": { "@type": "SearchAction", "target": "https://trnsfrm.tech/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "ProfessionalService", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "image": "https://trnsfrm.tech/og-image.png", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "address": { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "priceRange": "$$", "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "BlogPosting", "headline": "OT and IT still flat: how construction and plant networks get carved without stopping jobs", "description": "If a guest laptop or office PC can reach PLC, CNC, or site controllers, you do not have OT. You have a flat network with machines on it. Here is how construction and manufacturing teams carve it without taking production offline.", "author": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://www.linkedin.com/in/jefferydennis", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ], "worksFor": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" } }, "datePublished": "2026-10-14T12:09:34.349702+00:00", "publisher": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" }, "image": "https://trnsfrm.tech/blog-covers/zero-trust.jpg" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://trnsfrm.tech/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://trnsfrm.tech/blog" }, { "@type": "ListItem", "position": 3, "name": "OT and IT still flat: how construction and plant networks get carved without stopping jobs", "item": "https://trnsfrm.tech/blog/ot-it-flat-network-construction-plant-segmentation" } ] } ] } ] ```