Manufacturing
OT boundary monitoring for manufacturers.
Security built for the factory floor
Manufacturers need to investigate an intrusion without losing sight of production. Records from the IT/OT boundary and plant computers help security and operations work from the same evidence.
Levels
| Purdue level | What lives there | Security support |
|---|---|---|
| 4 and 5 | Directory, mail, ERP, VPN and the internet edge. | SIEM, DLP, SOAR and Detection all apply. → |
| 3.5 | Firewalls, jump hosts, remote access, historian replicas. | Syslog, flow and Windows logs, with Detection baselines. → |
| 3 | Engineering workstations, HMIs, OT domain controllers. | Windows logs by agent or Windows Event Forwarding, where the vendor allows. → |
| 0 to 2 | PLCs, RTUs, safety systems, field devices. | Direct controller and safety-system monitoring remains outside this collection scope. → |
IT/OT incident
Boundary, identity and host records can help establish where an intrusion was observed and what remains uncertain. That history supports the operations team’s containment and restart decisions.
IEC 62443
Boundary firewalls, jump hosts and approved plant systems can supply evidence without direct controller queries. Define collection around the control-system vendor’s requirements and the plant’s operating procedures.
Removable media
DLP device policies can restrict removable media to approved uses on supported plant computers. Recorded exceptions allow necessary production work while keeping responsibility for the transfer clear.
Remote plants
Local buffering can preserve records during a connection outage. Source health in a SIEM shows when the site last reported and helps the team account for delayed or missing history.
By rule
4 and 5
Directory, mail, ERP, VPN and the internet edge. Monitoring, data protection and response workflows address the functions included in the deployment.
3.5
Firewalls, jump hosts, remote access, historian replicas. UEBA baselines in AI Detection add historical context to account and host activity for analyst review.
3
Engineering workstations, HMIs, OT domain controllers. Supported network and EDR host records provide evidence for correlation and investigation.
0 to 2
PLCs, RTUs, safety systems, field devices. This function is handled by the organization’s separately defined systems and procedures.
Questions
What does ARRTECH touch on the control network?
The proposed monitoring scope uses agreed logs from boundary systems and approved computers. It does not require direct control of production equipment; the collection design is reviewed with operations.
What if a site loses its connection?
The SIEM agent holds its logs and sends them when the link returns.
Can we control USB drives on plant computers?
Yes, on the plant computers the control system vendor allows.
Who decides containment?
The designated security and operations owners decide under the plant’s response procedure. The SOAR workflow can gather evidence and retain the approval and outcome.
What stays with the manufacturer?
The production controllers, the OT asset inventory and industrial protocol monitoring.
Guide
What is IEC 62443?
IEC 62443 is the international standard series for industrial automation and control system security.
How can OT be monitored without disrupting production?
Use available boundary and EDR host records through collection methods approved for the environment. Test the design with operations before extending coverage.
Does NIS2 apply to manufacturers?
NIS2 covers specified manufacturing sectors, subject to its scope and national implementation. The organization’s sector, size and circumstances determine applicability.
How ARRTECH takes care of manufacturing security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
