Who owns the plant network? The question nobody at the plant can answer

Stand in front of the unmanaged switch bolted inside a control cabinet and ask a simple question: who owns this? The IT manager will tell you everything past the office firewall belongs to maintenance, because production equipment is not theirs to touch. The maintenance lead will tell you anything with an Ethernet port belongs to IT, because networking is not their trade. Both answers are reasonable. Both are sincere. And between them sits a layer of switches, gateways, HMIs and Windows boxes that nobody patches, nobody monitors and nobody has ever claimed.

That unclaimed layer is not a technology gap. It is an org-chart gap, and it is the single most common root condition we find when a manufacturer asks us to look at their plant. The malware does not care whose column the asset sits in. The attacker who lands on an office PC and finds a flat path to the production historian is exploiting a boundary dispute, not a firewall.

How the gap forms

Nobody designs it this way. It accumulates:

• A machine arrives with a built-in PC, installed by the OEM’s tech. IT never sees a ticket. Maintenance treats the PC as part of the machine, like a motor
• A controls integrator adds a switch to connect 3 machines for a project. The project ends. The switch stays, undocumented
• The office network gets professionally managed, patched and monitored because that is clearly IT’s job. The plant side of the wall gets whatever the last project left behind
• Each side assumes the other has visibility. Neither does. The first complete inventory anyone performs is the one the incident responders build during an outage

The result is predictable enough that we treat it as a default assumption: in a plant that has never formally assigned network ownership, there is equipment on the production network that appears in no inventory, receives no updates and authenticates with credentials nobody can rotate because nobody knows what would break.

Why “just give it to IT” fails

The instinctive fix is to extend IT’s authority to the plant floor, and it fails for a reason maintenance already understands: office IT instincts are wrong for production. Rebooting a server at 2 a.m. is good hygiene in the office and a scrapped batch on the floor. Pushing a patch on Tuesday is routine upstairs and a line-down event downstairs if the patch breaks the HMI vendor’s software. The priority order is genuinely different. Office IT ranks confidentiality first. The plant ranks availability first, safety above that, and both are correct for their domain.

Handing the floor to IT without changing IT’s operating rules produces either of 2 bad outcomes: IT applies office rules and breaks production, after which maintenance locks them out forever, or IT recognizes the danger, touches nothing and the unclaimed layer continues exactly as before with a new name on it.

What working ownership looks like

The plants that get this right do not resolve the dispute by picking a winner. They draw the boundary deliberately and put names on each side of it:

1. A written demarcation line. Typically: IT owns up to and including the firewall between business and production networks, plus the plant’s network infrastructure, switches, wireless and the remote access path. Maintenance or engineering owns the equipment side, controllers, drives, instruments and the OEM relationships that come with them
2. Shared custody of the awkward middle. The Windows machines that run production software, HMIs, historians, the CNC’s PC, get a joint rule: IT maintains the operating system and security agents, on a schedule maintenance approves, during windows production sets. Changes to the production application itself stay with maintenance and the vendor
3. One inventory both sides can see. Every device with an IP address on plant property, who owns it, what it runs and when it was last updated. Building this list is the first 2 weeks of any engagement we run in a plant, and it is where the surprises surface
4. A standing 30 minutes a month. IT and maintenance, same table, reviewing what changed, what the vendors asked for and what is scheduled. Most plants have never had this meeting. It costs almost nothing and it is where boundary disputes go to get settled before they become incidents

None of this requires hiring an OT specialist. It requires an owner for every box and a rhythm for the conversation. The technical patterns, segmentation between office and floor, controlled vendor access, outbound-only data paths, are covered in OT cybersecurity for manufacturers, the vendor remote access problem and plant-floor data without exposure. All 3 assume someone owns the ground they stand on. This post is about creating that someone.

The boundary we hold on our side

When Atticus Rowan takes on the IT side of this arrangement, the same demarcation applies to us. We design and operate the network boundary, the monitoring and the access paths, and we maintain the Windows layer on agreed windows. Deep PLC-level engineering stays with your OT integrator or the OEM. The point of the written boundary is that everyone, including your IT provider, knows exactly where their authority ends.

Where to start Monday

Ask 3 questions at your next production meeting. Who owns the switch in the press cabinet? When was the HMI’s operating system last updated? If the OEM connects remotely tonight, who gets notified? If all 3 produce confident answers, your plant is ahead of most. If they produce the look, the sideways glance between IT and maintenance that says “I thought that was yours,” you have found the gap this post is about, and it closes with a meeting and a list before it ever needs a budget.

Insurance underwriters and enterprise customers are asking these same questions now, in writing, and “jointly owned under a documented boundary” is an answer that holds up. The wider set of what they ask is in our manufacturing cybersecurity guide. If you would rather walk the floor with someone who has drawn this line in other plants, start a conversation.