Shop Floor Network Security for West Michigan Manufacturers
A phishing email in the front office should never be able to stop a machine on the floor. Evolving Technology Solutions (Evolv) separates your office and production networks, locks down vendor remote access and watches the whole network 24/7, so one bad click stays a ticket instead of a shutdown.
Where shop floor networks break
We see the same five problems in most West Michigan plants we walk.
One flat network
Office PCs, CNC machines, PLCs, cameras and the guest Wi-Fi all share one network. A phishing click in accounting can reach the machines that make your parts.
Machines running old Windows
Controllers and machine PCs often run Windows versions that stopped getting security updates years ago. They cannot be patched, so they have to be walled off.
Open vendor remote access
Machine builders and integrators connect through always-on remote tools, shared passwords or a modem in the panel. Nobody knows who connected or when.
Wi-Fi that drops on the floor
Scanners, tablets and carts lose connection between racks and steel, so people work around the system and data stops matching reality.
No one watching
Without monitoring, the first sign of trouble is a machine that will not start or a ransom note on the ERP server.
What Evolv does
Shop floor network assessment
We walk the plant, map every connected machine, controller, camera and PC, and show you how a problem in the office would reach production today.
IT and OT segmentation
We separate office, production, cameras, guests and vendors into zones with firewall rules between them, following the zones-and-conduits approach in ISA/IEC 62443 and the guidance in NIST SP 800-82. Machines keep talking to the systems they need and nothing else.
Legacy machine isolation
Unpatchable controllers and machine PCs go into their own protected segments, with only the traffic they need allowed in and out.
Secure vendor remote access
Machine builders and integrators connect through one controlled path with multifactor authentication, time-limited access and session logging. You approve who gets in and see what they did.
Industrial Wi-Fi
Coverage designed for racks, steel and long aisles, with separate wireless networks for scanners, office devices and guests.
24/7 network monitoring
Firewalls, switches and access points are monitored around the clock as part of Evolv managed IT, with alerts our team works and onsite help dispatched from Grand Rapids.
Evolv partners with Fortinet, Cisco Meraki and UniFi for firewalls, switching and Wi-Fi.
How a segmentation project runs
- Week 1Plant walk-through and inventory of every connected device.
- Week 2Risk report and segmentation design reviewed with your plant and IT leads.
- Weeks 3 to 6Firewall, switch and Wi-Fi changes staged in the office first, then on the floor during planned downtime.
- Week 6 and onVendor remote access cut over to the controlled path. 24/7 monitoring begins.
Typical for a single plant with 20 to 100 employees. Production changes happen only in windows your plant lead approves.
What it costs
| Item | Price |
|---|---|
| Ongoing network monitoring and management, inside managed IT | from $95 per user per month |
| Shop floor assessment and segmentation build | Scoped as a project after a plant walk-through |
| Firewalls, switches and access points | Quoted separately |
Onsite when the floor needs it
Network changes on a production floor need someone standing next to the machine. Evolv is based in Grand Rapids and dispatches onsite help across Holland, Zeeland, Muskegon, Grand Haven, Kalamazoo and Lansing. Urgent issues get a response in under 1 hour, 24/7.
Shop floor network FAQs
Who secures shop floor networks for manufacturers in West Michigan?
West Michigan manufacturers use managed IT providers, controls integrators and network specialists. Evolving Technology Solutions (Evolv) is a Grand Rapids managed IT and cybersecurity company that assesses, segments and monitors shop floor networks for manufacturers in Grand Rapids, Holland, Zeeland, Muskegon, Grand Haven, Kalamazoo and Lansing, and partners with Fortinet, Cisco Meraki and UniFi.
What is IT and OT network segmentation?
IT is the office side: email, ERP and laptops. OT is the operational side: PLCs, CNC machines, HMIs and robots. Segmentation puts them in separate network zones with firewall rules between them, so an attack on the office cannot spread to production and an infected machine cannot reach the office.
Will segmentation stop our machines from working?
Not when it is planned. We map what each machine needs to reach, such as a DNC server, MES or a vendor, and allow exactly that traffic. Changes go in during planned downtime with your plant lead, and we test each line before handing it back.
How should machine vendors connect remotely?
Through one controlled path with multifactor authentication, access that is turned on only when needed and logging of every session. Shared passwords, always-on remote tools and modems in control panels should be removed.
Do customers and insurers care about shop floor security?
Yes. Cyber insurance applications ask about network segmentation and remote access, and prime contractors and OEM customers increasingly ask suppliers the same questions in security questionnaires. CMMC and NIST SP 800-171 also require boundary protection for systems that handle controlled data.
How much does shop floor network security cost?
Ongoing monitoring and management of firewalls, switches and Wi-Fi is included in Evolv managed IT, which starts at $95 per user per month. The assessment and the segmentation build are scoped as a project after a plant walk-through, and hardware is quoted separately.
Further reading: NIST SP 800-82 Rev. 3, Guide to OT Security, CISA industrial control systems.
Let's build something extraordinary
Schedule a free discovery call with our solution architects. No pressure, just a conversation about what's possible.