Managed IT Services for Manufacturing: Vetting OT/IT Support

A plant does not go down politely at 9am. It goes down at 2:40am on second shift, during a changeover, with a truck scheduled at 7. The MSP that is perfectly fine for a 60-person accounting firm will look at a twenty-year-old PLC on a flat network, see an unpatched endpoint, and take the line down trying to fix it. That is the whole problem with buying managed IT services for manufacturing: the capabilities that matter most are the ones a generalist provider has never needed.

This guide is for the plant manager, ops director, or the one internal IT person at a manufacturer with 50 to 500 employees, a modern office on one side and older shop-floor equipment on the other. It starts with how generalist MSPs fail in a plant and explains the OT/IT boundary in plain language. Then it lays out what to evaluate, with the question to ask and what weak and strong answers sound like. It closes on response time priced in downtime, shift coverage, the defense supply chain case, and the three questions that disqualify a provider fastest.

How a generalist MSP fails a manufacturer

Manufacturing fitness is not a vertical logo on a provider's website. It shows up, or fails to, in a handful of moments that never happen in an office. A few common patterns:

• The patch push. The provider rolls the monthly update cycle to every Windows machine it manages, including the HMI workstation that runs a packaging line. The machine reboots mid-shift, or worse, the update breaks compatibility with the vendor's control software.
• The security scan. A new provider runs an aggressive network scan during onboarding to build its inventory. Some older controllers do not handle unexpected traffic well, and a scan meant to find risk becomes the cause of an outage.
• The help desk clock. Support runs 8 to 5, Monday to Friday. The plant runs two shifts and Saturday overtime. Most of the hours you actually produce are outside the hours you are covered.
• The flat network. Office laptops, the ERP server, guest Wi-Fi, and the machines on the floor all share one network. The provider leaves it that way because nobody asked, and one phishing click in accounting now has a path to production.

None of these come from a bad provider. They come from a provider applying good office habits to equipment that does not behave like office equipment. The fix is to vet for plant experience specifically, before the contract, rather than discover the gap on second shift.

The OT/IT boundary, in plain language

Every manufacturer runs two kinds of technology. IT is the office side: laptops, email, file servers, and business systems like your ERP. OT, or operational technology, is the equipment that runs production: programmable logic controllers (PLCs), human-machine interfaces (HMIs), SCADA systems, CNC machines, robots, and the sensors on the line. CISA describes these industrial control systems simply as the systems and devices that interact with the physical environment, and lists critical manufacturing among the sectors that depend on them.

The two sides are managed for different things, which is why the same habit can be correct in one and dangerous in the other:

• Priorities are reversed. Office IT protects confidentiality first and can tolerate a reboot. OT protects safety and uptime first. A restart that costs an office worker five minutes can scrap a batch or stop a line.
• Lifespans are longer. A laptop is replaced every few years. A press, a molding machine, or a CNC cell may run for decades, often on an operating system the equipment vendor certified long ago and will not support you changing.
• Patching is not always possible. Updating the PC that runs a machine can break the vendor's software or void its support. Some controllers have no practical patch path at all.

NIST's Guide to Operational Technology Security (SP 800-82 Revision 3) exists precisely because OT has its own performance, reliability, and safety requirements. It is the reference a serious provider should know, and a fair question to ask on a sales call is whether they do.

The two sides meet wherever production touches the business: the ERP or MES pulling counts from the floor, the engineering workstation that programs the controllers, the remote connection an equipment builder uses for support. That boundary is where an attack crosses from a phishing email to a stopped line, and it is where an MSP for manufacturers earns its fee.

That makes segmentation the single highest-value thing an MSP does in a plant. Separate the office network from the production network, allow only the specific connections production actually needs, and put a controlled point between them that can be monitored. Flat networks are the default in older plants. Segmentation is the work, not an upsell.

What to evaluate in managed IT services for manufacturing

Use these as your evaluation criteria. For each one, there is a question to ask and a sense of what weak and strong answers sound like.

1. OT/IT network segmentation

Ask: "Looking at a plant like ours, how would you separate the office network from the production network, what would be allowed to cross between them, and how long would that take without stopping production?"

Weak: "We can look at that as a project later," or a firewall quote with no discussion of what production systems need to talk to.
Strong: A phased plan that starts with an inventory of what is on the floor and what it talks to, defines zones, and schedules cutovers during planned downtime. A strong provider asks about your ERP and MES integrations before proposing anything.

2. Legacy equipment handling

Ask: "We have machines running old, unsupported versions of Windows that the vendor will not let us upgrade. How would you protect them?"

Weak: "Those need to be upgraded," or "We'll put our standard agent on them."
Strong: Compensating controls instead of patches: isolate the machine on its own segment, remove internet access, allow only the connections it needs, control USB use, keep offline images, and watch the segment for unusual traffic. Upgrade where it is possible, protect what cannot be changed, and do not patch the unpatchable.

3. Named equipment and protocol experience

Ask: "Name the plant equipment, industrial protocols, and ERP or MES systems you support for current clients."

Weak: "We work with lots of manufacturers." That is a logo, not experience.
Strong: Specifics. A controller family by brand, protocols such as Modbus, EtherNet/IP, or OPC UA, the ERP your peers run, and a description of how they coordinate with integrators and equipment builders. Then references in a plant of similar size that you can call.

4. Remote vendor access

Ask: "Our equipment builders connect remotely for support. How would you control that access?"

Weak: Leaving the vendor's always-on remote tool in place, or sharing one login across vendors.
Strong: Access that is requested and approved, time-limited, protected with MFA, limited to the specific machine, and logged. You should be able to answer "who connected to the line last month, and why?" from a report.

5. Plant-aware backup and recovery

Ask: "If the HMI computer on our main line died tonight, what would you restore, from where, and how long would it take?"

Weak: "We back up your servers nightly." The office servers are not what stops the line.
Strong: Backups that include HMI and engineering workstation images, PLC program files held in coordination with your controls team, and ERP and MES data, with offline copies and a restore time they have actually tested.

6. Change windows that follow production

Ask: "How do you schedule changes, updates, and reboots for a plant that runs on its own calendar?"

Weak: The same maintenance window as every other client.
Strong: Changes on the plant side scheduled around your planned downtime, with your sign-off, and a clear line between what gets updated automatically (office laptops) and what never does (anything that runs production).

For the general vetting questions that apply to any provider, from contracts to exit terms, work through the questions to ask before hiring an MSP alongside these.

Price response time in downtime, not in hours

An accounting firm struggles to put a number on an hour of IT trouble. A manufacturer usually can. That changes the whole service-level conversation.

Before you compare proposals, estimate what an hour of stopped production costs on your main line: lost output at margin, wages for people standing idle, overtime to catch up, expedited freight, and any late-delivery penalties in your customer contracts. Take a hypothetical plant where that adds up to $8,000 an hour. A provider offering a four-business-hour response on everything is now quoting you a $32,000 problem, before anyone has started work. A faster, more expensive tier may be the cheaper option.

Then make sure priority levels are defined by production impact, not by the provider's convenience. "Line down" needs its own top priority, with a first response measured in minutes and an on-site dispatch commitment if remote work cannot fix it. A broken office printer does not belong in the same tier. Ask, too, where the provider's responsibility ends and the equipment builder's begins, and who makes the call to the integrator when the problem turns out to be on the controls side. The IT support SLA guide covers how to get those definitions into the contract rather than the brochure.

Shift coverage: match support to when the plant runs

Write down your actual production schedule, including second and third shifts, weekend overtime, and seasonal peaks. Then lay each provider's support hours over it. A business-hours help desk often covers well under half of the hours a two-shift plant produces.

The questions that matter:

• When does a person, not a voicemail, answer the phone?
• What is the after-hours path for a production-impacting issue, and what is the contracted response time?
• How is after-hours work billed, and is "line down" treated differently from a routine request?
• How far is the nearest technician who can be on site, and what is the dispatch commitment at night or on a weekend?

Weak: "We offer 24/7 support" with no detail on who answers or what they can do.
Strong: Named coverage hours that match your shifts, a defined after-hours escalation path for production issues, written billing rules, and an on-site radius that includes your plant.

If you supply the defense industrial base: CMMC and ITAR

Some manufacturers carry obligations that most office businesses never see. If you handle Controlled Unclassified Information under Department of Defense contracts, CMMC requirements apply as they are written into your contracts. If you make or export defense articles, ITAR limits who can access controlled technical data.

In both cases, treat the MSP's experience as something to evidence, not something to assume. Ask how the provider's own tools and staff fit into your assessment scope, and what documentation they would produce to support your System Security Plan. Ask where your data would be stored, and whether any staff or subcontractors outside the United States could reach it. Ask whether they have supported clients through a CMMC assessment, and for references you can call. A provider's website badge is not evidence. A provider that can walk you through how its people and tools would sit inside your scope is a much better sign.

If none of this applies to you, skip it. Most manufacturers in the 50 to 500 employee range are better served focusing on segmentation, legacy equipment, and shift coverage first.

Three questions that disqualify a provider fastest

If your shortlist is long and your time is short, open every call with these three. The answers sort providers quickly.

1. "How would you patch our shop-floor equipment?" A provider who proposes patching plant equipment on the office patch schedule has told you they have never supported a plant.
2. "Name a piece of plant equipment or an industrial protocol you support today." "We work with manufacturers" without a named piece of equipment or a named protocol is a logo, not experience.
3. "What does our network look like after your first 90 days?" If segmentation shows up as an optional add-on rather than the plan, keep looking. In a plant, segmentation is the work.

A provider that answers all three specifically is worth a deeper conversation. If you want a framework for the rest of the evaluation, NIST's Cybersecurity Framework gives you a neutral structure to hold any provider's plan against.

Build your manufacturing MSP shortlist by state

Build the shortlist before you take a sales call. Compare managed IT providers in Ohio, Michigan, Indiana, or your own state in the MyMSPHub directory of managed IT providers. For the segmentation work specifically, filter by network services in states like Ohio or Wisconsin. Then run every finalist through the three questions above. The MyMSPHub buyer's guide covers the rest of the process, from shortlist to signed agreement.

Frequently asked questions

What should I look for in managed IT services for manufacturing?

Look for four things before you look at price: a plan to segment your office network from your shop-floor network, a way to protect legacy equipment that cannot be patched, help desk and on-site coverage that matches your shift schedule, and response priorities defined by production impact. Then ask the provider to name the plant equipment, industrial protocols, and ERP or MES systems they support today. A manufacturing page on their website is not evidence of any of this.

What is the difference between IT and OT in manufacturing?

IT is the office side: laptops, email, file servers, and business systems like your ERP. OT, or operational technology, is the equipment that runs production: PLCs, HMIs, SCADA systems, CNC machines, robots, and sensors. IT is usually managed for confidentiality and can tolerate a reboot. OT is managed for safety and uptime, often runs for decades, and frequently cannot be patched or restarted on an office schedule. The two meet wherever production data flows into business systems, and that boundary is where a manufacturing IT provider has to prove itself.

Should my MSP manage our shop-floor equipment?

Usually not the controllers themselves. PLC programming and machine configuration generally stay with your controls engineers, integrator, or the equipment builder. What a capable MSP should own is the boundary: the network segmentation between office and plant, remote access for vendors, backups of HMI and engineering workstations, and monitoring of the systems that connect production to the business. Ask any provider to state in writing which equipment they will touch, which they will not, and who they hand off to.

How do you protect manufacturing equipment that cannot be patched?

With compensating controls instead of patches. That means isolating the equipment on its own network segment, allowing only the specific connections it needs, removing direct internet access, controlling and logging remote vendor access, keeping offline backups of configurations and images, and monitoring the segment for unusual traffic. NIST SP 800-82, the federal guide to operational technology security, is built around this kind of approach. A provider whose only answer is to upgrade or patch everything has not supported a plant.

Do manufacturers need 24/7 IT support?

If you run more than one shift, you need IT support that covers the hours you produce, which for many plants means nights and weekends. That does not always mean a full 24/7 contract. It does mean a defined after-hours path for anything that stops production, with a contracted response time and a clear rule on what gets billed. Map your shift schedule first, then compare it against each provider's live help desk hours and on-site dispatch commitments.

How do I choose an MSP if we need CMMC compliance?

Treat CMMC experience as something the provider must evidence, not something you take from a logo. Ask how their own tools and staff fit into your assessment scope, what documentation they will produce to support your System Security Plan, how they handle access to Controlled Unclassified Information, and whether they have supported clients through an assessment, with references you can call. A provider that calls itself CMMC-ready but cannot answer those questions specifically is not ready for your contract.