Segmenting IT and OT networks in a food plant

If you do one thing this year, put a real boundary between the office network and the plant floor. Flat networks are why a phished email in accounts payable ends up stopping a production line.

Start by mapping what talks to what. Most plants discover connections nobody remembered — a spreadsheet macro reaching into a historian, a vendor laptop bridged to both sides.

Then enforce the boundary with a firewall and a short, explicit allow-list. Everything not on the list is denied. It is unglamorous, and it is the highest-leverage control in the building.