Manufacturing
The plant and the office are not the same network with more dust.
Keep OT and IT intentionally separate. Name who may change the boundary. Leave a picture the plant engineer and the network team can both explain.
Manufacturing estates accumulate the same failures as any complex estate — hidden single points of failure, blurred boundaries, knowledge that lives in one head — and one more: a well-intentioned peering or routing change that quietly collapses the line between plant automation and the corporate network.
The work is not to make those planes one fabric. It is to keep them separate on purpose, and understandable to both groups who have to live with them. Named change authority: what may route, what must not, who is allowed to change it. Boring reliability at the boundary. Fail-closed when the change is not named.
When a customer questionnaire or a cyber-insurer asks about segmentation, identity, and the public path, the answers should already be in the map. Not in a slide assembled the night before. NIST CSF, CMMC, and IEC 62443 show up as questions manufacturers already get. They are not products Director-Tech sells, and they are not certifications the practice holds.
The hire is the person who can own that picture with the people who run it, then leave a successor who can run the next cycle. The platforms on the campus — Cisco at the edge, Azure next to whichever cloud the ERP chose, SCADA-adjacent systems that must stay off the office plane — are the terrain. They are not the proof of the hire.
The platforms change. The obligation does not.
The practice holds the rest of the planes.
Multi-cloud, identity, perimeter, transfer. Speak with the line when the estate is already real.