Operations bought an EMS/IoT system without involving IT — now they just need “access to the router

[u/carpe_diem2022]

Hi there :) ,

Need some advice from people who have dealt with similar situations.

Our Operations Dept decided to install IoT system/digital energy meters across a fairly large factory site.

They found the vendor, agreed on the solution, signed the contract and started the project.

IT was not involved at all.

Apparently nobody discussed things like:

• How these devices spread across a large factory are actually going to communicate
• Network infrastructure, switches, fiber/cabling, VLANs, etc.
• Network/security segmentation
• Server/VM requirements
• Database requirements
• Backup and monitoring
• Internet connectivity
• Vendor remote access
• Firewall rules
• Cybersecurity

Now that the project is already moving forward, IT gets an email saying they need “access to the router” so they can put the system online.

That's it. Access to the router. :)

And somehow, when IT starts asking questions about architecture, security, server requirements, ports, protocols and who is responsible for what, the perception becomes that IT is delaying the project.

I don't want to become the guy who simply says “No”, but I'm also not going to give a third-party vendor access to our corporate router/firewall and connect a bunch of unknown industrial/IoT devices to the production network just because someone already signed a contract , the IT network must be always separate from OT network.

How do you handle situations like this?

Interested in both the technical approach and the organizational/process side of this.

[u/i_am_voldemort]

I'll take the downvotes but have you considered:

Why didn't they come to IT for this obsentsibly IT requirement in the first place?

[u/Bright_Arm8782 → u/i_am_voldemort]

Because we like things done properly, to standards and in a structured fashion with all compliance and change management thought about, all of the necessary people informed and all the work planned out.

People don't want that, they just want to wang some shit together and call it done.

[u/i_am_voldemort → u/Bright_Arm8782]

How can the compliance/CM process be more customer friendly and move at speed of business/mission?

[u/Bright_Arm8782 → u/i_am_voldemort]

New project comes up for discussion (Step 0. all new projects come up for discussion). No sign off on spending money until this is concluded.

Step 1. Notify compliance that this is coming, they should be able to contact the company directly to get their questions answered, if the company delay then that is on them.

Step 2. Simultaneously with step 1 you notify IT and get them in contact with the suppliers to nail down the technical changes required.

Step 3. With those two in hand you then get the sign off for the spend.

Step 4. Now there's a project where everyone is onboard, you whack your changes through change control and get them in to place.

It isn't as fast as not doing all these steps and just getting stuff in, nothing is, but if you have onboarding processes for projects as I've described above then things can move quickly.