The machine phones home. The spec doesn't.

Here is an uncomfortable observation. SANS now counts OT incidents at a third of industrial organisations, and CISA has stood up an Installed Base Program that asks OEMs to identify internet-exposed OT assets – because the asset owners cannot answer the question for themselves. Read that twice. A government agency is asking the people who build the machines to tell the people who own them what is reachable from the internet inside their own plants. Almost none of those doors were forced. They shipped with the machine, enabled at the factory and waved through at acceptance.

I learned that the hard way on a greenfield automotive build – 900-plus employees, a QA/QC department built from zero. For weeks I signed equipment acceptance protocols. Cycle time, repeatability, guarding, interlocks: all evidenced, all witnessed. Not one protocol asked a single question about what the machine was doing on the network.

How the machine arrives

A modern press, CMM or cell controller does not arrive as a machine. It arrives as a network node that happens to make parts. The HMI ships with vendor defaults: admin accounts nobody rotates, ports open for legacy protocols your OT team has never heard of. The service package pre-loads a remote-access client so the OEM's engineers can diagnose faults without a site visit. Then cloud telemetry for "predictive maintenance", and sometimes a cellular gateway quietly bolted into the cabinet – your firewall never sees it. The machine has its own subscription.

And the most exposed interface in the first week of commissioning is not the HMI at all. It is the service engineer's laptop, which has been on hotel Wi-Fi in four countries since the factory acceptance test.

Acceptance is where it stings. We measured cycle time to the tenth of a second, ran repeatability studies, tripped every interlock and demanded capability figures on the first thirty parts. I have led quality across a 2,000-plus, multi-site workforce; I know what a proper gate looks like. The mechanical and process sides were audited to death. The network stack was invisible – not because anyone approved it, but because no document existed that could have rejected it.

The purchasing spec is a control plan

Quality people already own the solution; we simply refuse to recognise it. A coil of steel without a mill certificate is a rejected lot – no negotiation, no sentiment. PPAP exists because we do not accept supplier claims about characteristics; we demand evidence. Yet a €2.5 million press with an undocumented modem and factory credentials on the controller rolls through goods-in without a single characteristic checked. That is not an IT gap. It is an incoming-inspection gap wearing an IT costume.

The fix is an annex to the purchase order that treats shipped security configuration as an incoming characteristic, evidenced like any other:

• Network documentation – every port, service, protocol and external dependency, as-built, in writing.
• Credential handover – unique accounts, changed at handover, witnessed and countersigned.
• Firmware baseline – versions and hashes recorded, plus the vendor's patch-delivery commitment.
• A remote-access register – who can dial in, through what, under whose approval, revoked at contract end.
• Declared telemetry – every cloud connection named, with a data map and an opt-out.

Here my two careers collide, and the collision is the point. I hold a CEH and thirty-odd security certifications, and a clickjacking exposure I reported through responsible disclosure sits on T-Mobile's public Hall of Fame. So when a vendor datasheet says secure by default, I read it exactly the way I read an MSA study quoting a %GRR figure with no raw data behind it: a claim, not evidence. PPAP was invented to kill that class of claim on the material side. It works on machines too.

Whatever the purchase order tolerates, the network inherits.

Acceptance is the last gate you will get

The signature matters because afterwards your negotiating position is gone. The service contract activates remote dial-in to meet response-time SLAs, and any later lockdown becomes a €40,000 change order, a revalidation study and a weekend of planned downtime on a line that costs five figures an hour. CISA's Installed Base Program is, at heart, an admission that a generation of acceptance signatures skipped this paragraph. Now it is being remediated by federal request instead of purchase order.

So make the gate do the work. Add a network section to the FAT and SAT protocols and sign it with the same weight as a Cpk result: a port scan run from the plant side, not the vendor's laptop; default credentials verified changed in front of a witness; remote access disabled or registered; PLC and HMI programs backed up and archived. If the OEM cannot produce the network documentation, treat it precisely like a missing PPAP element – milestone on hold, deviation raised, 8D opened. Suppliers respond to payment gates. In two decades I have never seen one respond to an IT memo.

Applied to defect cost, that same gating discipline bought a 70% reduction on one greenfield launch. The craft is identical: catch it at the gate, not in the field.

None of this makes OT security someone else's problem. It moves it to incoming materials, where the tooling already exists. OT exposure belongs in the purchasing spec, gets verified with the same suspicion as hardness or torque, and lives or dies at machine acceptance. The next machine you buy will phone home either way. The only question worth asking at the gate is whether your purchase order says to whom, on which port, and with whose credentials.