Know the architecture
Maintain an inventory of MES servers, clients, databases, gateways, interfaces, service accounts and remote-access paths.
Segment by function and trust
Do not expose MES or plant interfaces broadly to enterprise or internet networks. Use controlled network zones and approved communication paths appropriate to the plant architecture.
Manage identity
Use unique accounts, role-based access and managed service identities. Remove stale vendor and shared accounts where operationally feasible.
Patch with validation
MES depends on operating systems, databases, runtimes and connectors. Patch planning should consider vendor support, testing, production windows and rollback.
Back up for recovery
Recovery may require databases, configuration, certificates, interface definitions, scripts and deployment artifacts—not just a nightly database dump.
NIST guidance
NIST SP 800‑82 Rev. 3 is the current final Guide to Operational Technology Security. NIST opened pre-draft work for Revision 4 in January 2026, so Rev. 4 should not yet be cited as a final standard.