Iconium Network Logo Stack 2025
Book a Call

Industries

The line does not care that it is a Tuesday.

In an office, an outage costs a morning. On a production floor it costs a shift, and the cost is countable: units not made, a crew stood around, a delivery date that moves. Iconium keeps the systems behind the floor running, and keeps the office network away from the machines that should never have been on it.

Under 2 hrs
First response, business hours
24/7
Threat monitoring
$179
Per additional site, per month
$0
Trip charges

What actually goes wrong on a plant or a job site

Operational technology

  • A machine controller or HMI on the same flat network as the front office, reachable by anything that gets into email
  • Equipment running an operating system the vendor stopped patching years ago, which cannot simply be upgraded because the machine is the point
  • A vendor remote-support connection left permanently open because it was easier than arranging it each time

The rest of the business

  • The ERP or MRP system down, so nothing can be scheduled, shipped or invoiced
  • Wi-Fi that does not reach the far end of the shop, or drops between racking
  • A second location or a job-site trailer added with no real network behind it
  • Payment or supplier-change fraud, where the target is the accounts payable inbox rather than the machinery

Keeping the floor and the office apart

This is the single most valuable thing an IT provider does in a manufacturing environment, and it is the one most often skipped because the network already works.

Segmentation

Production equipment belongs on its own segment with controlled routes in and out. When ransomware arrives through an office mailbox, the question that decides your week is whether it could reach the controllers. On a flat network the answer is yes.

Equipment you cannot patch

Some machines run software that is frozen by the vendor, by validation, or by the simple fact that the machine costs more than the building. You do not fix that by patching it. You fix it by controlling what can talk to it, monitoring what does, and keeping a restore path for the systems around it.

Vendor access

Machine builders and integrators often need remote access, and an always-on tunnel is a standing risk. Access that is granted when needed, logged, and closed again is not harder to work with once it is set up.

Coverage where the work is

Wireless that works across a shop floor is an engineering problem, not a consumer access point. Onsite visits are included in the monthly rate, and additional locations are $179 per month per site rather than per device in them.

If you supply the defense industrial base

Contractors handling Federal Contract Information or Controlled Unclassified Information fall under the Cybersecurity Maturity Model Certification programme, alongside DFARS 252.204-7012. Where it currently stands matters, because the picture has moved:

What is in force

Phase 1 began on 10 November 2025 and remains in effect: self-assessment against the applicable level, with an annual affirmation. Level 1 covers Federal Contract Information and carries 15 security requirements. Level 2 covers Controlled Unclassified Information and maps to the 110 requirements in NIST SP 800-171 Revision 2.

What is paused

Implementation of Phase 2 was suspended on 13 July 2026 pending a review of the programme. Self-assessment obligations under Phase 1 were not suspended.

We will tell you what is actually required today rather than what a sales deck says is coming. If your contracts do not carry these clauses, you do not need any of this, and we will say so.

The 110 requirements in NIST SP 800-171 are, in large part, the same controls any well-run environment should have: access control, identification and authentication, audit and accountability, configuration management, incident response, media protection, and system and communications protection. The work is usually less about buying tools and more about documenting and evidencing what is running.

The controls we run

Network

  • Segmentation between production and business networks
  • Firewall management, wireless design and coverage across the floor
  • Controlled, logged vendor and remote access
  • Network documentation an auditor or an insurer will accept

Security

  • Managed detection and response, 24/7, independent of our support hours
  • Multi-factor authentication and identity hardening
  • Email security and quarantine, DNS and web content filtering, application allow-listing
  • Patch and vulnerability management, and dark web credential monitoring

Continuity

  • Backup verification and recovery testing for ERP, file and engineering data
  • Unlimited help desk with onsite included, because some of this needs hands on it

Planning

  • Quarterly technology planning, so disruptive work lands in a shutdown rather than mid-run
  • Vendor management across machine builders, ERP and connectivity
  • Audit evidence collection

Where our responsibility stops

  • We do not program, validate or maintain your production machinery. We manage the network and systems around it and work with the machine builder or integrator who does.
  • We do not issue CMMC certifications or assessments. Certification is a separate, independent function and a provider cannot both implement and assess.
  • Your ERP vendor keeps its own support obligations. We manage the environment it runs in.

What it costs

The same published rates: $163 per user, $19 per computer, $100 per server, $17 per mailbox and $179 per additional location, per month. A fully equipped seat is $199 all in. The per-site rate is worth noting in manufacturing: a second plant or a site trailer is charged per location, not per device inside it. See the pricing page.

We cover plants and sites across Northeast Ohio and the Greater Houston area.

Questions manufacturers ask us

More than you would think, and none of it involves touching the machine. The risk from an unpatchable system is a function of what can reach it and what it can reach. Put it on its own network segment, control the routes in and out, log what talks to it, and keep a tested restore path for the systems around it. That turns a machine that cannot be patched into a machine that is difficult to get to, which is the realistic goal.

Only if your contracts say so. It applies to contractors handling Federal Contract Information or Controlled Unclassified Information, and it arrives through contract clauses rather than as a general obligation. Check the flow-downs from your primes. If they are not there, you do not need it, and we will tell you that rather than selling you a readiness project.

Phase 1 began on 10 November 2025 and is in effect: self-assessment against the applicable level with an annual affirmation. Level 1 covers Federal Contract Information with 15 requirements; Level 2 covers Controlled Unclassified Information and maps to the 110 requirements in NIST SP 800-171 Revision 2. Implementation of Phase 2 was suspended on 13 July 2026 pending a review. Phase 1 obligations were not suspended. This has moved more than once, so verify it against your contracts rather than against any vendor’s marketing, including ours.

No, and no provider who implements your controls should. Assessment is a separate and independent function; a firm cannot credibly both build the environment and certify it. What we do is implement and document the controls, and produce the evidence an assessment or a self-assessment needs.

Your first location is included in the monthly rate and each additional site is $179 per month. That is charged per location rather than per device inside it, which is usually favourable for manufacturing, where a second plant might have a lot of connected equipment and very few users. It covers firewall management, network segmentation, wireless and the network documentation an auditor or insurer will ask for.

Both, and it is solvable. Shop-floor wireless is an engineering exercise rather than a matter of adding another consumer access point: racking, machinery and the building itself all absorb and reflect signal, and scanners and tablets are less forgiving than laptops. It needs a survey and a design, which is project work, and then it stays covered under the monthly rate.

The honest answer depends on whether your backups restore, which is a different question from whether they run. We verify and test restores rather than trusting a completed-job notification. Where the ERP is hosted by a vendor, we manage your connection to it and hold them to their obligations; where it is on your own server, it is ours to recover, and we will tell you in advance roughly how long that takes.

We plan for a clean handover, never withhold data or client intellectual property, and work with your incoming provider. In a manufacturing environment that also means handing over the network documentation and the vendor access arrangements, which is the part that usually goes missing. Onboarding takes about a week, with terms of twelve, twenty-four or thirty-six months and no setup fee.

Is your shop floor on the same network as your email?

Call (440) 991-9980 or book a thirty minute call. It is a quick thing to check and a bad thing to find out during an incident.

See also: every industry we serve and our written answers.

Browse all 111 questions we answer →