Manufacturing IT Readiness Scorecard

You’re never sure what will break next. Outages surprise the floor; nobody owns root cause. Operators wait while IT “looks into it.” Downtime is accepted as the cost of doing business.

You recover from most failures, but it’s scramble mode. Monitoring is patchy. You find out from the shop before the dashboard. Same issues recur every few months.

Critical systems are monitored; you usually know before the floor does. Planned maintenance windows exist. Post-mortems happen. Uptime is measurable and trending up.

Uptime is a managed outcome — SLAs, redundancy where it pays, and a clear “who does what” when something fails. The plant trusts IT the way it trusts utilities.

ERP feels fragile. Slow screens, mystery permissions, and “don’t touch that server.” Your VAR and IT blame each other when jobs stall. Plant decisions wait on workarounds.

ERP mostly runs, but infrastructure is afterthought. Backups of the app exist; recovery time is a guess. Remote access is a VPN prayer. Peak weeks expose every weak link.

Networks, identity, and servers are shaped around how inventory, MRP, and accounting actually run. You and the VAR have clear lanes. Performance issues get diagnosed, not shrugged at.

ERP is the trusted spine: stable connectivity, sane access, tested recovery, and cloud/remote paths that don’t open the plant. Ops and finance stop treating IT as the bottleneck.

Paper prints rule the floor. Binders go stale. “Current” files live in three folders and someone’s laptop. Scrap and rework trace back to wrong revisions more often than anyone admits.

There’s a network share and a naming convention — until people ignore it. Email and USB still move drawings. Finding the right PDF is a scavenger hunt under deadline pressure.

Approved revisions have a home. Access is controlled enough for audits. The floor can usually get the right drawing without calling engineering twice. Paper is declining, not growing.

Job, traveler, or machine → scan → current approved revision. Drawings are findable, controlled, and at the machine. Wrong-print scrap is a rare exception, not a monthly story.

Backups are hoped for, not verified. Nobody can say RTO/RPO in one sentence. A restore test would be a project. Ransomware or a dead server would stop the plant cold.

Jobs run on a schedule, but restores are rare and scary. Offsite copies may exist. You’ve never timed a full recovery. Leadership assumes “we’re backed up” without proof.

Critical systems have documented backup jobs and periodic restore tests. You can explain recovery to a COO. Gaps are known and prioritized — not invisible.

Verified backups, tested restores, and a recovery path matched to plant reality. You know what comes back in hours vs days — and you’ve practiced it before the worst day.

Shared logins, sticky notes, flat networks, and “that PC by the CNC never gets updated.” USB drives wander. You’d rather not know what an auditor would find in week one.

Office side is okay; floor is the wild west. Patches lag. MFA is partial. Segmentation is a slide, not a config. Incidents get handled — after they hurt.

Endpoints and identities are managed; privileged access is limited. Floor machines have a hardening path. Phishing and patch cadence are real programs, not annual lectures.

Shop-floor cyber matches how the plant actually works: protected without freezing production. Identity, endpoints, and network boundaries are deliberate — and evidence exists when buyers ask.

Ticket roulette. After-hours means whoever answers. Different techs reinvent the plant every call. You pay by the hour for firefighting you already paid for last month.

There’s a helpdesk, but context walks out with each ticket. SLAs are soft. You’re the escalation path for anything ERP or shop-floor related. Costs spike when things break.

One accountable partner (or strong internal lead) with plant context. Issues get closed with root cause, not band-aids. You’re not the after-hours helpdesk for your own company.

Fixed-fee managed IT with manufacturing fluency: proactive work, unlimited support flavor, and someone who already knows your ERP, drawings, and compliance story. Surprises are rare.

ISO / ITAR / CMMC are someone else’s problem until a customer or letter arrives. Policies live in a binder nobody opens. Evidence would take weeks to invent under pressure.

You’re aware of the frameworks. Gaps are known in conversation, not in a living register. Last audit was painful. Next one will be too unless something changes this quarter.

You can map controls to how the plant runs. Evidence habits exist for the areas buyers care about. Remediations have owners. You’re preparing, not panicking.

Compliance posture is a sales and ops asset: scoped clearly, maintained continuously, and explained in plant language. Auditors and primes hear the same story IT lives every day.

AI and modern tools feel like vendor demos. You’re still drowning in email, tribal knowledge, and manual lookups. “Innovation” means another login nobody uses after week two.

You’ve tried a chatbot or pilot. It didn’t stick to the floor. Document search is still Ctrl+F across shares. Automation is aspirational; fire drills still win the week.

You’re selectively using AI and workflow tools where they cut search time and handoffs — on systems you trust. Ops leads can name two wins that saved real hours.

Modern tools are embedded in ops: faster answers, fewer scavenger hunts, assistants that know your docs and processes. Tech multiplies the plant — it isn’t a toy SKU on a slide.