Zero Trust Architecture for Manufacturing IT and ERP
Zero trust architecture is a security model that removes implicit trust based on network location and instead verifies every access request using identity, device posture, and context. NIST SP 800-207 defines the reference model, and CISA's Zero Trust Maturity Model organizes it into five pillars: identity, devices, networks, applications and workloads, and data. Manufacturing is a harder environment than a software company, because a PLC cannot run an agent and a press cannot be re-authenticated mid-cycle. This guide explains how to apply zero trust to ERP and enterprise systems while handling operational technology realistically.
Zero Trust Principles Applied to ERP Access
In a traditional design, being on the corporate network is enough to reach the SyteLine or LN application server. Zero trust replaces that with per-session evaluation: who is the user, is the device managed and healthy, is the request consistent with normal behavior, and is the requested privilege minimal. Practically for ERP, that means federated identity through Infor Federation Services or Entra ID, phishing-resistant MFA such as FIDO2 security keys for finance and administrative roles, conditional access policies that block unmanaged devices from privileged functions, and just-in-time elevation instead of standing administrator rights. The ERP becomes a protected application behind a policy enforcement point rather than an open server on a trusted VLAN.
- Federate all ERP authentication to one identity provider and eliminate local ERP passwords
- Require FIDO2 or certificate-based MFA for administrator, finance, and remote access to production ERP
- Apply conditional access rules for device compliance, location, and risk score before granting ERP sessions
- Replace standing privileged accounts with just-in-time elevation that expires automatically after each task
Replacing VPN with ZTNA Without Breaking the Plant
Full-tunnel VPN gives a contractor laptop the same network reach as an engineering workstation, which is the opposite of zero trust. Zero trust network access publishes specific applications to specific identities, so a machine builder reaches one HMI and nothing else. Migrate in a sequence: start with third-party and contractor access where the risk is highest and the user count is lowest, then remote employees, then site-to-site links. Keep the legacy VPN available during transition, because a plant that cannot ship at 6 a.m. will not tolerate an identity outage. Expect three to six months for a mid-size manufacturer to retire general-purpose VPN entirely.
Microsegmentation and the OT Boundary
Zero trust says never trust the network, but plant floor devices often cannot authenticate at all. The workable compromise is to treat operational technology zones as protected surfaces defined by IEC 62443 and enforce zero trust rigorously at their boundaries and for anyone accessing them. Every engineer, integrator, or application reaching into an OT zone is verified, authorized to a single asset, and recorded. Inside the zone, protection comes from segmentation and allow-listing rather than per-device identity. Avoid vendor claims about zero trust on the shop floor that require agents on controllers; those projects stall and consume budget that segmentation would have used better.
- Define protected surfaces around production cells, the ERP, the historian, and engineering data repositories
- Verify identity and device posture for every human or application entering an OT zone, with session recording
- Use allow-listed east-west rules inside OT zones instead of attempting agent-based identity on controllers
- Instrument the boundary with passive monitoring so policy violations are detected, not just blocked
A Realistic Zero Trust Roadmap and What It Costs
Zero trust is a program, not a product, and any vendor selling it as a single purchase is selling something else. A workable 18 to 24 month sequence for a manufacturer is: consolidate identity and enforce MFA everywhere in months one to four, remove standing privilege and implement just-in-time elevation in months three to eight, deploy device compliance and endpoint detection in months six to twelve, move third-party and remote access to ZTNA in months nine to fifteen, then segment and instrument the OT boundary through month 24. Sequence by risk reduction per dollar. Identity and privileged access consistently deliver the largest reduction for the smallest spend.
How Netray Delivers Zero Trust Around Infor ERP
Netray implements the parts of zero trust that touch the ERP, which is where generalist security firms lose momentum. We federate SyteLine, LN, or M3 authentication to your identity provider, design conditional access policies that match real manufacturing job roles including shift and shop floor kiosk usage, convert standing administrator access into just-in-time elevation, and scope every integration identity to the minimum IDOs or sessions it needs. Our AI agents then monitor for policy drift and privilege creep continuously. A typical first phase reaches full MFA coverage and eliminates shared ERP administrator accounts within 90 days.
Frequently Asked Questions
What is zero trust architecture in manufacturing?
Zero trust in manufacturing means no user, device, or application is trusted because of where it sits on the network. Every request to reach ERP, MES, engineering data, or a production cell is verified against identity, device health, and context, and granted the least privilege needed. Because plant controllers cannot authenticate themselves, zero trust is enforced at zone boundaries while segmentation and allow-listing protect inside the zone.
Can zero trust work with legacy plant equipment?
Yes, if you apply it at the boundary rather than to the device. Legacy PLCs, HMIs, and CNC controllers cannot run agents or support modern authentication, so you place them in tightly segmented zones with allow-listed communication and enforce strict identity verification, least privilege, and session recording for anyone or anything entering that zone. This satisfies zero trust intent without replacing equipment.
Where should a manufacturer start with zero trust?
Start with identity, because it delivers the largest risk reduction per dollar. Consolidate authentication into one provider, enforce phishing-resistant MFA on all remote and administrative access, remove standing privileged accounts in favor of just-in-time elevation, and eliminate shared logins. Only then move to device compliance, application-level access replacing VPN, and network microsegmentation. Starting with network projects first is the most common way these programs stall.
Key Takeaways
- 1Zero Trust Principles Applied to ERP Access: In a traditional design, being on the corporate network is enough to reach the SyteLine or LN application server. Zero trust replaces that with per-session evaluation: who is the user, is the device managed and healthy, is the request consistent with normal behavior, and is the requested privilege minimal.
- 2Replacing VPN with ZTNA Without Breaking the Plant: Full-tunnel VPN gives a contractor laptop the same network reach as an engineering workstation, which is the opposite of zero trust. Zero trust network access publishes specific applications to specific identities, so a machine builder reaches one HMI and nothing else.
- 3Microsegmentation and the OT Boundary: Zero trust says never trust the network, but plant floor devices often cannot authenticate at all. The workable compromise is to treat operational technology zones as protected surfaces defined by IEC 62443 and enforce zero trust rigorously at their boundaries and for anyone accessing them.
Put this into numbers
Free interactive tools for exactly this problem. No signup to use them.
ERP Security Posture Checklist
Work through 30 concrete security controls across access, patching, network, data protection, and monitoring, with the highest-risk items flagged.
Free ToolS&OP Maturity Assessment
Assess your sales and operations planning process across cadence, data quality, scenario capability, and accountability, and get a staged roadmap to the next maturity level.
Free ToolCycle Time & Capacity Calculator
Translate cycle time, parallel stations, shift pattern, and realistic utilization into hourly, daily, and annual production capacity.
Terms used in this article
Build a zero trust roadmap that fits a plant floor reality and start with the ERP identity controls that cut the most risk first.
Related Resources
OT/IT Convergence Security in Manufacturing
OT/IT convergence security for manufacturers: segment the Purdue model, secure MES to ERP data flows, apply IEC 62443 zones, and monitor plant networks safely.
ERPERP Security Best Practices for Manufacturers
ERP security best practices for manufacturers: harden Infor SyteLine and LN with least privilege, MFA, patching, encryption, and audit-ready access controls.
ERPThird-Party Risk Management for ERP Vendors
Third-party risk management for ERP vendors: assess hosting partners and consultants, read SOC 2 reports, control remote access, and write contract clauses.