The controller PC with no image
It fails, and the only copy of a proprietary configuration fails with it. We image every machine PC before we touch anything else.
Manufacturing
Uptime on the floor, not just in the office
A machine PC running an operating system nobody supports is not a problem you patch away. It is a problem you isolate. We separate plant systems from office systems, keep ERP and labeling running, and respond on your shift schedule, not ours.
🛡 OT/IT Separation⏱ Shift-Aligned Support💰 Never Outsourced★ Family Owned
Overview
The computers that run your machines are not office computers
Treating a CNC controller like a laptop is how a shop loses a shift. The strategy is separation, not standardization.
Every plant we assess has at least one machine tied to a PC running an operating system that stopped receiving patches years ago. Sometimes it is a CNC controller, sometimes an inspection system, a laser marker, a test fixture or a press with a proprietary HMI. The vendor will not certify a newer OS, the software will not run on one, and replacing the machine costs six figures. Patching is not the answer. Isolation is: the machine goes on its own VLAN with firewall rules that permit only the traffic it genuinely needs, USB use is controlled, application allowlisting stops anything unexpected from executing, and no path exists from that segment to email or the internet.
That is the core of OT and IT separation. Office users, plant equipment, engineering workstations, cameras and building systems each belong on their own segment with explicit rules between them. Done properly, a phishing click in the front office cannot reach the shop floor, and a compromised machine cannot spread into finance. We build this with managed switching, VLANs and firewall policy under network administration, and we document the map so your maintenance team can read it.
Above the floor sits ERP. Epicor, Global Shop, JobBOSS, Made2Manage, Fishbowl and NetSuite are where job travelers, routings, inventory and costing live. When ERP is slow, every station feels it. We look at database server sizing, disk performance, the client-side path, and the integrations to shipping and CAD before anyone concludes that the software is just like that. Barcode and labeling deserve the same attention: Zebra industrial printers, BarTender or NiceLabel templates, and the print servers and network paths that break silently and stop shipping.
Shift schedules change how support works. If first shift starts at 5am, a 7am help desk is useless. We align monitoring and response with your actual production hours, schedule maintenance during planned downtime, and keep documented runbooks so a floor supervisor can perform the first three steps before we arrive. Spare configured PCs for critical stations turn a failure into a swap, and image-based recovery for those machines is part of our backup and recovery service.
If you supply defense primes, DFARS flow-downs put NIST SP 800-171 controls on any system touching controlled unclassified information. That work starts with knowing which drawings, shares and machines are actually in scope. We handle the technical implementation and evidence; the assessment itself belongs to your assessor. There is more at our manufacturing IT microsite.
You cannot patch a 1998 controller. You can make sure nothing can reach it.Orca IT, Gilbert AZ
What We Handle
The plant floor checklist
Written after walking a lot of shops in Chandler and Mesa.
Legacy machine PC isolation
Dedicated VLANs, explicit firewall rules, controlled USB, application allowlisting and full disk images so a dead controller PC restores instead of stopping production.
OT and IT segmentation
Office, engineering, plant equipment, cameras and building systems separated with documented rules between them, not one flat network.
ERP performance and support
Database server sizing, disk latency, client path and integration health for Epicor, Global Shop, JobBOSS, Made2Manage and similar systems.
Barcode and label infrastructure
Zebra industrial printers, label template management, print servers and the network paths that quietly break and stop shipments.
Industrial network hardware
DIN-rail switches, fiber between buildings, sealed enclosures, and cabling routed away from VFDs and welders that inject noise.
Shift-aligned response
Monitoring and support hours matched to your production schedule, with maintenance windows planned around actual downtime.
Failure Modes
Six ways a plant loses production to IT
Each one has cost a shop we have met real money.
Flat network, plant-wide outage
One infected office PC reaches the shop floor because everything shares a subnet. Segmentation stops it at the boundary.
The label printer that stopped
A driver update or an IP change halts outbound freight at 3pm. Monitored print paths catch it before the truck arrives.
Month-end takes six hours
Usually disk latency on the database server. We measure and fix the bottleneck instead of adding user licenses.
Switch in an unconditioned closet
Arizona heat and metal dust end network gear early. We relocate, filter or specify hardware rated for the space.
Nobody knows the network
The last person who understood the plant network left. We document it so knowledge does not walk out the door again.
Manufacturing IT questions
We have machines running Windows XP or 7. Do we have to replace them?
Not necessarily, and usually not immediately. Replacing production equipment because of an operating system is rarely the right economic call. Instead we isolate the machine on its own network segment, restrict what it can talk to, control removable media, and take a full disk image so a hardware failure becomes a restore rather than a shutdown.
What does OT and IT separation actually involve?
Managed switches, VLANs and firewall rules that define exactly which systems may communicate. Plant equipment gets no internet access and no path to email. Engineering workstations that need to push programs to machines get a controlled route. Everything is documented in a network diagram your maintenance team can actually use during a troubleshoot.
Can you support our ERP system?
We support the infrastructure it depends on and manage the vendor relationship for application issues. That covers database server sizing and tuning, disk performance, backup of the ERP database, client workstation configuration, terminal server or remote access, and the integrations to shipping, CAD and label printing that break most often.
Our shifts start at 5am. Will anyone answer?
We align coverage with production. Monitoring runs 24/7 and frequently opens a ticket before anyone on the floor notices. Pod Care clients get same-business-day human response as the standard and after-hours emergency response for outages that stop production. We do not claim staffed phones around the clock, because that would not be true.
A prime contractor is asking about NIST SP 800-171. Can you help?
Yes, on the technical side. We help identify which systems and shares hold controlled unclassified information, then implement access control, encryption, logging, media protection and configuration management for that scope, and produce the supporting evidence. The formal assessment and the system security plan ownership stay with your organization and your assessor.
How do you handle backups for machine and production systems?
Differently from office data. Machine PCs get full disk images because the value is in the configuration, not the files. ERP and file servers get application-aware backups with local and offsite copies and tested restores. Program files for CNC and inspection equipment get versioned storage, since an overwritten program is a common and expensive mistake.
Our network gear sits in a hot closet by the shop. Is that a problem?
Yes. Heat and airborne metal dust shorten the life of switches, firewalls and drives significantly, and Arizona summers make it worse. We relocate equipment into conditioned space where possible, use filtered or sealed enclosures where it is not, and specify industrial-rated hardware for locations that cannot be improved.
Can you help with a plant expansion or move?
Yes. Structured cabling and fiber runs between buildings, wireless coverage across the floor, machine drop placement, server and closet design, and a cutover plan that fits your production schedule. Planning this during construction avoids the far more expensive version where cable is pulled after equipment is installed.
Protect the line the way you protect the machines.
Book a free floor walk. You keep the inventory and the plan either way.
Talk to Your Pod
One stopped line costs more than a year of managed IT.
We will walk the floor, inventory every machine PC and network drop, and give you a written plan for isolating the systems you cannot patch.
(602) 677-0779Family owned in Gilbert, AZ since 2015 · onsite across the Phoenix metro · remote support nationwide · never outsourced
Same-day response
No long contracts
Flat, honest pricing
Five-star service
Get your free IT consultation
A few details and your pod gets right back to you, usually the same business day.