OEE Software Security Assessment: 20 Questions to Ask Before Connecting to Your PLC Network

OEE software connects to your most sensitive operational technology, production PLCs, SCADA systems, and machine controllers, and sends that data to cloud infrastructure. This creates security exposure that most OEE evaluations underweight.

See our guide to CMMS implementation.

The Three Core OT Security Questions

• How does machine data travel from the OT network to the cloud? Any path requiring inbound connections from the internet to your OT network is a red flag.
• What happens if the cloud platform is compromised? Does that create a path into your OT environment?
• Who has access to your production data? Can vendor support engineers access your OEE data without your knowledge?

The Correct Architecture

Machine data should flow outbound only, through an edge device in a DMZ, with zero inbound connectivity from the cloud platform to the OT network. Verify this explicitly, don't accept verbal assurances.

• Does the platform require any inbound firewall rules from the internet to our OT network?
• What is the data flow path from machine to cloud, what initiates each connection?
• Does the edge device support network segmentation between OT and IT?

Cloud Security

• SOC 2 Type II report date, can we review it?
• Last third-party penetration test, summary of findings and remediation?
• Is production data encrypted in transit and at rest (AES-256 minimum)?
• Can vendor support access our data? Is access logged and auditable by us?
• Is our data logically isolated from other customers in the multi-tenant environment?

Incident Response

• Security incident notification SLA to customers?
• Documented process for production data breach scenarios?
• Does the vendor maintain cyber liability insurance?

Access Control

• SSO/SAML integration support for enterprise identity management?
• MFA available for all user roles including admin?
• Complete audit log of all user actions accessible to our administrators?

• Platform requires inbound firewall rules from internet to OT network
• No SOC 2 Type II certification or equivalent third-party security audit
• Unable to provide data flow architecture diagram
• No audit log of vendor access to customer data
• Security incident notification timeline exceeds 72 hours

Scoring Remaining Vendors

• 3 points. Evidence provided: SOC 2 report shared, architecture diagrams shown, pentest summary provided
• 1 point. Verbal assurance only: "Yes, we're secure" with no documentation
• 0 points. Cannot answer or deflects: Questions escalated to a "security team" that never follows up

Any vendor scoring below 24/30 on security (80%) should require a security review meeting with their CISO or equivalent before progressing to commercial evaluation. OEE security is not a checkbox, it's a gateway requirement for OT connectivity.