Quick answer: Start by establishing the impact: one user, several office devices, a business application, or equipment that may affect production. An IT helpdesk can log the ticket and check approved user, endpoint and IT services. If symptoms involve a PLC, SCADA, HMI, a control-connected MES component or an OT network, notify the OT owner or system integrator. Do not scan, patch, reboot or change industrial equipment or network settings on your own.
At a factory, the same “connection lost” message can come from an office laptop, Wi-Fi, a business server, a supplier link or part of a control environment. Treating every alert as an ordinary desktop issue can destroy useful evidence, expand impact or create risk for an active process. This is an incident classification and handover checklist, not an on-site safety procedure or authorization to operate control systems.
Initial classification: what is affected?
| Observed symptom | Possible area | First owner to contact | Initial action |
|---|---|---|---|
| One computer cannot sign in, print or open an office application | Endpoint, identity or IT application | IT helpdesk | Record user, asset, time, exact error and any recent change. |
| Several people in one area lose email, file or business-application access | LAN/Wi-Fi, server or business application | IT helpdesk and application owner | Identify locations and users affected, services that still work and start time. |
| HMI/SCADA, PLC, sensor or control equipment shows an alarm or abnormal state | OT / industrial control | On-duty operations lead and OT owner/integrator | Follow the site procedure; IT may record and coordinate but must not operate controls. |
| IT and OT applications are not exchanging data and control status is unclear | IT/OT interface or application dependency | Application owner with IT and OT leads | Preserve the current state and record confirmed dependencies; do not change firewall or VLAN settings. |
This table helps route an incident; it is not a diagnostic or control-system procedure. If ownership is unclear, treat it as a boundary that needs confirmation rather than assuming the asset is an office computer.
What to include in a factory incident ticket
- Time and location: shift, plant area, line or department using the site’s approved naming.
- Impact: one user or many, one asset or multiple areas, and the task reportedly delayed or stopped.
- Asset and system: asset tag, host name, application, vendor and owner, limited to identifiers the reporter may share.
- Exact symptom: permitted screenshots, error code, displayed state and action immediately before the issue.
- Recent changes: update, access change, network change, device replacement, maintenance or supplier work.
- Urgency: site-authorized personnel must assess safety, quality, environmental and production impact under local procedures. IT should not guess the safety level.
- Decision-maker and vendors: who can approve a shutdown, isolation, recovery or change, plus relevant OT, maintenance, application and integrator contacts.
Do not place passwords, one-time codes, sensitive personal information or detailed control/network diagrams in an unprotected ticket. Use company-approved storage and sharing channels.
A practical IT/OT handoff that avoids ticket ping-pong
- Use one intake point: record the incident, timestamp, reporter, impact and a safe callback method.
- Classify by asset and owner: endpoints, email, servers and office networks are commonly IT-owned; PLCs, HMIs, SCADA, control devices and cell/area networks need confirmation from the OT owner.
- Check only within approved access: helpdesk may perform authorized endpoint and IT checks. Do not scan, install agents, patch firmware, change routes/VLANs/firewalls, reboot equipment or connect USB media to OT without the system owner’s approval and plan.
- Transfer with acknowledgement: pass the ticket ID, impact, permitted evidence, actions taken and not taken, and receiving owner; confirm the receiving party has accepted ownership.
- Close with verified outcomes: record the confirmed cause, who approved the action, which service was tested and who confirmed normal operation. If the cause is unknown, say so instead of speculating.
CISA recommends IT/OT network segmentation and preparation for incident response and continuity of essential operations. NIST SP 800-82 Rev.3 describes OT’s distinct performance, reliability and safety requirements. Changes in OT therefore need the system owner, site change process and local risk assessment; a helpdesk checklist cannot replace those controls. See CISA ICS Recommended Practices, NIST SP 800-82 Rev.3 and the ISA/IEC 62443 series.
What not to do when the affected zone is unclear
- Do not reboot a PLC, HMI, industrial switch, control server or any asset whose owner the site has not identified.
- Do not run a network scan, install an agent, apply a patch or update firmware in OT just because an IT tool recommends it.
- Do not alter VLANs, routes, ACLs, firewalls or inter-zone connections as an experiment.
- Do not unplug/reconnect cables or attach USB or personal devices to a control network without authorization.
- Do not promise a recovery time, downtime reduction or specific SLA before assessing scope, shifts, vendor dependencies and the service agreement.
Prepare before the next incident
Maintain an asset-owner list, an approved high-level IT/OT boundary map, shift contact matrix, priority definitions, change approvals, vendor escalation contacts and an approved evidence repository. Rehearse handoffs using a tabletop scenario or an authorized test environment; do not create a live production disruption merely to test the helpdesk process.
Define helpdesk SLA terms clearly: coverage hours, intake channels, response time, priority rules, ticket updates, onsite conditions, vendor coverage and exclusions. Acknowledgement or response time is not the same as resolution time; define and report them separately using the actual agreement and operational data.
What can IT Systems support?
IT Systems provides business IT Support and Helpdesk for users and IT infrastructure according to a surveyed scope, authorized access and mutually agreed SLA. The factory must identify the owner of industrial control systems and engage an appropriate OT provider or integrator for control-system work. This article does not claim that IT Systems operates PLC/SCADA, repairs production lines or guarantees OT recovery times.
View IT Helpdesk services · View IT Support · Discuss your support scope
Frequently asked questions
Should an IT helpdesk directly operate a PLC or HMI?
Not by default. Only a site-authorized person or provider following the appropriate OT procedure should decide on control-system actions. The helpdesk should record, classify, route and support approved IT tasks.
Does a failed MES connection mean an OT fault?
Not necessarily. The cause may be the user device, IT network, server, application, integration point or an OT component. Check system ownership and dependencies, preserve evidence and avoid unapproved configuration changes.
What should a factory incident ticket contain?
Record time, location/shift, affected users and devices, application, exact error, recent changes, reported impact, authorized steps already taken and the next receiving owner. Never include passwords or sensitive data in an unprotected ticket.
Is SLA response time the same as resolution time?
No. Response is the provider’s acknowledgement and intake under the agreement. Resolution may depend on the cause, access, parts, other vendors, change windows and required approvals.
