# Running a data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → audit: from policy to shop-floor proof
A plant manager in Ohio pulls up the MES (Manufacturing Execution System) dashboard and finds three years of operator login records still sitting in active storage, four years past the retention limit the company's own policy set. Nobody deleted them because nobody was assigned to check. That single gap, found during a routine audit, is exactly the kind of thing that turns a clean-looking governance policy into a real liability.
Data governanceData governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → policies read well in a boardroom deck. The real test is whether they survive contact with a shop floor running three shifts, three PLC (Programmable Logic Controller) vendors, and a contractor list that changes every quarter. An audit is how you find out before a regulator, a customer, or an attacker does.
Manufacturing data lives in more places than office data. You're auditing:
Each system has different owners, different retention rules, and often different vendors, some of them decades-old equipment never designed with data privacy in mind. A 2015 PLC controlling a stamping press was not built thinking about GDPR (General Data Protection Regulation, the EU's 2018 data privacy law).
You don't need to be a lawyer, but you need to know what an audit is checking against:
None of these tell you exactly how to run your plant. They set the bar. The audit is where you measure your plant against that bar.
Pick a random sample of MES records (say, 50 batches from the last two years). For each, check:
Worked example: Policy says badge-access logs are kept 180 days. You sample 50 records. 42 fall within 180 days. 8 are older, one is 14 months old. That's an 84% compliance rate on this sample, well below an acceptable threshold (most internal audit standards look for 95%+ before calling a control "effective"). The finding: retention deletion is not automated, it depends on someone remembering.
Fix pattern: automate deletion via a scheduled job rather than manual review, and log every deletion event for evidence.
This is where governance policy meets reality. Pull the role-based access control (RBAC) matrix, the document defining who should access what, and compare it against actual system logs.
Concretely:
1. Export the last 30 days of login events from the MES and SCADA historian.
2. Cross-reference each user against their assigned role (operator, quality engineer, maintenance contractor, plant IT).
3. Flag any access outside the defined role, e.g., a contractor account with write access to recipe parameters when their contract only authorized read-only diagnostics.
# Simplified access-audit logic (pseudocode)
for user in access_log:
role = role_registry.get(user.id)
if user.action not in role.permitted_actions:
flag_finding(user, role, user.action, timestamp)This kind of query is trivial once logs are centralized, but many plants still have PLC-level access that never reaches a central log at all, which is itself a finding worth writing up.
Tabletop exercise: assume an attacker has gained remote access to a PLC controlling a critical process (a furnace, a chemical mixer, a robotic weld cell). Time how long it takes the team to:
Real-world reference point: the 2021 Colonial PipelinePipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → ransomware incident (US) showed how operational technology (OT) and information technology (IT) can be tightly coupled in ways that turn an IT breach into a production shutdown. Manufacturing plants with poor IT/OT network segmentationsegmentationDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.View full definition → face the same exposure.
🎬 [VIDEO: "Industrial Control Systems Security Basics" - youtube.com/@CISAgov - CISA's overview of ICS/SCADA security fundamentals for critical infrastructure and manufacturing environments]
Knowledge check
1. The Ohio plant example (operator login records kept years past the retention limit) illustrates what kind of governance failure?
2. Why do manufacturing data governance audits tend to be more complex than typical office IT audits?
3. A company discovers that a 2015-era PLC controlling a stamping press logs operator IDs indefinitely with no way to configure automatic deletion. What is the most appropriate governance response?
4. Select ALL correct answers about why an audit is described as necessary to catch governance gaps 'before a regulator, a customer, or an attacker does.'
Select all the correct answers.
5. Select ALL correct answers about the challenges that make shop-floor systems distinct audit targets compared to standard office IT systems
Select all the correct answers.
An audit that produces a 40-page PDF nobody reads is worse than no audit. Structure findings so plant managers and compliance officers can act:
| Finding | Risk level | Evidence | Owner | Fix by |
|---|---|---|---|---|
| Badge logs retained 14 months past policy | Medium | Sample of 50 records, 8 non-compliant | Plant IT | Q2 |
| Contractor has write access beyond role | High | Access log cross-reference | Security lead | Immediate |
| Breach drill: 47 min to isolate segment (target: 15 min) | High | Drill timing log | OT security | Q1 |
Each row needs a named owner and a date. Governance audits fail in practice not because nobody finds problems, but because findings sit in a report with no accountable owner.
The ENISA (European Union Agency for Cybersecurity) industrial control systems guidance is a useful free reference for benchmarking OT-specific controls against EU expectations.