A bioreactor arrives at a plant with a controller inside it built by a different company, and that controller may reach out to a server its new owner has never heard of. The FDA puts that problem at the center of its June 2025 white paper on securing the operational technology (OT) used to make medical products. A manufacturer cannot secure a production network, the agency argues, until it knows what is on that network and what each device is saying.
Most plants cannot say what their machines are saying
The stakes are set early in the paper. The FDA regulates more than $3.6 trillion worth of food, tobacco and medical products, about 21 cents of every dollar US consumers spend. If a manufacturer or another link in that supply chain is compromised, the agency writes, the health of thousands or millions of patients could be affected.
Industrial equipment was not built for that threat. Programmable logic controllers, remote terminal units and distributed control systems often run for months or years in harsh conditions, and their designers prioritized consistent function over security. They did not expect to sit on networks that are always connected and reachable from the internet.
The paper names 2 problems that follow.
- Lack of visibility. Control devices are often embedded inside other equipment. A chromatography system, a bioreactor or an annealing furnace may carry automation hardware from another manufacturer, so plants often lack an accurate list of what is on the network and how each device communicates.
- Lack of control. Equipment assumes some connectivity once it is plugged in. It may exchange data with related devices or call a home server to check for updates. Those connections are not always disclosed to the buyer, and when they are, the buyer may not be able to change them.
The FDA’s suggested starting point is a hardware bill of materials and a software bill of materials (SBOM) from the vendor. The paper goes further than most SBOM discussions and says an SBOM should summarize the frequency and volume of a component’s communications, along with the infrastructure it needs. For medical device makers, an SBOM is already a legal requirement under 21 U.S.C. § 360n-2(b)(3), added by the Consolidated Appropriations Act of 2023. For drug and biologic plants, it is a recommendation.
A plant that cannot list what each machine talks to has not started securing it yet. It has started guessing.
Zones and conduits keep a breach on one line
Once the inventory exists, the paper recommends arranging assets on the network to contain damage. It points to ISA-95/IEC 62264, which dates to the 1990s, as the baseline for enterprise architecture, and to ISA-99/IEC 62443 for connected industrial networks.
The model is simple to state. A zone is a group of assets with common security requirements. Conduits are the only permitted paths between zones. Under least privilege, an asset talks to its own zone and reaches anything else only through a conduit with a defined policy.
The FDA’s example is a facility with several fill-finish lines. Equipment on one line has no reason to talk to equipment on another, though product and capacity data may need to pass between them. Give each line its own zone and a narrow conduit, and a compromised machine on line 1 stays a line 1 problem. The paper adds that segmentation also improves network performance compared with a flat network where every device shares the same bandwidth.
Inside each zone, the FDA describes a 3-tier structure. The presentation tier handles the user interface, the application tier runs business logic, and the data tier stores persistent records. Isolating the tiers lets separate teams update or secure one without touching the others.
What the FDA learned running its own line
The agency’s demonstration line includes software for manufacturing execution, operations and lifecycle management. It makes no products. Its purpose is research, and it had to pass the same rules as any federal system, including FIPS 140-2 and 140-3, NIST SP 800-82, CISA guidelines and strict network routing requirements.
Many commercial off-the-shelf products did not comply out of the box and needed reconfiguration. The paper acknowledges the pull toward exceptions and permissive firewall rules in the short term, then calls that an unacceptable long-term risk for government networks and medical plants alike. Its practical lessons read as a deployment checklist.
- Map traffic before deployment. Vendor and manufacturer OT specialists should agree on how traffic will move within zones, between zones and outside the plant. If the network allows external traffic on a single port, the vendor’s software has to use that port, even when it does not by default.
- Hold temporary staff to permanent standards. Integrators and vendor personnel need privileged access during installation. The paper calls for automatic, confirmed removal of those accounts when the work ends, because legacy accounts and passwords are easy ways in.
- Scan, do not just read the documentation. Federal systems go through an Authorization to Operate, which pairs document review with network inspection. Third-party firmware that quietly tries to call out may not appear in an initial communications map, but it shows up in a scan.
- Review changes on shared resources. A change control board can catch a proposed change that would break another team’s system before it ships.
- Ask vendors for what is missing. Vendors may not know which security features customers want until enough of them ask, and requesting conformance to federal or consensus standards gives that request a shape.
Security and ease of use are both patient safety questions
The paper does not argue for maximum security at any cost. It says overemphasizing either security or ease of use can harm public health, patient access to care and pandemic preparedness. Its proposed method is risk based, which means mapping hazards, fixing what matters and monitoring continuously.
The incidents it cites show why the balance tilts toward discipline. The NotPetya attack in 2017 hit Merck & Co, the shipping company Maersk and a Pennsylvania hospital system, and the White House estimated its cost at about $10 billion at the time. The CrowdStrike outage on July 19, 2024 was not an attack at all. A flawed update caused at least $5 billion in direct losses over 4 days, according to the estimate the FDA cites, and the agency uses it to argue for rigorous testing in multiple environments before release.
The FDA’s own line is the paper’s strongest evidence. It runs a digitally integrated manufacturing line inside a federal network under federal rules, which shows the controls are workable for a small manufacturer. The harder part for industry is asking every vendor on the floor to say plainly what its equipment does.