Factory IT Helpdesk: Segregating office IT support and production systems
In a manufacturing environment, a computer incident does not always affect just one employee. A disconnected warehouse workstation, a halted label printer, or an inaccessible operational computer application can disrupt an entire factory process. Therefore, a factory IT Helpdesk needs to be organized differently from a standard office IT support model.
The key point is not that the Helpdesk team can fix every device, but rather clearly defining the support scope, the responsibilities between IT and OT, the shift-based service hours, and the escalation mechanism when incidents involve production systems.
For businesses considering outsourcing, clarifying these factors from the beginning helps select the appropriate service model, avoids responsibility gaps, and limits unauthorized technical operations.
How does factory IT Helpdesk differ from office IT support?
In an office enterprise, the Helpdesk usually focuses on computers, accounts, software, emails, printers, and network connections. When an employee encounters an error, the support department can check remotely or directly to restore working capabilities.
A factory has a more complex operational scope. Users do not only work in offices but are also distributed across raw material warehouses, quality control (QA/QC) departments, packaging areas, and workshops.
Each area has different support requirements:
Office block: Computers, accounts, emails, software, and network connections.
Warehouse and logistics: Warehouse computers, barcode scanners, label printers, and endpoints.
QA/QC: Workstations, quality management applications, and data connections.
Production area: Operational computers, endpoints, and systems that may relate to the assembly line.
Multiple factories or branches: Need to unify the focal point for receiving, classifying, and escalating incidents across locations.
A significant difference is that an IT device might be part of the production process without directly controlling the machinery. For instance, a computer used to input production yield data can be supported like a normal endpoint, but a computer running software that communicates with an industrial controller needs to be managed under a separate procedure.
Additionally, many factories operate on two or three shifts, whereas an office Helpdesk is typically designed for business hours.
Therefore, the factory Helpdesk model must be defined by users, locations, systems, and operating hours, rather than solely relying on the total number of computers.
Businesses can refer to more about the role and scope of work of IT Support before determining the specific support requirements of a manufacturing environment.
The IT/OT boundary: How far can the Helpdesk handle?
Distinguishing IT and OT responsibilities in the factory
Information Technology (IT) refers to information technology systems that serve data processing, connectivity, application management, and user support.
Operational Technology (OT) includes technologies that monitor or control devices, processes, and physical operations. In a factory, OT systems may involve PLC, HMI, SCADA, and industrial controllers.
The difference lies not only in the type of device but also in the impact of technical operations.
For an office computer, restarting the operating system can be a standard troubleshooting step. But restarting an HMI computer or altering connections between control components can affect the monitoring and operational capabilities of the assembly line.
According to NIST SP 800-82 Rev. 3 — Guide to Operational Technology (OT) Security, OT systems have specific requirements for performance, reliability, and safety. Thus, applying standard IT management measures to OT must be evaluated based on actual operating conditions.
On September 21, 2026, NIST also released the draft SP 800-82 Rev. 4, expanding guidelines on risk management and protecting OT environments. As of October 2026, this is still a draft for public comment, not the final version replacing Rev. 3.
Defining the scope of IT/OT support
For manufacturing IT support services, businesses should define responsibilities by individual systems and granted intervention rights.
Situation | IT Helpdesk role | Specialized processing unit |
An employee cannot log into the computer | Check the account, device, and connection within the authorized scope | Internal IT or system administrator |
The label printer in the warehouse is not working | Check the printer, connection, and print queue | Application or device vendor if the error relates to integration |
The operational computer loses connection to MES | Gather information, check permitted IT components | MES application team, IT/OT, or relevant vendor |
The HMI cannot communicate with the PLC | Receive, record impacts, and escalate | OT/Automation or machine provider |
SCADA generates abnormal alerts | Record and notify the correct point of contact | OT team or SCADA expert |
The assembly line network connection is interrupted | Assist in isolating information within the permitted scope | IT/OT network system owner and relevant experts |
*The table is a reference responsibility segregation model. The actual scope needs to be agreed upon in the contract and operating procedures of each factory.
An important principle is that the IT Helpdesk does not automatically have the right to intervene in OT systems. Tasks such as changing PLC logic, configuring SCADA, restarting control devices, or updating industrial software must be performed by personnel with the appropriate expertise and authority.
Even if a Helpdesk technician is capable of executing an operation, the authorization to perform it still depends on the approval process and factory safety requirements.
This is especially crucial at IT/OT intersection points, where the same incident could involve the enterprise network, application servers, and operational devices.
Organizing IT Helpdesk by shifts and multiple factory zones
A factory may operate continuously while the internal IT team only works during business hours. If an incident arises during the night shift, the lack of a clear focal point for reception can prolong waiting times and cause information to be lost between shifts.
When structuring the service scope, businesses need to distinguish three elements: request reception time, response time, and the ability to deploy handling personnel.
For example, a Helpdesk unit can provide an after-hours reception channel but this does not mean there are always Onsite technicians at the factory. Similarly, a fast response SLA does not mean all errors will be resolved within the same timeframe.
To define support needs, the IT Manager should clarify:
How many work shifts does the factory have, and which shifts need support?
Which areas continue to operate at night or on days off?
Which incidents can be handled Remote and which situations require Onsite?
Who has the authority to confirm the priority level of an incident?
How are incomplete tickets handed over between shifts?
For instance, a software error on an administrative computer can be handled on the next working day, whereas a login error on a device serving goods dispatch may need to be prioritized if it affects warehouse operations.
Classification must be based on actual business impact, not just the device name or the self-assessed urgency level by the person reporting the error.
Metrics such as response time, progress update time, and escalation responsibilities need to be specified in the SLA. Businesses can learn more deeply about IT Helpdesk SLA and how to manage support quality.
For factories, Helpdesk SLAs must be distinguished from commitments regarding the operational capacity of the production line. A Helpdesk unit cannot guarantee the recovery time for a system outside its control scope or technical authority.
When an incident involves production machines, how does IT Helpdesk coordinate with vendors?
Many systems in a factory are deployed and maintained by different vendors. A single assembly line might use control devices from one OEM, SCADA software from another unit, and an MES system provided by an integration partner.
Therefore, not every incident occurring in the production area can be resolved by a single Helpdesk team.
An effective coordination mechanism needs to clearly define the role of each party:
IT Helpdesk: Receives requests, logs symptoms, gathers initial information, and routes the ticket to the correct point of contact. If assigned, the Helpdesk continues to track the status and update information for users.
Internal IT: Manages IT components within the scope of responsibility, coordinates to check infrastructure or applications, and confirms relevant technical changes.
OT/Automation team: Assesses incidents related to control systems, evaluates the impact on operations, and decides on actions appropriate to safety requirements.
Machine vendor or solution provider: Diagnoses and handles components within their technical support or warranty scope.
An example of the escalation process
Suppose an operational computer fails to display data from the production system.
First, the Helpdesk records the time the error occurred, the affected device, the error message, and the status of related devices. If permitted, the technician can check the connection status of the computer or related IT services.
Upon discovering the incident likely resides in SCADA, PLC, or industrial communications, the Helpdesk escalates to the OT team or the respective vendor. Deep inspections and configuration changes are only performed according to the factory's approval process.
In this model, escalation does not mean the end of coordination responsibility. The Helpdesk can still track the ticket, update progress, and synthesize information, if those activities fall within the agreed service scope.
Businesses that already have an internal IT department can also use an outsourced Helpdesk to receive and handle daily requests, while retaining administrative rights over critical systems. This organizational approach relates directly to the problem of outsourcing IT or maintaining an internal IT team.
How should remote access to the factory environment be controlled?
Remote support helps the Helpdesk team approach multiple requests without having to travel to each area. However, Remote access rights to office computers and access rights to OT systems should not be managed identically.
For standard IT devices, technicians can use remote support tools approved by the business to check and handle incidents.
Conversely, remote access into industrial control systems can create risks if access privileges are too broad, accounts are unmanaged, or sessions occur without appropriate supervision.
Following NIST's orientation on OT security, control measures must be selected to align with the operational, reliability, and safety requirements of the system. The draft NIST SP 800-82 Rev. 4, released on September 21, 2026, also expands guidelines on the architecture for protecting system administration functions and Zero Trust principles.
When hiring an IT Helpdesk, the factory should agree on fundamental requirements for remote access:
Only grant access rights to systems within the support scope.
Use distinct identity accounts, appropriate authentication, and the minimum necessary privileges.
Require separate approval for access sessions into the OT environment.
Log activities, monitor access sessions when necessary, and maintain the ability to revoke rights.
Do not use remote access rights as an excuse to bypass the change management process.
For sensitive systems, businesses can consider the option of accessing through a controlled intermediary point, in accordance with the factory's architecture and safety policies.
One principle must remain clear: Having remote connection rights does not equate to having system alteration rights. Operations that affect machinery, assembly lines, or industrial activities still require approval from the authorized system owner.
Major incident: Who coordinates when an incident affects production?
A Major incident is an occurrence with a severe level of impact, requiring a coordination mechanism and processing priority higher than the standard ticket procedure.
In a factory, this situation can arise when multiple endpoints simultaneously lose connection, a critical application fails to serve production operations, or an infrastructure failure affects multiple workshops.
However, not all incidents impacting production automatically fall under the Helpdesk's handling authority.
The major incident coordination procedure should be divided into steps:
Step 1 – Reception and impact identification: The Helpdesk records the area, system, number of affected users, and the reported severity of disruption.
Step 2 – Activate escalation: Based on agreed criteria, the Helpdesk notifies the IT Manager, Plant Operations, the OT team, and related vendors.
Step 3 – Assessment and handling: The system owner along with authorized experts determine the recovery plan. Any operation related to control devices must comply with safety requirements and the approval process.
Step 4 – Information update: The coordination point of contact announces the status, ongoing activities, and unresolved dependencies.
Step 5 – Recovery confirmation and post-incident evaluation: The authorized operational department confirms appropriate operating conditions before closing a production-related incident.
In situations directly involving safety, the response procedures and decisions of the personnel responsible for operations must take precedence. The Helpdesk does not arbitrarily restart control devices or alter configurations merely to achieve ticket resolution time.
The value of the Helpdesk in a major incident lies in consistent reception, information coordination, and support within the exact scope; not replacing the incident commander or OT experts.
What should businesses clarify before hiring a factory IT Helpdesk?
When evaluating providers, the question should not simply be the support cost per employee or per computer. Two factories with the same number of users may still require vastly different service models if the number of operational shifts, locations, and levels of dependency on production systems are not the same.
Before requesting a quote, businesses should clarify six groups of information.
User scale and location
It is necessary to determine the total number of users, computers, endpoints, and locations requiring support. Simultaneously, distinguish areas with special access conditions, such as restricted areas or safety requirements when working on the factory floor.
IT scope and the intersection with OT
List the systems the Helpdesk is permitted to support directly, the items that are only for initial checking, and the systems that mandate escalation.
Limitations on access rights, configuration changes, and device restarts must be explicitly stated to avoid differing interpretations during deployment.
Support hours
Determine the shifts that require service, after-hours requirements, response times, and the capability to deploy Onsite personnel. Do not assume a business hours support package is suitable for every continuously operating factory.
IT, OT and vendor points of contact
There must be a contact list and responsibilities for each party, especially for systems affecting production operations. This list should also specify backup contacts when the primary person in charge is not working.
Remote access rights and approval process
Determine the utilized support tools, the group of devices permitted for access, and how to control work sessions. OT systems need to be handled according to the factory's separate policies.
SLA and major incident handling mechanism
Both sides need to agree on priority criteria, response times, escalation mechanisms, responsibilities for updating progress, and conditions for confirming completion.
Additionally, businesses should clearly distinguish metrics controlled by the Helpdesk from processing times dependent on the OT team, OEM, or third-party vendors.
An appropriate service proposal must demonstrate the tasks the Helpdesk is responsible for, the tasks requiring coordination, and the out-of-scope items. This forms the basis for the business to compare providers and limit the occurrence of responsibility disputes after signing the contract.
IT Helpdesk for businesses from IPSIP Vietnam
If your business needs to organize or outsource IT support operations at a factory, IPSIP provides IT Helpdesk & IT Support services with options for Remote, Onsite support, internal IT coordination, and SLA scope by agreement. Contact IPSIP to survey the number of users, locations, operational shifts, and the IT scope requiring support.
IT Helpdesk in a factory environment is not merely a service for fixing computer, account, or office network errors. The support model needs to be built based on user characteristics, operational shifts, the dependency level of production activities on IT systems, and the boundary of responsibilities between IT and OT.
An appropriate Helpdesk team does not necessarily have to handle every incident directly. The crucial element is knowing which scope allows intervention, when escalation is required, and which departments to coordinate with so that incidents are handled with the correct expertise, exact authority, and aligned with the factory's safety requirements.
References:
NIST SP 800-82 Rev. 3 – Guide to Operational Technology (OT) Security
NIST SP 800-82 Rev. 4 — Guide to Operational Technology (OT) Security (Initial Public Draft)
