OT security on the factory floor, where IT rules don't simply apply.
Production lines, process automation and building management run on systems that last twenty years, can't be patched and are connected to the office network because that was convenient once. The Dutch Cybersecurity Act, an insurer, a customer or an incident at a fellow manufacturer suddenly makes that urgent, and IT doesn't know the factory and the factory doesn't trust IT. Within two days you'll have an experienced OT security specialist interviewed who speaks both languages and sets up the programme without halting the line. If you need someone permanently, we recruit that person just as well, though not within two days.
The moment
It's often a question from outside: the Dutch Cybersecurity Act naming manufacturing, chemicals and food as sectors, a major customer wanting to know how production is secured, an insurer asking about the connection between office and factory. Sometimes it's an incident at a fellow manufacturer that wakes up management. And then it turns out nobody knows exactly which systems are on the factory floor, which of them are reachable from the office, and who is actually responsible: the plant manager, the machine vendor, or IT. IT doesn't know the factory, the factory doesn't trust IT, and both are right.
Why OT is different from IT
On the factory floor availability comes before everything. An update that takes a server down for an hour is an inconvenience in the office and the loss of a day in production. Systems run on operating systems that are no longer maintained, vendors require remote access, and patching is only possible in the maintenance stop that comes twice a year. Security therefore lies not in updates but in visibility, separation and monitoring: knowing what's there, separating the factory from the office and from the internet, controlling remote access, and seeing when something deviates. The standard for that is IEC 62443, and whoever knows it can talk to the plant manager and the IT manager alike. That profile is scarce, which is why interim is often the only way to start quickly here.
What needs to happen now
- Inventory. Which systems are there, whose are they, how old, how connected. Not from the documentation but from reality. The OT specialist, with the technical department, in the first weeks.
- Separation from office and internet. A zone layout according to IEC 62443, with controlled transitions instead of a flat connection. The OT architect with the network administrators.
- Remote access. Vendors doing remote maintenance through one managed entry point with logging, instead of ten modems and VPNs of their own. The OT engineer with procurement and the vendors.
- Monitoring. Passive monitoring that sees what happens in the OT network without disturbing it, and an agreement on who watches. OT engineer with the SOC or the external party.
- Policy and evidence. Who is responsible for what, what the rules are for maintenance and new machines, and the evidence for regulator, customer and insurer. The industrial security officer, with the plant manager.
Who leads this
Manufacturers here look for an OT security specialist or engineer who carries out the inventory and the measures, an OT security architect for the zone layout and the separation, and sometimes a security officer with industrial experience for policy and evidence. The profile is scarce; we therefore say honestly when we don't have anyone who fits your process. If you need someone permanently, that's simply permanent recruitment; for the programme it's interim. We've been doing both for years.
Interim: within two days, and what it costs
Fast doesn't mean sloppy. We start with a proper intake: which environment, which trigger, which vendors, who this person needs to bring along on the factory side. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.
Freelance, and the Dutch DBA Act
Setting up an OT security programme is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. If it turns out after the programme that the factory structurally needs an OT security engineer, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.
Call today?.
Call us, or book a slot yourself. Within fifteen minutes you'll know whether we can help and who the right person is.
Call: 020 399 1●●●
Available for interim now.
A selection of the interim professionals who can start right now. Anonymous until you get in touch; rate and availability are listed.
NIS2 / Cyberbeveiligingswet · DORA · SOX (ITGC)
- interim · €95k–100k gross per year
ISO 27001 · ISO 27002 · NIS2 / Cyberbeveiligingswet
- Interim / Freelance · €120–130 per hour
ISO 27001 · NIS2 / Cyberbeveiligingswet · AVG/GDPR
- Arnhem-Nijmegen
- interim / freelance · €120–130 per hour
Frequently asked questions.
How fast can you provide an OT security specialist?
For interim: within two days you'll have your first candidate interviewed; for a permanent role it takes longer, because the best candidates are rarely actively looking and have to be moved with the right arguments; we discuss what's realistic at the intake. We start with an intake about the environment, the trigger and the vendors, then search a network of interim professionals we have usually known for years. OT security is a scarce profile; if we don't have anyone who fits your process, we'll say so honestly.
Does our factory fall under the Dutch Cybersecurity Act?
Manufacturing, chemicals and food are in annex 2 of the Act, so from fifty employees or with both turnover and balance sheet total above ten million euros the chances are high. Whether you fall under it is a legal question; the RDI's self-assessment gives the answer. If the factory is in scope, OT security is a direct fulfilment of the duty of care; also see our page on NIS2 and the Act.
Can security be put in order without halting production?
Yes, if done well. OT security lies not in updates but in visibility, separation and monitoring: knowing what's there, separating the factory from office and internet, controlling remote access and watching passively. Almost all of that is possible without touching the line; what does require a maintenance stop is planned into it.
Freelance, secondment or permanent: what suits OT security?
Setting up the programme is an assignment with a clear beginning and end, and then a freelancer with a model agreement fits well. If it turns out afterwards that the factory structurally needs an OT security engineer, we'll say so and recruit that person permanently. If you really want someone temporarily on payroll, secondment is possible, although it isn't our core business.
What does an interim OT security specialist cost?
That depends on the person and the assignment, and you always see the professional's rate separately from our margin. That margin is never more than €15 per hour on a full-time assignment. The rate bands of who is currently available are listed anonymously with the interim professionals on this site.
Our machine vendors want remote access. How do you arrange that securely?
Through one managed entry point with logging and per-session approval, instead of ten modems and VPNs of their own that nobody oversees. That's usually one of the first measures, because it removes the biggest risk without touching production. An OT engineer arranges it with procurement and the vendors, and sets it out in the contracts.
What is IEC 62443 and do we have to comply with it?
IEC 62443 is the international standard for securing industrial automation, with a zone layout and security levels per zone. It isn't a legal obligation, but it is the framework customers, insurers and regulators recognise, and it aligns well with the duty of care under the Dutch Cybersecurity Act. An OT specialist who knows the standard uses it as a practical roadmap, not as a paper tiger.
Our IT department and the factory talk past each other. Does an external person help with that?
That's often the main reason to bring in someone from outside. A good OT specialist speaks both languages: they understand why the plant manager doesn't want an update and why IT doesn't want a flat connection, and find the measures both say yes to. Without that bridge the programme gets stuck on who is actually in charge.
Getting the factory in order without downtime?
Tell us which environment it is and what the trigger is. If you need an interim professional, your first candidate is interviewed within two days — and if we don't have anyone who fits, we'll say so.