Operational Technology (OT) Network Design and Management

Serving Coastal Carolina and Georgia Facilities

CloudCentric is a managed IT provider in Mount Pleasant, South Carolina, serving businesses across Charleston and the Lowcountry. We can be reached at (844) 422-7000. We design, repair, and manage the networks that run plant floors, terminals, warehouses, and water plants, known as operational technology (OT) networks.

Our service area covers the Charleston port's terminals, which include Wando Welch in Mount Pleasant, North Charleston, Columbus Street, Union Pier, Veterans, and the Hugh K. Leatherman terminal that opened in March 2021. We also deploy networks for large warehouses and distribution centres that have recently been built in Summerville and Ridgeville near Charleston.

We serve operations around Savannah, including large warehouses recently built in Pooler, Garden City, and Effingham. The Georgia Ports Authority describes its Garden City Terminal in Savannah as the largest single-terminal container operation in the Western Hemisphere, operating 34 ship-to-shore and 238 rubber-tyred gantry cranes, according to a fact sheet dated September 3, 2026. The Savannah region's manufacturers include Gulfstream Aerospace, International Paper, JCB, and the Hyundai Motor Group Metaplant America in Ellabell, Bryan County.

Securing OT Networks and Addressing Vulnerabilities

CISA, the FBI, the EPA, and the DOE published five primary OT mitigations on May 6, 2025: remove OT connections to the public internet, change default passwords, secure remote access, segment IT and OT networks, and practise running OT manually. We conduct an OT network assessment that produces a drawing of what is connected, where unmanaged switches sit, which devices reach the internet or a cellular modem, and every remote-access path.

On July 30, 2026, CISA warned that attackers were changing PLC passwords and IP addresses at water and wastewater systems, noting that undocumented cellular modems installed by operators, vendors, or integrators were being targeted. CISA advisory AA26-097A, updated July 22, 2026, reports attackers reaching internet-facing Allen-Bradley CompactLogix and Micro850, Schneider Modicon M340, and Siemens S7-1200 controllers. Furthermore, CISA advisory AA26-231A, issued August 19, 2026, describes active reconnaissance against Siemens S7 controllers over TCP port 102 and asks owners to block that port at the perimeter.

Meeting Maritime and Water Utility Regulations

The Coast Guard's maritime cybersecurity rule (90 FR 6298), published January 17, 2025, and effective July 16, 2025, covers MTSA-regulated facilities, which include many terminals and waterfront plants. Under that rule, a covered facility must submit a Cybersecurity Plan to the Coast Guard by July 16, 2027, and the facility must separate its IT and OT networks. The rule also requires that HMIs and other OT hardware be secured, monitored, and logged for personnel access.

CloudCentric does not write Coast Guard Cybersecurity Plans and gives no legal advice. We supply the network map, network separation, logged remote access, and access control that a plan describes.

For water utilities, community water systems serving more than 3,300 people must certify a risk and resilience assessment and an emergency response plan to the EPA under America's Water Infrastructure Act, covering their computer systems too.

Building the Network with UniFi Industrial

Our work is built on UniFi equipment, which includes Ubiquiti's industrial line of DIN-rail switches, an industrial gateway, an industrial Wi-Fi access point, and an industrial cellular router. Ubiquiti announced the UniFi Industrial family on October 8, 2026, featuring a new DIN-rail switch line, the U7 Industrial access point, and an Industrial Gateway introduced earlier in 2026. UniFi charges no licence fee for the network, camera, or door software; the hardware is bought once.

UniFi switches, gateways, cameras, and door readers are managed from one console, allowing the plant network, cameras, and doors to sit on the same screen. To meet requirements for access logging, UniFi door readers and cameras log entry to the rooms holding the OT hardware.

Separating plant and office networks puts controllers and HMIs on their own VLANs, with a firewall between zones on the UCG-Industrial gateway. The UCG-Industrial gateway lists a 5 Gbps IDS/IPS, a zone-based firewall, site-to-site VPN using IPsec, OpenVPN, or Site Magic, and failover to an LTE backup connection. Vendor and integrator remote access is moved off modems on controllers and onto a VPN through the firewall, where it is limited to listed sources.

PLC Integration and Control Panel Hardware

We work on the network alongside the plant's own controls engineers or integrator, and re-addressing a controller is coordinated with whoever maintains its program. Our PLC support covers Allen-Bradley and Siemens controllers on a UniFi network, handling addressing, EtherNet/IP and PROFINET traffic, connectivity, and backups of PLC programs. CloudCentric holds no partner, certification, or authorised-integrator status with Rockwell Automation, Allen-Bradley, or Siemens; the brand names identify the equipment we work on.

The USW-Industrial-DIN-8 switch takes 12 to 60 V DC on two inputs, so it runs from the 24 V DC supply already found in most control cabinets. The industrial DIN-rail switches run from -30 to 70 °C, have aluminium enclosures and no fan, and carry a dry-contact alarm relay for watching an external power supply.

Site Wireless, Bridging, and Cameras

The U7 Industrial access point is rated IP67 and runs from -40 to 70 °C, featuring a directional antenna and optional reflectors for long aisles, yards, and docks. We use bridges such as the UDB-Pro, which reaches up to 5 km, and the 60 GHz UBB-XG, which delivers up to 6 Gbps over 500 m, to link guard shacks, pump stations, and outbuildings without trenching.

For site surveillance, the AI PTZ Industrial camera (UVC-AI-PTZ) records 4K with 22x optical zoom, 100 m infrared, and an IP66 rating for monitoring yards, docks, and fence lines.

Technical Limits and Design Scope

The industrial switches and gateway carry no IP rating and are installed inside an enclosure or cabinet. No UniFi product carries a hazardous-location rating such as Class I Division 2, ATEX, or IECEx; UniFi gear goes in unclassified rooms and never in fuel, dust, or chemical classified areas.

The UniFi DIN-rail switches are Layer 2 only, so routing between zones happens at the gateway. The UniFi industrial switches list STP and RSTP only and support no ring redundancy protocol such as ERPS, MRP for PROFINET, or DLR for EtherNet/IP; redundancy comes from dual power inputs and paired uplinks, not a ring.

No UniFi product is certified to IEC 62443. While a network design can follow the standard's zones-and-conduits approach, nothing is described as 62443 certified. Additionally, no UniFi page says the gateway firewall or IDS/IPS understands industrial protocols such as Modbus/TCP, EtherNet/IP, S7comm, PROFINET, or DNP3, meaning rules between zones are written by address and port.

Finally, UniFi gear lists no substation approvals like IEC 61850-3 or IEEE 1613, and no marine approvals, which puts utility protection networks out of our scope.