Security & connectivity
Should CNC machines be air-gapped or network-segmented?
Updated
DNC-MaxOT-MaxNetwork segmentation
Direct answer
The answer depends on production and compliance needs. Air gaps reduce network exposure but do not eliminate risks such as uncontrolled USB. Segmentation usually offers a more usable middle ground: isolate CNCs in dedicated zones, permit only required endpoints and protocols, and centralize transfers through a controlled service or gateway.
Practical checkpoint
Document every legitimate communication path before choosing the boundary; an undocumented exception usually becomes the workaround that defeats it.