cloud

In industrial and manufacturing contexts, cloud commonly refers to computing services delivered over a network from shared, remotely hosted infrastructure instead of on local, on‑premise hardware. These services are typically provided by a third party and accessed via the internet or a private network.

Core meaning

Cloud usually includes three broad service models:

• Infrastructure as a Service (IaaS): Virtual machines, storage, and networks hosted by a provider, used like remote data centers.
• Platform as a Service (PaaS): Managed platforms for building, deploying, and running applications without managing servers directly.
• Software as a Service (SaaS): Complete applications delivered via a browser or API, such as quality systems, asset management, or analytics tools.

In regulated manufacturing and OT/IT environments, cloud services may host or process data related to production, quality, maintenance, or business planning, but the physical control of equipment typically remains on premises or at the edge.

How it appears in operations

• Data collection and historian offload: Sending production or sensor data from plant-floor systems or historians to a cloud environment for storage, reporting, or advanced analytics.
• Manufacturing and quality applications: Using cloud-hosted MES modules, LIMS, QMS, OEE dashboards, or maintenance management systems accessed from multiple sites.
• ERP and planning: Many ERP and supply chain systems are delivered as cloud services and exchange data with on-premise MES or OT systems.
• Remote access to OT: Secure connectivity patterns where an OT zone communicates with a cloud service for monitoring, anomaly detection, or patch and configuration management.

From a security and compliance perspective, many industrial standards and frameworks treat the cloud as another network zone or external system that must be risk-assessed, segmented, monitored, and governed. This includes defining data flows, access controls, and responsibilities between the manufacturer and the cloud provider.

What cloud does not necessarily mean

• It does not inherently mean that systems are public or unsecured. Private, community, and hybrid clouds are common in industrial use.
• It does not automatically replace on-premise control systems. Critical OT control functions often remain local, with the cloud used for supervisory, analytical, or business functions.
• It does not guarantee specific performance, resilience, or compliance characteristics. These depend on design, configuration, and contractual controls.

Common confusion

• Cloud vs. on-premise virtualization: A virtualized data center inside a plant is not typically called “cloud” unless it uses cloud-like service models (self-service, elastic scaling, metering).
• Cloud vs. edge: Edge computing runs closer to equipment (for example, on gateways or industrial PCs). Edge systems may connect to the cloud but are distinct from the cloud itself.
• Cloud provider vs. cloud service: A single provider can offer many distinct services (storage, messaging, analytics). Risk and integration considerations often apply at the individual service level, not only at the provider level.

Link to OT cybersecurity standards context

When industrial cybersecurity standards discuss cloud in relation to OT environments, they generally treat any cloud-hosted system as an external or separate zone. Cloud connections to control networks are typically subject to the same principles as other external connections: segmentation, least-privilege access, secure protocols, and documented governance for lifecycle management.