IT Support for Manufacturers in Lockhart, TX

IT Support for Manufacturers in Lockhart, Texas: What a Plant Needs That an Office Doesn't

IT support for a manufacturer in Lockhart has to cover everything an office needs: working computers, patched software, protected email, backups and a help desk that answers. A plant also needs five things most offices never think about: separate networks for the office and the production floor, isolation for machines that can't be patched, a controlled way for equipment vendors to connect, tested backups of whatever runs production, and individual logins on the shop floor.

If you run an office in Lockhart, not a plant, our general post on IT services in Lockhart is the better place to start.

Lockhart has more plants than it used to

Lockhart is known for barbecue, but the city has spent years recruiting manufacturers.

The Lockhart Economic Development Corporation recruits advanced manufacturing, large-scale manufacturing and food processing. It owns the 75-acre Lockhart Industrial Park III next to SH 130, where McElroy Metal became the first tenant in 2020.

It isn't the only plant in town. Ziegenfelder, the Twin Pops maker, opened a 75,000-square-foot frozen treat plant in May 2025, its fourth nationwide. Pure Castings, an investment castings foundry, moved here from Austin in 2017 and has about 75 employees. Hill Country Foodworks employs 90 people at a 50,000-square-foot food plant on DeWitt Street, and in July 2026 the EDC announced an equipment grant to expand it.

Look at the headcounts. One plant has 75 people and another has 90, and the EDC's employer list puts Fashion Glass & Mirror at 102. At that size IT is often somebody's second job: the controller, the office manager, or the maintenance lead who is good with computers.

Naming those companies here doesn't mean we work with them. The details come from the EDC's public pages and the local paper.

Why manufacturers get hit more than other industries

IBM's X-Force team responds to breaches around the world and publishes its numbers every year. In its 2026 Threat Intelligence Index, manufacturing accounted for 27.7% of 2025 incidents among the industries it tracks. That was the largest share of any industry for the fifth year in a row.

IBM's explanation is that manufacturers sit in tightly linked supply chains and run complicated plant-floor technology, on top of holding designs worth stealing.

The more useful part is how the attackers got in. In IBM's manufacturing cases, the most common way in was a flaw in something exposed to the internet (32%), followed by stolen company logins (16%) and remote access services (11%). Data theft was the most common result, at 40% of cases.

Those numbers come from large incident response jobs worldwide, not from small Texas plants, so treat them as a guide to where to look first. Each one has a matching fix. Patch what faces the internet. Put multi-factor authentication (MFA) on logins. Lock down remote access.

What a plant needs that an office doesn't

Show Image Gaslight-Baker Theatre, downtown Lockhart. Photo: Larry D. Moore, CC BY 4.0, cropped and darkened.

Keep the office and the plant floor on separate networks

Your office runs information technology (IT): email, accounting, and the ERP system that tracks orders and inventory. Your floor runs operational technology (OT): programmable logic controllers (PLCs), operator panels (HMIs), CNC controllers, and the PCs attached to them. A small plant often ends up with all of it on one flat network, because that was the easy way to get the label printer talking to the ERP.

On a flat network, whatever lands on a front-office laptop can reach the floor. Take a hypothetical. Someone in accounts payable opens a bad attachment at 10 a.m. If the network is flat, the ransomware can reach the Windows PC that runs line two. If a firewall sits between the office and the floor, it stops at the office.

Show Image Southwest Museum of Clocks and Watches, Lockhart square. Photo: Larry D. Moore, CC BY 4.0, cropped and darkened.

Federal guidance says the same thing. In a May 2025 fact sheet, CISA, the FBI, the EPA and the Department of Energy listed five basic steps for protecting industrial systems:

Remove OT connections to the public internet.
Change default passwords and use strong, unique ones.
Secure remote access to OT networks.
Segment IT and OT networks.
Practice and maintain the ability to operate OT systems manually.

The fact sheet was written for critical infrastructure operators. Nothing on the list is specific to a power plant, though, and it works the same way in a 40-person fabrication shop.

Fence off the machines you can't patch

A CNC machine or a packaging line can run for twenty years. The Windows PC bolted to it won't get security updates for anything like that long. Microsoft ended support for Windows 10 on October 14, 2025, and a plant-floor PC may still run that or something older because the machine builder never certified a newer version.

You usually can't upgrade those PCs without the vendor, and nobody is going to scrap a working machine over its operating system. What you can do is isolate them. Put them on their own network segment, block them from the internet and from email, and allow only the connections the machine needs. Write down what each one is and who supports it. Then put the replacement on the capital plan so it isn't a surprise.

Give equipment vendors a controlled way in

Machine builders and integrators often support equipment remotely. That is useful, and it is also one of the entry points in IBM's data. Find out how each vendor connects today. A remote desktop tool left running on a floor PC with a shared password is the setup to look for.

CISA's advice is to move remote access onto a private connection where you can. Where you can't, use a VPN with phishing-resistant MFA, give each vendor only the access it needs, and disable accounts nobody uses. In practice that means a named account for each vendor, access that is switched on for a job and off afterward, and a log of who connected.

Back up what runs production, and test it

Office backups usually cover file shares and email. A plant has more to lose: the ERP or MRP database, CAD and CAM files, CNC programs, PLC programs, recipes, and quality and traceability records. Some of that lives on a server. Some of it may live only on the machine itself, or on a laptop the integrator left behind.

Ask two questions. Where is the current copy of each of those, and when did someone last restore one to prove it works? Then decide how long the plant can be down, counted in shifts, and check whether the backup can meet that. CISA's fifth item belongs here too. Know how to run by hand if the screens go dark, and practice it.

Sort out logins on the floor

A shared shop floor PC tends to have one login that everybody on the shift knows. MFA is awkward when operators wear gloves and phones aren't allowed on the line. It can still be done. Give each operator an account that signs in with a badge tap or a hardware security key. Set floor PCs up as kiosks that open only the application the station needs, and keep email and web browsing off them. Office staff, remote access and anything with admin rights should have MFA without exception. Our post on passkeys covers how sign-in without a password works.

Rules that may apply to a Texas manufacturer

None of this is legal advice. Check with your attorney or your contracting officer on how these apply to you.

Texas SB 2610: an optional safe harbor

Since September 1, 2025, Chapter 542 of the Texas Business and Commerce Code has rewarded smaller businesses that prepare. If a business with fewer than 250 employees is sued over a data breach, the plaintiff can't recover exemplary (punitive) damages if the business had a qualifying cybersecurity program in place when the breach happened.

What counts as qualifying depends on headcount:

Employees What the statute requires at that size
Fewer than 20 Simplified requirements, including password policies and employee cybersecurity training
20 to 99 Moderate requirements, including CIS Controls Implementation Group 1
100 to 249 Conformity with a recognized framework such as the NIST Cybersecurity Framework, NIST SP 800-171, the CIS Controls or ISO/IEC 27000

At every size the program also has to include administrative, technical and physical safeguards for personal data. The law covers businesses that hold sensitive personal information. Texas defines that as a name combined with a Social Security number, a driver's license number or financial account details, or as health information. For a manufacturer that usually means payroll and HR files. The safe harbor is optional. It does not remove other liability, and the chapter says it does not change any other legal duty.

Defense work: the CMMC audit phase is paused and the security rules still apply

If you make parts for a defense prime, you have heard of CMMC, the Pentagon's Cybersecurity Maturity Model Certification program. Its second phase would have made independent audits a condition of many contracts starting November 10, 2026. On July 13, 2026, the Pentagon suspended that phase and opened a review. When we wrote this in early October 2026, the review's recommendations had not been made public.

The rest did not change. Contracts that carry DFARS 252.204-7012, the defense clause on safeguarding covered information, still require the NIST SP 800-171 controls. Where a contract calls for a self-assessment, the score still has to be posted in the Supplier Performance Risk System (SPRS). The Pentagon has said it will keep enforcing those requirements through self-assessments and its own audits, and a prime can still ask its suppliers for more. A score you post is a statement to the government, so post one you can back up.

We are not a CMMC assessor, and CMMC certification is not a service we sell. The IT work underneath it (MFA, patching, endpoint protection, backups, documentation) is what our managed plans cover. For help with the assessment side, the Texas Manufacturing Assistance Center (TMAC), the state's NIST Manufacturing Extension Partnership center, assists manufacturers with DFARS cybersecurity.

Customers and insurers

Most small plants meet a security questionnaire before they meet a regulator. A large customer sends one, or the cyber insurance renewal asks about MFA, endpoint detection and tested backups. Answer those honestly. A wrong answer on an insurance application can matter when a claim is reviewed.

Questions to ask an IT provider before you sign
Will you map our network and tell us which devices are office and which are plant floor?
What do you do with a machine you can't install your software on?
How will our equipment vendors connect, and who approves each session?
When you test a restore, which systems do you restore, and do we see the result?
Who picks up at 2 a.m. when second shift has a problem?
How long does it take to get someone to our building?
Do shared shop floor PCs count as billable devices?
If we leave, do we keep the documentation and the passwords?

These apply to any provider, us included.

Where safemode IT fits

safemode IT is a managed IT and cybersecurity company in Kyle. Lockhart is about 30 minutes from our office by Highway 21 and Highway 142, and we cover Caldwell County along with Kyle, San Marcos, Austin and Bastrop.

Our managed IT plans cover the IT side of a plant: the office and shop floor PCs, Microsoft 365, and the firewalls and network equipment that connect them. Every plan includes 24/7 monitoring, patching, an unlimited help desk that is staffed around the clock, and a guaranteed 15-minute engineer response on support requests that is written into the agreement. That matters if you run a second or third shift. Our Fortress plan adds 24/7 security monitoring, endpoint detection that contains ransomware automatically, managed backup, and on-site support as needed at no extra charge. Both plans include monthly vulnerability scanning, which is how you find the internet-facing flaws IBM's data points to. Penetration testing is a separate engagement. Managed firewalls and network segmentation are part of our security stack. Redesigning a flat plant network is a project, and we quote projects in writing before any work starts.

Pricing is a flat monthly fee per device on a 36-month agreement. Shared computers and kiosks count as devices, and servers are quoted separately. Vendor management is included, so your internet provider and your software vendors call us instead of you.

We don't program PLCs, service CNC controllers or replace your machine builder. That equipment stays with your vendor or controls integrator, and we work with them on how it connects to the network.

If you already have an IT person, our co-managed IT service leaves them in place and adds after-hours coverage, monitoring and security tools.

If you want to talk it through, book a 10-minute discovery call or call 512-761-7652. If it looks like a fit, we review your network and security and send a written report ranked by what to fix first. The review is free and there is no obligation.

Common questions
Does a small plant need a separate network for the production floor?

Yes, if anything on the floor is connected to a network. Separation limits how far a problem in the office can spread, and CISA lists it among the five basics for industrial systems. How big a job it is depends on the switches and the firewall you already have.

What do we do with a machine that runs an unsupported version of Windows?

Keep running it and isolate it. Put it on its own network segment, block internet and email access, and restrict who can connect to it. Antivirus does not fix an operating system that no longer gets security patches. Plan the replacement with your machine vendor.

We have one IT person. Would a provider replace them?

Not under a co-managed arrangement. Your IT person keeps what they already own, and the provider covers what one person can't, such as after-hours calls and security monitoring.

Does the CMMC pause mean a defense supplier can stop working on security?

No. The pause covers third-party certification. NIST SP 800-171 under DFARS 252.204-7012 still applies, so do self-assessments and SPRS scores, and a prime can still ask for more.

Last updated: October 16, 2026